flyio

package
v0.2.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 28, 2023 License: Apache-2.0 Imports: 5 Imported by: 4

README

github.com/superfly/macaroon/flyio

This package contains fly.io-specific caveats.

Documentation

Index

Constants

View Source 
const (
	CavOrganization      = macaroon.CavFlyioOrganization
	CavVolumes           = macaroon.CavFlyioVolumes
	CavApps              = macaroon.CavFlyioApps
	CavFeatureSet        = macaroon.CavFlyioFeatureSet
	CavMutations         = macaroon.CavFlyioMutations
	CavMachines          = macaroon.CavFlyioMachines
	CavIsUser            = macaroon.CavFlyioIsUser
	CavMachineFeatureSet = macaroon.CavFlyioMachineFeatureSet
	CavFromMachineSource = macaroon.CavFlyioFromMachineSource
	CavClusters          = macaroon.CavFlyioClusters
	CavNoAdminFeatures   = macaroon.CavNoAdminFeatures
)
View Source 
const (
	FeatureWireGuard       = "wg"
	FeatureDomains         = "domain"
	FeatureSites           = "site"
	FeatureRemoteBuilders  = "builder"
	FeatureAddOns          = "addon"
	FeatureChecks          = "checks"
	FeatureLFSC            = "litefs-cloud"
	FeatureMembership      = "membership"
	FeatureBilling         = "billing"
	FeatureDeletion        = "deletion"
	FeatureDocumentSigning = "document_signing"
)
View Source 
const (
	// well-known locations
	LocationPermission     = "https://api.fly.io/v1"
	LocationAuthentication = "https://api.fly.io/aaa/v1"
	LocationSecrets        = "https://api.fly.io/secrets/v1"
)

Variables

View Source 
var (
	MemberFeatures = map[string]resset.Action{
		FeatureWireGuard:      resset.ActionAll,
		FeatureDomains:        resset.ActionAll,
		FeatureSites:          resset.ActionAll,
		FeatureRemoteBuilders: resset.ActionAll,
		FeatureAddOns:         resset.ActionAll,
		FeatureChecks:         resset.ActionAll,
		FeatureLFSC:           resset.ActionAll,

		FeatureMembership: resset.ActionRead,
		FeatureBilling:    resset.ActionRead,

		FeatureDeletion:        resset.ActionNone,
		FeatureDocumentSigning: resset.ActionNone,
	}
)

Functions

func DischargeClient added in v0.2.0 

func DischargeClient(opts ...tp.ClientOption) *tp.Client

DischargeClient returns a *tp.Client suitable for discharging third party caveats in fly.io permission tokens.

func ParsePermissionAndDischargeTokens 

func ParsePermissionAndDischargeTokens(header string) ([]byte, [][]byte, error)

ParseRootAndDischargeTokens takes a string header and parses out the fly.io permission and discharge tokens.

Types

type Access 

type Access struct {
	OrgSlug        *string       `json:"org_slug,omitempty"`
	AppID          *string       `json:"apphid,omitempty"`
	Action         resset.Action `json:"action,omitempty"`
	Feature        *string       `json:"feature,omitempty"`
	Volume         *string       `json:"volume,omitempty"`
	Machine        *string       `json:"machine,omitempty"`
	MachineFeature *string       `json:"machine_feature,omitempty"`
	Mutation       *string       `json:"mutation,omitempty"`
	SourceMachine  *string       `json:"sourceMachine,omitempty"`
	Cluster        *string       `json:"cluster,omitempty"`

	// deprecated
	DeprecatedOrgID *uint64 `json:"orgid,omitempty"`
	DeprecatedAppID *uint64 `json:"appid,omitempty"`
}

func (*Access) GetAction 

func (a *Access) GetAction() resset.Action

func (*Access) Now 

func (a *Access) Now() time.Time

func (*Access) Validate 

func (f *Access) Validate() error

validate checks that the Access has sensible values set. This consists of ensuring that parent-resources are specified when child-resources are present (e.g. machine requires app requires org) and ensuring that multiple child resources aren't specified for a single parent resource (e.g. machine and volume are mutually exclusive).

This ensure that a Access represents a single action taken on a single object.

type Apps 

type Apps struct {
	Apps resset.ResourceSet[uint64] `json:"apps"`
}

Apps is a set of App caveats, with their RWX access levels. A token with this set can be used only with the listed apps, regardless of what the token says. Additional Apps can be added, but they can only narrow, not expand, which apps (or access levels) can be reached from the token.

func (*Apps) CaveatType 

func (c *Apps) CaveatType() macaroon.CaveatType

func (*Apps) Name added in v0.0.5 

func (c *Apps) Name() string

func (*Apps) Prohibits 

func (c *Apps) Prohibits(a macaroon.Access) error

type Clusters 

type Clusters struct {
	Clusters resset.ResourceSet[string] `json:"clusters"`
}

Clusters is a set of Cluster caveats, with their RWX access levels. Clusters belong to the "litefs-cloud" org-feature.

func (*Clusters) CaveatType 

func (c *Clusters) CaveatType() macaroon.CaveatType

func (*Clusters) Name added in v0.0.5 

func (c *Clusters) Name() string

func (*Clusters) Prohibits 

func (c *Clusters) Prohibits(a macaroon.Access) error

type FeatureSet 

type FeatureSet struct {
	Features resset.ResourceSet[string] `json:"features"`
}

FeatureSet is a collection of organization-level "features" that are managed as single units. For example, the ability to manage wireguard networks is gated by the "wg" feature, though you could conceptually gate access to them individually with a Networks caveat. The feature name is free-form and more should be addded as it makes sense.

func (*FeatureSet) CaveatType 

func (c *FeatureSet) CaveatType() macaroon.CaveatType

func (*FeatureSet) Name added in v0.0.5 

func (c *FeatureSet) Name() string

func (*FeatureSet) Prohibits 

func (c *FeatureSet) Prohibits(a macaroon.Access) error

type FromMachine 

type FromMachine struct {
	ID string `json:"id"`
}

func (*FromMachine) CaveatType 

func (c *FromMachine) CaveatType() macaroon.CaveatType

func (*FromMachine) Name added in v0.0.5 

func (c *FromMachine) Name() string

func (*FromMachine) Prohibits 

func (c *FromMachine) Prohibits(a macaroon.Access) error

type IsUser 

type IsUser struct {
	ID uint64 `json:"uint64"`
}

TODO: deprecate this and replace with an attestation

func (*IsUser) CaveatType 

func (c *IsUser) CaveatType() macaroon.CaveatType

func (*IsUser) Name added in v0.0.5 

func (c *IsUser) Name() string

func (*IsUser) Prohibits 

func (c *IsUser) Prohibits(a macaroon.Access) error

type MachineFeatureSet 

type MachineFeatureSet struct {
	Features resset.ResourceSet[string] `json:"features"`
}

func (*MachineFeatureSet) CaveatType 

func (c *MachineFeatureSet) CaveatType() macaroon.CaveatType

func (*MachineFeatureSet) Name added in v0.0.5 

func (c *MachineFeatureSet) Name() string

func (*MachineFeatureSet) Prohibits 

func (c *MachineFeatureSet) Prohibits(a macaroon.Access) error

type Machines 

type Machines struct {
	Machines resset.ResourceSet[string] `json:"machines"`
}

func (*Machines) CaveatType 

func (c *Machines) CaveatType() macaroon.CaveatType

func (*Machines) Name added in v0.0.5 

func (c *Machines) Name() string

func (*Machines) Prohibits 

func (c *Machines) Prohibits(a macaroon.Access) error

type Mutations 

type Mutations struct {
	Mutations []string `json:"mutations"`
}

Mutations is a set of GraphQL mutations allowed by this token.

func (*Mutations) CaveatType 

func (c *Mutations) CaveatType() macaroon.CaveatType

func (*Mutations) Name added in v0.0.5 

func (c *Mutations) Name() string

func (*Mutations) Prohibits 

func (c *Mutations) Prohibits(a macaroon.Access) error

type NoAdminFeatures added in v0.2.4 

type NoAdminFeatures struct{}

NoAdminFeatures is a shorthand for specifying that the token isn't allowed to access admin-only features. Same as: 

resset.IfPresent{
  Ifs: macaroon.NewCaveatSet(&FeatureSet{
    "memberFeatureOne": resset.ActionAll,
    "memberFeatureTwo": resset.ActionAll,
    "memberFeatureNNN": resset.ActionAll,
  }),
  Else: resset.ActionAll
}

func (*NoAdminFeatures) CaveatType added in v0.2.4 

func (c *NoAdminFeatures) CaveatType() macaroon.CaveatType

func (*NoAdminFeatures) Name added in v0.2.4 

func (c *NoAdminFeatures) Name() string

func (*NoAdminFeatures) Prohibits added in v0.2.4 

func (c *NoAdminFeatures) Prohibits(a macaroon.Access) error

type Organization 

type Organization struct {
	ID   uint64        `json:"id"`
	Mask resset.Action `json:"mask"`
}

Organization is an orgid, plus RWX-style access control.

func (*Organization) CaveatType 

func (c *Organization) CaveatType() macaroon.CaveatType

func (*Organization) Name added in v0.0.5 

func (c *Organization) Name() string

func (*Organization) Prohibits 

func (c *Organization) Prohibits(a macaroon.Access) error

type Volumes 

type Volumes struct {
	Volumes resset.ResourceSet[string] `json:"volumes"`
}

func (*Volumes) CaveatType 

func (c *Volumes) CaveatType() macaroon.CaveatType

func (*Volumes) Name added in v0.0.5 

func (c *Volumes) Name() string

func (*Volumes) Prohibits 

func (c *Volumes) Prohibits(a macaroon.Access) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.