llmendpoint

package
v0.0.36 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 14, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Overview

Package llmendpoint validates host-internal native LLM endpoint identities and confines gateway request URLs before credential retrieval.

Index

Constants

View Source
const (
	// CredentialNamespace is the isolated encrypted native-provider credential namespace.
	CredentialNamespace = "mecatl/provider-oidc/v1"
)

Variables

View Source
var ErrNotEnrolled = errors.New("OIDC provider is not enrolled")

ErrNotEnrolled reports absent, identity-drifted, corrupt, or unavailable protected state.

Functions

func CanonicalGatewayURL

func CanonicalGatewayURL(raw string) (string, error)

CanonicalGatewayURL validates and canonicalizes one configured gateway origin and base path. It performs no credential or network access.

func CredentialRecordKey

func CredentialRecordKey(id CredentialIdentity) ([]byte, error)

CredentialRecordKey returns the endpoint's versioned opaque store key.

func JoinGatewayURL

func JoinGatewayURL(canonicalBase, relative string) (*url.URL, error)

JoinGatewayURL appends a relative adapter request path beneath a canonical gateway base. Query parameters are deliberately rejected here and may be set on the returned URL only after this confinement check succeeds.

func NewGatewayHTTPClient

func NewGatewayHTTPClient(canonicalBase string, source BearerSource, base http.RoundTripper) (*http.Client, error)

NewGatewayHTTPClient returns a redirect-refusing client whose transport validates the configured gateway origin and base-path boundary before asking for a bearer. A 401 for a replayable request is retried once before the response is returned to the streaming decoder.

func NewProtectedStore

func NewProtectedStore(ctx context.Context, cfg ProtectedStoreConfig) (credentialstore.Store, error)

NewProtectedStore opens only the encrypted namespace using the selected key source.

func NormalizeScopes

func NormalizeScopes(scopes []string) ([]string, error)

NormalizeScopes validates RFC 6749 scope-token bytes, deduplicates them, and returns a lexicographically sorted owned slice.

func ValidIssuer

func ValidIssuer(raw string) bool

ValidIssuer accepts an exact HTTPS issuer identifier without rewriting it.

func ValidateTrust

func ValidateTrust(trust Trust) error

ValidateTrust enforces the closed public/private-ca policy vocabulary.

Types

type BearerSource

type BearerSource interface {
	Token(context.Context) (string, error)
	Refresh(context.Context, string) (string, error)
}

BearerSource supplies deployment-scoped gateway credentials. Refresh receives the rejected token so concurrent 401s can reuse a token another caller already refreshed instead of rotating it again.

type CredentialIdentity

type CredentialIdentity struct {
	SchemaVersion                                           int
	EndpointID, Gateway, Issuer, ClientID, ResourceAudience string
	Scopes                                                  []string
	RedirectURI                                             string
	IssuerTrust, GatewayTrust                               TrustIdentity
}

CredentialIdentity is the complete endpoint-bound durable credential identity.

type CredentialRecord

type CredentialRecord struct {
	Token   Token
	Version credentialstore.Version
}

CredentialRecord carries a token and its exact opaque CAS version.

type CredentialRepository

type CredentialRepository struct {
	// contains filtered or unexported fields
}

CredentialRepository protects identity validation and CAS over one namespace-bound store.

func NewCredentialRepository

func NewCredentialRepository(store credentialstore.Store) *CredentialRepository

NewCredentialRepository binds record validation and CAS to store.

func (*CredentialRepository) Delete

Delete removes only the exact loaded credential version.

func (*CredentialRepository) Load

Load retrieves an exact-identity, supported-schema credential.

func (*CredentialRepository) Save

Save creates or exact-version-replaces a credential and reconciles ambiguous commits.

type KeySource

type KeySource interface {
	Key(context.Context, bool) ([]byte, error)
}

KeySource returns encryption key material and optionally permits creation. The caller clears the returned bytes after opening the encrypted store.

type Lifecycle

type Lifecycle struct {
	Repository          *CredentialRepository
	Locker              Locker
	Authorize           func(context.Context) (Token, error)
	Exchange            func(context.Context, string) (Token, error)
	ValidateAccessToken func(context.Context, string) error
	AfterCommit         func()
}

Lifecycle serializes refresh exchange and durable CAS commit.

func (Lifecycle) Enroll

func (l Lifecycle) Enroll(ctx context.Context, id CredentialIdentity) error

Enroll serializes authorization-code exchange and first credential commit.

func (Lifecycle) Logout

func (l Lifecycle) Logout(ctx context.Context, id CredentialIdentity, revoke func(context.Context, Token) error) error

Logout makes exact-version local deletion authoritative before making one bounded best-effort revocation call with the retained in-memory material.

func (Lifecycle) Refresh

func (l Lifecycle) Refresh(ctx context.Context, id CredentialIdentity) (Token, error)

Refresh exchanges the exact loaded refresh token and commits rotation before return.

func (Lifecycle) RefreshRejected

func (l Lifecycle) RefreshRejected(ctx context.Context, id CredentialIdentity, rejected string) (Token, error)

RefreshRejected refreshes rejected unless another synchronized caller already replaced it, in which case the newer durable token is reused.

func (Lifecycle) Status

func (l Lifecycle) Status(ctx context.Context, id CredentialIdentity, now time.Time) Status

Status inspects only the local record. It never authorizes, refreshes, or performs provider communication.

type LifecycleSource

type LifecycleSource struct {
	Identity   CredentialIdentity
	Repository *CredentialRepository
	Lifecycle  Lifecycle
	Now        func() time.Time
}

LifecycleSource adapts the durable credential lifecycle to gateway request transport. It never holds the lifecycle lock while an HTTP request is in flight.

func (*LifecycleSource) Refresh

func (s *LifecycleSource) Refresh(ctx context.Context, rejected string) (string, error)

Refresh handles one rejected bearer. The lifecycle lock makes concurrent callers observe and reuse a newer token rather than refreshing it again.

func (*LifecycleSource) Token

func (s *LifecycleSource) Token(ctx context.Context) (string, error)

Token returns a usable cached bearer, refreshing an expired record before it leaves the lifecycle transaction.

func (*LifecycleSource) Validate

func (s *LifecycleSource) Validate(ctx context.Context) error

Validate requires one exact-identity durable record before an endpoint can be advertised as available or selected as a default.

type Locker

type Locker interface {
	With(context.Context, CredentialIdentity, func(context.Context) error) error
}

Locker serializes one complete endpoint credential transaction.

func MemoryLocker

func MemoryLocker() Locker

MemoryLocker returns an in-process test locker.

type OIDC

type OIDC struct {
	Issuer           string
	ClientID         string
	ResourceAudience string
	Scopes           []string
}

OIDC identifies the native endpoint's exact authorization-server contract.

type ProtectedStoreConfig

type ProtectedStoreConfig struct {
	Root         string
	KeySource    KeySource
	ExistingOnly bool
}

ProtectedStoreConfig requires an explicit key source and has no fallback source.

type Status

type Status string

Status is the closed, value-free local credential state vocabulary.

const (
	// StatusUsable means the local record is currently usable.
	StatusUsable Status = "usable"
	// StatusNotEnrolled means no exact-identity record exists.
	StatusNotEnrolled Status = "not-enrolled"
	// StatusExpired means the local record has expired.
	StatusExpired Status = "expired"
	// StatusCorrupt means protected local state failed validation.
	StatusCorrupt Status = "corrupt"
	// StatusStorageUnavailable means local protected storage cannot be read.
	StatusStorageUnavailable Status = "storage-unavailable"
	// StatusRejected means the provider rejected the retained credential.
	StatusRejected Status = "rejected"
)

type Token

type Token struct {
	AccessToken, RefreshToken, TokenType string
	Expiry                               time.Time
}

Token is transient OAuth material persisted only inside the protected record.

type TransactionLocker

type TransactionLocker struct {
	// contains filtered or unexported fields
}

TransactionLocker owns hashed endpoint-scoped cross-process flock transactions.

func NewTransactionLocker

func NewTransactionLocker(root string) (*TransactionLocker, error)

NewTransactionLocker validates an explicit owner-only credential root.

func (*TransactionLocker) With

With holds the endpoint transaction lock for fn and honors context cancellation.

type Trust

type Trust struct {
	Policy   string
	CABundle string
}

Trust keeps issuer and gateway trust policies separate.

type TrustIdentity

type TrustIdentity struct{ Policy, CADigest string }

TrustIdentity binds one independently configured network trust policy.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL