Help us shape the future of Go! Take the 2026 Go Developer Survey

customclaim

package
v0.0.12 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 20, 2026 License: Apache-2.0, MIT Imports: 21 Imported by: 0

Documentation

Overview

Package customclaim manages per-user and per-group key/value claims injected into OIDC tokens. The federation oidc package consumes them at token time via a consumer-side adapter.

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrNotFound  = errors.New("custom claim not found")
	ErrDuplicate = errors.New("custom claim already exists for this owner")
)

Errors surfaced by the store; the handler maps them to statuses.

Functions

This section is empty.

Types

type CustomClaim

type CustomClaim struct {
	ID    CustomClaimID `json:"id"`
	Key   string        `json:"key"`
	Value string        `json:"value"`

	UserID      *string `json:"user_id,omitzero"`
	UserGroupID *string `json:"user_group_id,omitzero"`

	CreatedAt time.Time `json:"created_at"`
}

CustomClaim is one key/value claim attached to a user or a group (exactly one owner, enforced by the database CHECK). Keys are case-sensitive; uniqueness is (key, user, group) — Postgres treats NULLs as distinct in the UNIQUE constraint, so the service checks duplicates up front.

type CustomClaimID

type CustomClaimID = typeid.TypeID[customClaimPrefix]

Typed IDs for the custom claim tables: UUIDv7 suffix, snake_case prefix matching the singular table name.

type PostgresStore

type PostgresStore struct {
	// contains filtered or unexported fields
}

PostgresStore persists claims in public.custom_claims. It keeps the parent Store for WithTx (list-replace runs in a transaction).

func NewPostgresStore

func NewPostgresStore(store datastore.Store) *PostgresStore

NewPostgresStore builds the production claim store.

func (*PostgresStore) Create

func (s *PostgresStore) Create(ctx context.Context, params UpsertParams) (CustomClaim, error)

Create inserts one claim; uuidv7() fills the ID.

func (*PostgresStore) Delete

func (s *PostgresStore) Delete(ctx context.Context, id CustomClaimID) error

Delete removes one claim.

func (*PostgresStore) ExistsForOwner

func (s *PostgresStore) ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)

ExistsForOwner reports whether the (key, owner) pair is present.

func (*PostgresStore) ListByGroup

func (s *PostgresStore) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)

ListByGroup returns one group's claims.

func (*PostgresStore) ListByUser

func (s *PostgresStore) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)

ListByUser returns one user's claims, by key then value.

func (*PostgresStore) ReplaceForGroup

func (s *PostgresStore) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForGroup swaps a group's whole claim set atomically.

func (*PostgresStore) ReplaceForUser

func (s *PostgresStore) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForUser swaps a user's whole claim set atomically.

func (*PostgresStore) SuggestedKeys

func (s *PostgresStore) SuggestedKeys(ctx context.Context) ([]string, error)

SuggestedKeys lists distinct claim keys, most used first.

func (*PostgresStore) Update

func (s *PostgresStore) Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)

Update replaces the value of one claim.

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service holds the claim business rules and HTTP surface.

func NewService

func NewService(store Store, recorder identity.Recorder, opts ...ServiceOption) *Service

NewService builds the claim feature on the given store.

func (*Service) CreateForGroup

func (s *Service) CreateForGroup(ctx context.Context, groupID usergroup.UserGroupID, params UpsertParams) (CustomClaim, error)

CreateForGroup attaches a claim to one group.

func (*Service) CreateForUser

func (s *Service) CreateForUser(ctx context.Context, userID user.UserID, params UpsertParams) (CustomClaim, error)

CreateForUser attaches a claim to one user.

func (*Service) Delete

func (s *Service) Delete(ctx context.Context, id CustomClaimID) error

Delete removes one claim.

func (*Service) ListByGroup

func (s *Service) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)

ListByGroup returns one group's claims.

func (*Service) ListByUser

func (s *Service) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)

ListByUser returns one user's claims.

func (*Service) Name

func (s *Service) Name() string

Name names the feature for logs.

func (*Service) RPCService added in v0.0.12

func (s *Service) RPCService() (string, http.Handler)

RPCService returns the Connect registration for the custom claim surface.

func (*Service) ReplaceForGroup

func (s *Service) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForGroup swaps a group's whole claim set.

func (*Service) ReplaceForUser

func (s *Service) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForUser swaps a user's whole claim set. Owner scoping is applied to every item; duplicate keys inside one call are rejected before touching the database.

func (*Service) SuggestedKeys

func (s *Service) SuggestedKeys(ctx context.Context) ([]string, error)

SuggestedKeys lists distinct claim keys already in use.

func (*Service) UpdateValue

func (s *Service) UpdateValue(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)

UpdateValue replaces one claim's value.

type ServiceOption

type ServiceOption func(*Service)

ServiceOption configures the claim feature.

type Store

type Store interface {
	Create(ctx context.Context, params UpsertParams) (CustomClaim, error)
	ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)
	Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
	Delete(ctx context.Context, id CustomClaimID) error
	ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
	ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
	// ReplaceForOwner swaps the whole claim set for the owner in one
	// transaction.
	ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
	ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
	SuggestedKeys(ctx context.Context) ([]string, error)
}

Store persists custom claims scoped to users or groups.

type UpsertParams

type UpsertParams struct {
	Key         string
	Value       string
	UserID      *string
	UserGroupID *string
}

UpsertParams carries the claim fields for one owner scope.

func (*UpsertParams) Validate

func (p *UpsertParams) Validate() error

Validate normalizes and enforces the claim shape.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL