Documentation
¶
Overview ¶
Package customclaim manages per-user and per-group key/value claims injected into OIDC tokens. The federation oidc package consumes them at token time via a consumer-side adapter.
Index ¶
- Variables
- type CustomClaim
- type CustomClaimID
- type PostgresStore
- func (s *PostgresStore) Create(ctx context.Context, params UpsertParams) (CustomClaim, error)
- func (s *PostgresStore) Delete(ctx context.Context, id CustomClaimID) error
- func (s *PostgresStore) ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)
- func (s *PostgresStore) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
- func (s *PostgresStore) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
- func (s *PostgresStore) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
- func (s *PostgresStore) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
- func (s *PostgresStore) SuggestedKeys(ctx context.Context) ([]string, error)
- func (s *PostgresStore) Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
- type Service
- func (s *Service) CreateForGroup(ctx context.Context, groupID usergroup.UserGroupID, params UpsertParams) (CustomClaim, error)
- func (s *Service) CreateForUser(ctx context.Context, userID user.UserID, params UpsertParams) (CustomClaim, error)
- func (s *Service) Delete(ctx context.Context, id CustomClaimID) error
- func (s *Service) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
- func (s *Service) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
- func (s *Service) Name() string
- func (s *Service) RPCService() (string, http.Handler)
- func (s *Service) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
- func (s *Service) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
- func (s *Service) SuggestedKeys(ctx context.Context) ([]string, error)
- func (s *Service) UpdateValue(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
- type ServiceOption
- type Store
- type UpsertParams
Constants ¶
This section is empty.
Variables ¶
var ( ErrNotFound = errors.New("custom claim not found") ErrDuplicate = errors.New("custom claim already exists for this owner") )
Errors surfaced by the store; the handler maps them to statuses.
Functions ¶
This section is empty.
Types ¶
type CustomClaim ¶
type CustomClaim struct {
ID CustomClaimID `json:"id"`
Key string `json:"key"`
Value string `json:"value"`
UserID *string `json:"user_id,omitzero"`
UserGroupID *string `json:"user_group_id,omitzero"`
CreatedAt time.Time `json:"created_at"`
}
CustomClaim is one key/value claim attached to a user or a group (exactly one owner, enforced by the database CHECK). Keys are case-sensitive; uniqueness is (key, user, group) — Postgres treats NULLs as distinct in the UNIQUE constraint, so the service checks duplicates up front.
type CustomClaimID ¶
Typed IDs for the custom claim tables: UUIDv7 suffix, snake_case prefix matching the singular table name.
type PostgresStore ¶
type PostgresStore struct {
// contains filtered or unexported fields
}
PostgresStore persists claims in public.custom_claims. It keeps the parent Store for WithTx (list-replace runs in a transaction).
func NewPostgresStore ¶
func NewPostgresStore(store datastore.Store) *PostgresStore
NewPostgresStore builds the production claim store.
func (*PostgresStore) Create ¶
func (s *PostgresStore) Create(ctx context.Context, params UpsertParams) (CustomClaim, error)
Create inserts one claim; uuidv7() fills the ID.
func (*PostgresStore) Delete ¶
func (s *PostgresStore) Delete(ctx context.Context, id CustomClaimID) error
Delete removes one claim.
func (*PostgresStore) ExistsForOwner ¶
func (s *PostgresStore) ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)
ExistsForOwner reports whether the (key, owner) pair is present.
func (*PostgresStore) ListByGroup ¶
func (s *PostgresStore) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
ListByGroup returns one group's claims.
func (*PostgresStore) ListByUser ¶
func (s *PostgresStore) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
ListByUser returns one user's claims, by key then value.
func (*PostgresStore) ReplaceForGroup ¶
func (s *PostgresStore) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
ReplaceForGroup swaps a group's whole claim set atomically.
func (*PostgresStore) ReplaceForUser ¶
func (s *PostgresStore) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
ReplaceForUser swaps a user's whole claim set atomically.
func (*PostgresStore) SuggestedKeys ¶
func (s *PostgresStore) SuggestedKeys(ctx context.Context) ([]string, error)
SuggestedKeys lists distinct claim keys, most used first.
func (*PostgresStore) Update ¶
func (s *PostgresStore) Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
Update replaces the value of one claim.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service holds the claim business rules and HTTP surface.
func NewService ¶
func NewService(store Store, recorder identity.Recorder, opts ...ServiceOption) *Service
NewService builds the claim feature on the given store.
func (*Service) CreateForGroup ¶
func (s *Service) CreateForGroup(ctx context.Context, groupID usergroup.UserGroupID, params UpsertParams) (CustomClaim, error)
CreateForGroup attaches a claim to one group.
func (*Service) CreateForUser ¶
func (s *Service) CreateForUser(ctx context.Context, userID user.UserID, params UpsertParams) (CustomClaim, error)
CreateForUser attaches a claim to one user.
func (*Service) Delete ¶
func (s *Service) Delete(ctx context.Context, id CustomClaimID) error
Delete removes one claim.
func (*Service) ListByGroup ¶
func (s *Service) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
ListByGroup returns one group's claims.
func (*Service) ListByUser ¶
ListByUser returns one user's claims.
func (*Service) RPCService ¶ added in v0.0.12
RPCService returns the Connect registration for the custom claim surface.
func (*Service) ReplaceForGroup ¶
func (s *Service) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
ReplaceForGroup swaps a group's whole claim set.
func (*Service) ReplaceForUser ¶
func (s *Service) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
ReplaceForUser swaps a user's whole claim set. Owner scoping is applied to every item; duplicate keys inside one call are rejected before touching the database.
func (*Service) SuggestedKeys ¶
SuggestedKeys lists distinct claim keys already in use.
func (*Service) UpdateValue ¶
func (s *Service) UpdateValue(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
UpdateValue replaces one claim's value.
type Store ¶
type Store interface {
Create(ctx context.Context, params UpsertParams) (CustomClaim, error)
ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)
Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
Delete(ctx context.Context, id CustomClaimID) error
ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
// ReplaceForOwner swaps the whole claim set for the owner in one
// transaction.
ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
SuggestedKeys(ctx context.Context) ([]string, error)
}
Store persists custom claims scoped to users or groups.
type UpsertParams ¶
UpsertParams carries the claim fields for one owner scope.
func (*UpsertParams) Validate ¶
func (p *UpsertParams) Validate() error
Validate normalizes and enforces the claim shape.