Documentation
¶
Overview ¶
Package security defines protocol-neutral authentication and authorization capabilities for Tacklr servers. server.Protocol implementations translate their wire formats into Attempt and Operation values; this package never interprets ACP, JSON-RPC, or HTTP types.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrAuthenticationRequired means no authenticated principal is available. ErrAuthenticationRequired = errors.New("authentication required") // ErrAuthenticationFailed means supplied credentials were rejected. ErrAuthenticationFailed = errors.New("authentication failed") // ErrAuthorizationDenied means the principal cannot perform an operation. ErrAuthorizationDenied = errors.New("authorization denied") )
Functions ¶
This section is empty.
Types ¶
type Attempt ¶
type Attempt struct {
Scheme string
Credential Secret
Binding ChannelBinding
}
Attempt is the canonical input to a host Authenticator.
type Authenticator ¶
Authenticator verifies an authentication attempt supplied by a protocol or transport adapter.
type Authorizer ¶
Authorizer decides whether a principal can perform an operation.
type ChannelBinding ¶
ChannelBinding identifies the logical channel on which authentication occurred. Values are transport-neutral and contain no credential material.
type Context ¶
type Context struct {
Principal Principal
Binding ChannelBinding
}
Context is the authenticated state propagated through server connections.
func (Context) Authenticated ¶
Authenticated reports whether this context contains a valid principal.
type Principal ¶
type Principal struct {
Subject string
}
Principal is the stable, opaque identity returned by a host Authenticator. Subject must be stable across reconnects when durable sessions can be loaded.
func NewPrincipal ¶
NewPrincipal constructs a Principal and rejects an empty subject.
type Secret ¶
type Secret struct {
// contains filtered or unexported fields
}
Secret is ephemeral credential material. Its String and GoString methods are deliberately redacted so ordinary structured logging cannot reveal it.
type Service ¶
type Service struct {
Authenticator Authenticator
Authorizer Authorizer
}
Service coordinates host-provided authentication and authorization without knowing how any protocol represents credentials or errors.
func (*Service) Authenticate ¶
Authenticate delegates to the host and validates its returned invariant.
Source Files