authorization

package

v0.1.0-rc.28 Latest Latest Go to latest Published: Sep 24, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tnldotdev/tnl

Links

Open Source Insights

Documentation ¶

Overview ¶

Package authorization authorizes control operations and builds stable request hashes.

Index ¶

Constants
Variables
func CanonicalizeIPPrefixes(values []string) ([]string, error)
func ValidateRouteTarget(target string) error
type Authorizer
type CertificatePlan
type Decision
type Digest
- func CanonicalRequestHash(request OperationRequest) (Digest, error)
- func IPPolicyHash(prefixes []string) (*Digest, error)
- func (d Digest) String() string
type Operation
type OperationRequest
type Request

Constants ¶

View Source

const MaxIPPrefixes = 64

Variables ¶

View Source

var (
	ErrInvalid         = errors.New("authorization: invalid request")
	ErrUnauthenticated = errors.New("authorization: unauthenticated")
	ErrForbidden       = errors.New("authorization: forbidden")
	ErrUnavailable     = errors.New("authorization: unavailable")
)

Functions ¶

func CanonicalizeIPPrefixes ¶

func CanonicalizeIPPrefixes(values []string) ([]string, error)

CanonicalizeIPPrefixes parses, masks, rejects duplicates, and sorts an IP policy. It preserves nil so an omitted policy differs from an empty policy.

func ValidateRouteTarget ¶

func ValidateRouteTarget(target string) error

ValidateRouteTarget accepts the local HTTP target format used by routes.

Types ¶

type Authorizer ¶

type Authorizer interface {
	Authorize(context.Context, Request) (Decision, error)
}

type CertificatePlan ¶

type CertificatePlan struct {
	CacheKey        string   `json:"cache_key"`
	Scope           string   `json:"scope"`
	Identifiers     []string `json:"identifiers"`
	ChallengeMethod string   `json:"challenge_method"`
}

type Decision ¶

type Decision struct {
	IdentityID            string
	TeamID                string
	ActingMembershipID    string
	ActingRole            string
	RouteMembershipID     string
	PolicyRevision        uint64
	DomainID              string
	CanonicalHostname     string
	RouteScope            string
	DNSAuthorityReference string
	CertificatePlan       *CertificatePlan
	RetrySecret           [32]byte
}

Decision contains current authority state accepted by control. RetrySecret is internal key material and is never part of the authority wire response.

type Digest ¶

type Digest [sha256.Size]byte

func CanonicalRequestHash ¶

func CanonicalRequestHash(request OperationRequest) (Digest, error)

CanonicalRequestHash returns a stable hash for one authorized control change.

func IPPolicyHash ¶

func IPPolicyHash(prefixes []string) (*Digest, error)

IPPolicyHash hashes the normalized prefix list. A nil policy has no hash.

func (Digest) String ¶

func (d Digest) String() string

type Operation ¶

type Operation string

const (
	OperationRouteCreate        Operation = "route.create"
	OperationRouteUpdate        Operation = "route.update"
	OperationRouteSessionCreate Operation = "route_session.create"
	OperationRouteDelete        Operation = "route.delete"
)

type OperationRequest ¶

type OperationRequest struct {
	Operation             Operation
	TeamID                string
	MembershipID          string
	DomainID              string
	CanonicalHostname     string
	RouteScope            string
	RouteID               string
	RouteVersion          uint64
	RouteMutationRevision uint64
	PolicyRevision        uint64
	Target                string
	AllowedIPPrefixes     []string
	Ephemeral             bool
	CertificatePlan       *CertificatePlan
}

OperationRequest contains every value included in a mutation hash.

type Request ¶

type Request struct {
	AccessToken           string
	Operation             Operation
	TeamID                string
	ActingMembershipID    string
	RouteMembershipID     string
	DomainID              string
	CanonicalHostname     string
	RouteScope            string
	Target                string
	AllowedIPPrefixes     []string
	Ephemeral             bool
	RouteID               string
	RouteVersion          uint64
	RouteMutationRevision uint64
}

Request contains the user credential and exact operation facts control asks the authority to authorize.

Source Files ¶

View all Source files

request.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL