auth

package
v1.17.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 11, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source 
const KeychainBackendUnavailableMarker = "keychain: OS keychain unavailable"

KeychainBackendUnavailableMarker is the stable wrap prefix dry/keychain.New emits when no OS keyring backend is reachable (e.g. WSL without DBus, headless Linux without secret-service). We treat this as "no credentials in this layer" so the chain continues to the no-creds hint instead of stopping with a confusing backend error. Exported so tests can construct fixtures that match.

Variables

View Source 
var ErrIncompleteCredentials = errors.New("auth: credentials incomplete")

ErrIncompleteCredentials signals that a source held one half of a credential pair (API key XOR tenant). The user clearly intended to use that source; we stop the chain rather than falling through to layers that wouldn't help.

View Source 
var ErrNoCredentials = errors.New("auth: no credentials configured")

ErrNoCredentials is returned when no source in the resolution chain has both an API key and a tenant identifier configured. Sources that hold no credentials report this sentinel so the layered resolver can fall through to the next source. Real backend failures (a keychain that errored out, a corrupt config file) propagate verbatim and stop the chain — they are not "no credentials", they are a broken source.

Functions

func ApiKey 

func ApiKey() string

func ApiUrl 

func ApiUrl() string

func CloudAccessToken added in v1.8.0 

func CloudAccessToken() string

func CloudIdentityServiceAudience added in v1.8.0 

func CloudIdentityServiceAudience() string

func CloudIdentityServiceBaseUrl added in v1.8.0 

func CloudIdentityServiceBaseUrl() string

func CloudIdentityServiceClientId added in v1.8.0 

func CloudIdentityServiceClientId() string

func CloudIdentityServiceDeviceCodeUrl added in v1.8.0 

func CloudIdentityServiceDeviceCodeUrl() string

func CloudIdentityServiceTokenUrl added in v1.8.0 

func CloudIdentityServiceTokenUrl() string

func CloudRefreshToken added in v1.8.0 

func CloudRefreshToken() string

func CommunityMode added in v1.0.0 

func CommunityMode() bool

func CommunityServicesApiUrl added in v1.10.1 

func CommunityServicesApiUrl() string

func ControlPlaneClientConnection added in v1.8.0 

func ControlPlaneClientConnection(name string) (*grpc.ClientConn, error)

Create a gRPC client connection for the control plane based on available configuration

func ControlTowerUrl added in v1.8.0 

func ControlTowerUrl() string

func DataPlaneUrl added in v1.8.9 

func DataPlaneUrl() string

func DefaultApiUrl 

func DefaultApiUrl() string

func DefaultCommunityApiUrl added in v1.0.0 

func DefaultCommunityApiUrl() string

func HasEntitlements added in v1.13.0 

func HasEntitlements(entitlementsFeatures ...v1.Feature) bool

HasEntitlements checks if the current tenant has the specified entitlements This always depends on cached entitlements and never calls the API directly

func InsightsApiV2Url added in v1.8.3 

func InsightsApiV2Url() string

func InsightsV2ClientConnection added in v1.8.3 

func InsightsV2ClientConnection(name string) (*grpc.ClientConn, error)

func InsightsV2CommunityClientConnection added in v1.11.2 

func InsightsV2CommunityClientConnection(name string) (*grpc.ClientConn, error)

func IsAccessTokenExpired added in v1.12.3 

func IsAccessTokenExpired() (bool, error)

func LoadEntitlements added in v1.13.0 

func LoadEntitlements() error

LoadEntitlements loads and caches entitlements for the current tenant If this fails, then no credential is available and the app should switch to community mode

func MalwareAnalysisClientConnection added in v1.8.9 

func MalwareAnalysisClientConnection(name string) (*grpc.ClientConn, error)

func MalwareAnalysisCommunityClientConnection added in v1.10.1 

func MalwareAnalysisCommunityClientConnection(name string) (*grpc.ClientConn, error)

func PersistApiKey added in v1.8.0 

func PersistApiKey(key, domain string) error

func PersistCloudTokens added in v1.8.0 

func PersistCloudTokens(accessToken, refreshToken, domain string) error

func PersistTenantDomain added in v1.8.0 

func PersistTenantDomain(domain string) error

func RefreshCloudSession added in v1.12.3 

func RefreshCloudSession() error

func SetRuntimeApiKey added in v1.8.0 

func SetRuntimeApiKey(key string)

func SetRuntimeCloudTenant added in v1.8.0 

func SetRuntimeCloudTenant(domain string)

func SetRuntimeCommunityMode added in v1.5.9 

func SetRuntimeCommunityMode()

SetRuntimeCommunityMode sets the runtime mode to community without persisting it to the configuration file.

func ShouldCheckAccessTokenExpiry added in v1.12.3 

func ShouldCheckAccessTokenExpiry() bool

func SyncApiUrl added in v1.8.0 

func SyncApiUrl() string

func SyncClientConnection added in v1.8.0 

func SyncClientConnection(name string) (*grpc.ClientConn, error)

func TenantDomain added in v1.8.0 

func TenantDomain() string

func Verify 

func Verify() error

Verify authentication to the data plane using API key and Ping Service.

Types

type Config 

type Config struct {
	ApiUrl                    string    `yaml:"api_url"`
	ApiKey                    string    `yaml:"api_key"`
	Community                 bool      `yaml:"community"`
	DataPlaneApiUrl           string    `yaml:"data_plane_api_url"`
	ControlPlaneApiUrl        string    `yaml:"control_api_url"`
	SyncApiUrl                string    `yaml:"sync_api_url"`
	InsightsApiV2Url          string    `yaml:"insights_api_v2_url"`
	CommunityServicesApiUrl   string    `yaml:"community_services_api_url"`
	TenantDomain              string    `yaml:"tenant_domain"`
	CloudAccessToken          string    `yaml:"cloud_access_token"`
	CloudRefreshToken         string    `yaml:"cloud_refresh_token"`
	CloudAccessTokenUpdatedAt time.Time `yaml:"cloud_access_token_updated_at"`
}

func DefaultConfig added in v1.8.0 

func DefaultConfig() Config

type Credentials added in v1.17.0 

type Credentials struct {
	APIKey   string
	TenantID string
}

Credentials carries the data-plane API key plus the tenant identifier the resolver chain produces. Field names mirror the existing helpers in auth.go so downstream code can adopt the resolver without adapter glue.

type Option added in v1.17.0 

type Option func(*layeredResolver)

Option configures NewLayeredResolver. The only documented option today is WithSource which appends an extra layer; we keep Option as a functional option so future extensions slot in without changing the constructor's signature.

func WithSource added in v1.17.0 

func WithSource(s source) Option

WithSource appends a custom source to the layered resolver. The source is consulted after the documented defaults in the order it was passed. Tests use this to inject deterministic stubs without reaching into package internals.

type Resolver added in v1.17.0 

type Resolver interface {
	Resolve(ctx context.Context) (Credentials, error)
}

Resolver discovers credentials at request time. Implementations must be safe to call concurrently when the underlying sources are.

func NewLayeredResolver added in v1.17.0 

func NewLayeredResolver(opts ...Option) Resolver

NewLayeredResolver returns a Resolver that walks credential sources in order:

  1. vet env vars + vet-auth.yml (via auth.ApiKey / auth.TenantDomain; covers SAFEDEP_API_KEY / SAFEDEP_TENANT_ID and their VET_ aliases).
  2. DRY keychain provider, constructed without an insecure file fallback.

A source that reports ErrNoCredentials triggers a fall-through; any other error stops the chain immediately. When every source is empty the resolver returns ErrNoCredentials so callers can branch on the sentinel.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.