authorization

package

v0.1.0-rc.40 Latest Latest Go to latest Published: Oct 3, 2026 License: MIT Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tnldotdev/tnl

Links

Open Source Insights

Documentation ¶

Overview ¶

Package authorization authorizes control operations and builds stable request hashes.

Index ¶

Variables
func CanonicalizeIPPrefixes(values []string) ([]string, error)
func ValidateTarget(target string) error
type Authorizer
type CertificatePlan
type Decision
type Digest
- func CanonicalRequestHash(request OperationRequest) (Digest, error)
- func IPPolicyHash(prefixes []string) (*Digest, error)
- func (d Digest) String() string
type Operation
type OperationRequest
type PublicURLScope
- func (scope PublicURLScope) Valid() bool
type Request

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrInvalid         = errors.New("authorization: invalid request")
	ErrUnauthenticated = errors.New("authorization: unauthenticated")
	ErrForbidden       = errors.New("authorization: forbidden")
	ErrUnavailable     = errors.New("authorization: unavailable")
)

Functions ¶

func CanonicalizeIPPrefixes ¶

func CanonicalizeIPPrefixes(values []string) ([]string, error)

CanonicalizeIPPrefixes parses, masks, rejects duplicates, and sorts an IP policy. it preserves nil so an omitted policy differs from an empty policy.

func ValidateTarget ¶

func ValidateTarget(target string) error

ValidateTarget accepts the local HTTP target format used by public URLs.

Types ¶

type Authorizer ¶

type Authorizer interface {
	Authorize(context.Context, Request) (Decision, error)
}

type CertificatePlan ¶

type CertificatePlan struct {
	CacheKey        string                              `json:"cache_key"`
	Scope           string                              `json:"scope"`
	Identifiers     []string                            `json:"identifiers"`
	ChallengeMethod certificateidentity.ChallengeMethod `json:"challenge_method"`
}

type Decision ¶

type Decision struct {
	IdentityID            string
	TeamID                string
	ActingMembershipID    string
	ActingRole            string
	PublicURLMembershipID string
	PolicyRevision        uint64
	DomainID              string
	CanonicalHostname     string
	PublicURLScope        PublicURLScope
	DNSAuthorityReference string
	CertificatePlan       *CertificatePlan
	RetrySecret           [32]byte
}

Decision contains current authority state accepted by control. RetrySecret is internal key material and is never part of the authority wire response.

type Digest ¶

type Digest [sha256.Size]byte

func CanonicalRequestHash ¶

func CanonicalRequestHash(request OperationRequest) (Digest, error)

CanonicalRequestHash returns a stable hash for one authorized control change.

func IPPolicyHash ¶

func IPPolicyHash(prefixes []string) (*Digest, error)

IPPolicyHash hashes the normalized prefix list. A nil policy has no hash.

func (Digest) String ¶

func (d Digest) String() string

type Operation ¶

type Operation string

const (
	OperationPublicURLCreate  Operation = "public_url.create"
	OperationPublicURLUpdate  Operation = "public_url.update"
	OperationPublishRunCreate Operation = "publish_run.create"
	OperationPublicURLDelete  Operation = "public_url.delete"
)

type OperationRequest ¶

type OperationRequest struct {
	Operation                 Operation
	TeamID                    string
	MembershipID              string
	DomainID                  string
	CanonicalHostname         string
	PublicURLScope            PublicURLScope
	PublicURLID               string
	PublishRunNumber          uint64
	PublicURLMutationRevision uint64
	PolicyRevision            uint64
	Target                    string
	AllowedIPPrefixes         []string
	Ephemeral                 bool
	CertificatePlan           *CertificatePlan
}

OperationRequest contains every value included in a mutation hash.

type PublicURLScope ¶

type PublicURLScope string

PublicURLScope identifies the ownership boundary for an authorized public URL.

const (
	PublicURLScopeMember PublicURLScope = "member"
	PublicURLScopeShared PublicURLScope = "shared"
)

func (PublicURLScope) Valid ¶

func (scope PublicURLScope) Valid() bool

type Request ¶

type Request struct {
	AccessToken               string
	Operation                 Operation
	TeamID                    string
	ActingMembershipID        string
	PublicURLMembershipID     string
	DomainID                  string
	CanonicalHostname         string
	PublicURLScope            PublicURLScope
	Target                    string
	AllowedIPPrefixes         []string
	Ephemeral                 bool
	PublicURLID               string
	PublishRunNumber          uint64
	PublicURLMutationRevision uint64
}

Request contains the user credential and exact operation facts control asks the authority to authorize.

Source Files ¶

View all Source files

request.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL