Documentation
¶
Overview ¶
Package llmendpoint validates host-internal native LLM endpoint identities and confines gateway request URLs before credential retrieval.
Index ¶
- Constants
- Variables
- func CanonicalGatewayURL(raw string) (string, error)
- func CredentialRecordKey(id CredentialIdentity) ([]byte, error)
- func JoinGatewayURL(canonicalBase, relative string) (*url.URL, error)
- func NewGatewayHTTPClient(canonicalBase string, source BearerSource, base http.RoundTripper) (*http.Client, error)
- func NewProtectedStore(ctx context.Context, cfg ProtectedStoreConfig) (credentialstore.Store, error)
- func NormalizeScopes(scopes []string) ([]string, error)
- func ValidIssuer(raw string) bool
- func ValidateTrust(trust Trust) error
- type BearerSource
- type CredentialIdentity
- type CredentialRecord
- type CredentialRepository
- func (r *CredentialRepository) Delete(ctx context.Context, id CredentialIdentity, expected credentialstore.Version) error
- func (r *CredentialRepository) Load(ctx context.Context, id CredentialIdentity) (CredentialRecord, error)
- func (r *CredentialRepository) Save(ctx context.Context, id CredentialIdentity, tok Token, ...) (CredentialRecord, error)
- type KeySource
- type Lifecycle
- func (l Lifecycle) Enroll(ctx context.Context, id CredentialIdentity) error
- func (l Lifecycle) Logout(ctx context.Context, id CredentialIdentity, ...) error
- func (l Lifecycle) Refresh(ctx context.Context, id CredentialIdentity) (Token, error)
- func (l Lifecycle) RefreshRejected(ctx context.Context, id CredentialIdentity, rejected string) (Token, error)
- func (l Lifecycle) Status(ctx context.Context, id CredentialIdentity, now time.Time) Status
- type LifecycleSource
- type Locker
- type OIDC
- type ProtectedStoreConfig
- type Status
- type Token
- type TransactionLocker
- type Trust
- type TrustIdentity
Constants ¶
const (
// CredentialNamespace is the isolated encrypted native-provider credential namespace.
CredentialNamespace = "mecatl/provider-oidc/v1"
)
Variables ¶
var ErrNotEnrolled = errors.New("OIDC provider is not enrolled")
ErrNotEnrolled reports absent, identity-drifted, corrupt, or unavailable protected state.
Functions ¶
func CanonicalGatewayURL ¶
CanonicalGatewayURL validates and canonicalizes one configured gateway origin and base path. It performs no credential or network access.
func CredentialRecordKey ¶
func CredentialRecordKey(id CredentialIdentity) ([]byte, error)
CredentialRecordKey returns the endpoint's versioned opaque store key.
func JoinGatewayURL ¶
JoinGatewayURL appends a relative adapter request path beneath a canonical gateway base. Query parameters are deliberately rejected here and may be set on the returned URL only after this confinement check succeeds.
func NewGatewayHTTPClient ¶
func NewGatewayHTTPClient(canonicalBase string, source BearerSource, base http.RoundTripper) (*http.Client, error)
NewGatewayHTTPClient returns a redirect-refusing client whose transport validates the configured gateway origin and base-path boundary before asking for a bearer. A 401 for a replayable request is retried once before the response is returned to the streaming decoder.
func NewProtectedStore ¶
func NewProtectedStore(ctx context.Context, cfg ProtectedStoreConfig) (credentialstore.Store, error)
NewProtectedStore opens only the encrypted namespace using the selected key source.
func NormalizeScopes ¶
NormalizeScopes validates RFC 6749 scope-token bytes, deduplicates them, and returns a lexicographically sorted owned slice.
func ValidIssuer ¶
ValidIssuer accepts an exact HTTPS issuer identifier without rewriting it.
func ValidateTrust ¶
ValidateTrust enforces the closed public/private-ca policy vocabulary.
Types ¶
type BearerSource ¶
type BearerSource interface {
Token(context.Context) (string, error)
Refresh(context.Context, string) (string, error)
}
BearerSource supplies deployment-scoped gateway credentials. Refresh receives the rejected token so concurrent 401s can reuse a token another caller already refreshed instead of rotating it again.
type CredentialIdentity ¶
type CredentialIdentity struct {
SchemaVersion int
EndpointID, Gateway, Issuer, ClientID, ResourceAudience string
Scopes []string
RedirectURI string
IssuerTrust, GatewayTrust TrustIdentity
}
CredentialIdentity is the complete endpoint-bound durable credential identity.
type CredentialRecord ¶
type CredentialRecord struct {
Token Token
Version credentialstore.Version
}
CredentialRecord carries a token and its exact opaque CAS version.
type CredentialRepository ¶
type CredentialRepository struct {
// contains filtered or unexported fields
}
CredentialRepository protects identity validation and CAS over one namespace-bound store.
func NewCredentialRepository ¶
func NewCredentialRepository(store credentialstore.Store) *CredentialRepository
NewCredentialRepository binds record validation and CAS to store.
func (*CredentialRepository) Delete ¶
func (r *CredentialRepository) Delete(ctx context.Context, id CredentialIdentity, expected credentialstore.Version) error
Delete removes only the exact loaded credential version.
func (*CredentialRepository) Load ¶
func (r *CredentialRepository) Load(ctx context.Context, id CredentialIdentity) (CredentialRecord, error)
Load retrieves an exact-identity, supported-schema credential.
func (*CredentialRepository) Save ¶
func (r *CredentialRepository) Save(ctx context.Context, id CredentialIdentity, tok Token, expected *credentialstore.Version) (CredentialRecord, error)
Save creates or exact-version-replaces a credential and reconciles ambiguous commits.
type KeySource ¶
KeySource returns encryption key material and optionally permits creation. The caller clears the returned bytes after opening the encrypted store.
type Lifecycle ¶
type Lifecycle struct {
Repository *CredentialRepository
Locker Locker
Authorize func(context.Context) (Token, error)
Exchange func(context.Context, string) (Token, error)
ValidateAccessToken func(context.Context, string) error
AfterCommit func()
}
Lifecycle serializes refresh exchange and durable CAS commit.
func (Lifecycle) Enroll ¶
func (l Lifecycle) Enroll(ctx context.Context, id CredentialIdentity) error
Enroll serializes authorization-code exchange and first credential commit.
func (Lifecycle) Logout ¶
func (l Lifecycle) Logout(ctx context.Context, id CredentialIdentity, revoke func(context.Context, Token) error) error
Logout makes exact-version local deletion authoritative before making one bounded best-effort revocation call with the retained in-memory material.
func (Lifecycle) Refresh ¶
Refresh exchanges the exact loaded refresh token and commits rotation before return.
func (Lifecycle) RefreshRejected ¶
func (l Lifecycle) RefreshRejected(ctx context.Context, id CredentialIdentity, rejected string) (Token, error)
RefreshRejected refreshes rejected unless another synchronized caller already replaced it, in which case the newer durable token is reused.
type LifecycleSource ¶
type LifecycleSource struct {
Identity CredentialIdentity
Repository *CredentialRepository
Lifecycle Lifecycle
Now func() time.Time
}
LifecycleSource adapts the durable credential lifecycle to gateway request transport. It never holds the lifecycle lock while an HTTP request is in flight.
func (*LifecycleSource) Refresh ¶
Refresh handles one rejected bearer. The lifecycle lock makes concurrent callers observe and reuse a newer token rather than refreshing it again.
type Locker ¶
type Locker interface {
With(context.Context, CredentialIdentity, func(context.Context) error) error
}
Locker serializes one complete endpoint credential transaction.
type ProtectedStoreConfig ¶
ProtectedStoreConfig requires an explicit key source and has no fallback source.
type Status ¶
type Status string
Status is the closed, value-free local credential state vocabulary.
const ( // StatusUsable means the local record is currently usable. StatusUsable Status = "usable" // StatusNotEnrolled means no exact-identity record exists. StatusNotEnrolled Status = "not-enrolled" // StatusExpired means the local record has expired. StatusExpired Status = "expired" // StatusCorrupt means protected local state failed validation. StatusCorrupt Status = "corrupt" StatusStorageUnavailable Status = "storage-unavailable" // StatusRejected means the provider rejected the retained credential. StatusRejected Status = "rejected" )
type TransactionLocker ¶
type TransactionLocker struct {
// contains filtered or unexported fields
}
TransactionLocker owns hashed endpoint-scoped cross-process flock transactions.
func NewTransactionLocker ¶
func NewTransactionLocker(root string) (*TransactionLocker, error)
NewTransactionLocker validates an explicit owner-only credential root.
func (*TransactionLocker) With ¶
func (l *TransactionLocker) With(ctx context.Context, id CredentialIdentity, fn func(context.Context) error) error
With holds the endpoint transaction lock for fn and honors context cancellation.
type TrustIdentity ¶
type TrustIdentity struct{ Policy, CADigest string }
TrustIdentity binds one independently configured network trust policy.