config

package
v2.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 23, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package config provides JSONC configuration loading and validation.

Index

Constants

View Source 
const DefaultSigningAlgorithm = "RS256"

Variables

This section is empty.

Functions

func BuildTrustSchema 

func BuildTrustSchema(claims, required map[string]json.RawMessage) ([]byte, error)

BuildTrustSchema canonicalizes and validates an effective trust schema without compiling it.

func CompileCanonicalTrustSchema 

func CompileCanonicalTrustSchema(data []byte) (*jsonschema.Schema, error)

CompileCanonicalTrustSchema compiles canonical bytes returned by BuildTrustSchema.

func CompileTrustSchema 

func CompileTrustSchema(claims, required map[string]json.RawMessage) ([]byte, *jsonschema.Schema, error)

CompileTrustSchema canonicalizes and compiles an effective trust schema using static policy safety semantics.

func ParseDuration 

func ParseDuration(value string) (time.Duration, error)

ParseDuration parses a positive Go duration string.

func PublicEndpointURL 

func PublicEndpointURL(issuer, endpoint string) string

PublicEndpointURL builds an externally visible endpoint solely from a validated issuer.

func ValidTrustBindingID 

func ValidTrustBindingID(id string) bool

ValidTrustBindingID reports whether id satisfies the shared static and dynamic binding identifier contract.

func ValidateTrustClaimName 

func ValidateTrustClaimName(name, provider string) error

ValidateTrustClaimName applies the configured issuer provider's trust claim allowlist.

Types

type ClientConfig 

type ClientConfig struct {
	RedirectURIs                []string             `json:"redirect_uris,omitempty"`
	UserGroupMapping            string               `json:"user_group_mapping,omitempty"`
	RequireUserGroupsFromPolicy *bool                `json:"require_user_groups_from_policy,omitempty"`
	RefreshTokens               RefreshTokenConfig   `json:"refresh_tokens,omitempty"`
	TrustBindings               []TrustBindingConfig `json:"trust_bindings,omitempty"`
	DPoP                        DPoPConfig           `json:"dpop,omitempty"`
	RequirePAR                  bool                 `json:"require_par,omitempty"`
}

ClientConfig defines OIDC client-specific configuration. Each client can have custom redirect URIs and a user group mapping.

func (*ClientConfig) ShouldRequireUserGroupsFromPolicy 

func (c *ClientConfig) ShouldRequireUserGroupsFromPolicy(policyDefault *bool) bool

ShouldRequireUserGroupsFromPolicy returns whether policy must resolve user groups. It checks the client-specific setting first, falling back to the policy default. If neither is set, it defaults to true.

type ClientLookupCacheConfig 

type ClientLookupCacheConfig struct {
	TTL         Duration `json:"ttl,omitempty"`
	NegativeTTL Duration `json:"negative_ttl,omitempty"`
	MaxEntries  int      `json:"max_entries,omitempty"`
}

ClientLookupCacheConfig bounds positive and negative client existence lookups.

type Config 

type Config struct {
	Schema              string                       `json:"$schema,omitempty"`
	IssuerURL           string                       `json:"issuer_url"`
	HomepageURL         string                       `json:"homepage_url,omitempty"`
	HTTPListenAddr      string                       `json:"http_listen_addr"`
	ServingCertificate  *ServingCertificateConfig    `json:"serving_certificate,omitempty"`
	SigningAlgorithm    string                       `json:"signing_algorithm,omitempty"`
	JWKSKID             string                       `json:"jwks_kid,omitempty"`
	AccessTokenTTL      Duration                     `json:"access_token_ttl,omitempty"`
	IDTokenTTL          Duration                     `json:"id_token_ttl,omitempty"`
	Secrets             SecretsConfig                `json:"secrets"`
	UserLoginConnectors map[string]ConnectorConfig   `json:"user_login_connectors"`
	ServiceTokenIssuers map[string]TrustIssuerConfig `json:"service_token_issuers,omitempty"`
	TemplatesDir        string                       `json:"templates_dir,omitempty"`
	Email               *EmailConfig                 `json:"email,omitempty"`
	StaticPolicy        StaticPolicyConfig           `json:"static_policy,omitzero"`
	StateDatabase       *StateDatabaseConfig         `json:"state_database,omitempty"`
	PolicyDatabase      *PolicyDatabaseConfig        `json:"policy_database,omitempty"`
}

Config represents the top-level configuration structure for truster.

func Load 

func Load(path string) (*Config, error)

Load reads and parses a JSONC configuration file from the given path. It validates the configuration and returns an error if validation fails. The path parameter must be non-empty.

func Parse 

func Parse(data []byte) (*Config, error)

Parse parses and validates JSONC configuration data.

type ConnectorConfig 

type ConnectorConfig struct {
	Type              string         `json:"type"`
	DisplayName       string         `json:"display_name"`
	Order             int            `json:"order,omitempty"`
	CredentialsSecret string         `json:"credentials_secret,omitempty"`
	Scopes            []string       `json:"scopes"`
	Google            *GoogleConfig  `json:"google,omitempty"`
	GitHub            *GitHubConfig  `json:"github,omitempty"`
	Generic           *GenericConfig `json:"generic,omitempty"`
}

ConnectorConfig defines the upstream OAuth provider configuration. Supports Google, GitHub, and generic OAuth2/OIDC providers.

type DPoPConfig 

type DPoPConfig struct {
	Mode             string `json:"mode,omitempty"`
	SigningAlgorithm string `json:"signing_algorithm,omitempty"`
}

DPoPConfig controls sender-constrained proof requirements for a client.

type Duration 

type Duration time.Duration

Duration is a positive configuration duration. Its JSON representation uses the Go standard library duration syntax.

func (Duration) Duration 

func (d Duration) Duration() time.Duration

Duration returns the standard-library duration value.

func (Duration) MarshalJSON 

func (d Duration) MarshalJSON() ([]byte, error)

MarshalJSON emits a canonical duration string, or null for an absent duration.

func (*Duration) UnmarshalJSON 

func (d *Duration) UnmarshalJSON(data []byte) error

UnmarshalJSON parses a canonical human duration and records its presence.

type EffectiveTrustBinding 

type EffectiveTrustBinding struct {
	ID, Policy, Issuer, Subject string
	Groups                      []string
	Schema                      *jsonschema.Schema
}

EffectiveTrustBinding is an immutable startup-compiled auth rule.

type EmailConfig 

type EmailConfig struct {
	VerificationMode string           `json:"verification_mode"`
	OTPSecretName    string           `json:"otp_secret_name"`
	OTPTTL           Duration         `json:"otp_ttl,omitempty"`
	SMTP             *SMTPConfig      `json:"smtp,omitempty"`
	Turnstile        *TurnstileConfig `json:"turnstile,omitempty"`
}

EmailConfig controls optional email verification and direct email authentication.

type GenericConfig 

type GenericConfig struct {
	AuthorizationURL   string                `json:"authorization_url"`
	TokenURL           string                `json:"token_url"`
	UserinfoURL        string                `json:"userinfo_url"`
	EmailField         string                `json:"email_field,omitempty"`          // JSON field name for email in userinfo response
	EmailVerifiedField string                `json:"email_verified_field,omitempty"` // JSON field name for email verification status
	SubjectField       string                `json:"subject_field,omitempty"`
	Refresh            *GenericRefreshConfig `json:"refresh,omitempty"`
}

GenericConfig contains generic OAuth2/OIDC provider configuration options.

type GenericRefreshConfig 

type GenericRefreshConfig struct {
	Scopes              []string          `json:"scopes,omitempty"`
	AuthorizationParams map[string]string `json:"authorization_params,omitempty"`
}

GenericRefreshConfig configures renewable upstream credential acquisition.

type GitHubConfig 

type GitHubConfig struct {
	Hostname string `json:"hostname"`
}

GitHubConfig contains GitHub-specific OAuth configuration options.

type GoogleConfig 

type GoogleConfig struct {
	HostedDomain string `json:"hd"`
}

GoogleConfig contains Google-specific OAuth configuration options.

type PolicyBuildCacheConfig 

type PolicyBuildCacheConfig struct {
	MaxEntries int `json:"max_entries,omitempty"`
}

PolicyBuildCacheConfig bounds immutable built trust policy artifacts.

type PolicyClientDefaults 

type PolicyClientDefaults struct {
	RequireUserGroupsFromPolicy *bool              `json:"require_user_groups_from_policy,omitempty"`
	RefreshTokens               RefreshTokenConfig `json:"refresh_tokens,omitempty"`
	DPoP                        DPoPConfig         `json:"dpop,omitempty"`
	RequirePAR                  bool               `json:"require_par,omitempty"`
}

PolicyClientDefaults defines settings shared by dynamically resolved clients.

type PolicyDatabaseConfig 

type PolicyDatabaseConfig struct {
	Driver                 string                  `json:"driver"`
	ConnectionStringSecret string                  `json:"connection_string_secret"`
	RedirectURIs           []string                `json:"redirect_uris"`
	ClientDefaults         PolicyClientDefaults    `json:"client_defaults,omitempty"`
	Queries                PolicyQueries           `json:"queries,omitempty"`
	ClientLookupCache      ClientLookupCacheConfig `json:"client_lookup_cache,omitempty"`
	PolicyBuildCache       PolicyBuildCacheConfig  `json:"policy_build_cache,omitempty"`
	QueryTimeout           Duration                `json:"query_timeout,omitempty"`
	MaxConnections         int32                   `json:"max_connections,omitempty"`
	MaxTrustRows           int                     `json:"max_trust_rows,omitempty"`
	MaxGroups              int                     `json:"max_groups,omitempty"`
	MaxGroupBytes          int                     `json:"max_group_bytes,omitempty"`
	MaxJSONBytes           int                     `json:"max_json_bytes,omitempty"`
}

PolicyDatabaseConfig configures a supplemental policy database.

type PolicyQueries 

type PolicyQueries struct {
	ClientExists  string `json:"client_exists"`
	UserAccess    string `json:"user_access"`
	TrustBindings string `json:"trust_bindings"`
}

PolicyQueries contains the three parameterized policy database queries.

type RefreshTokenConfig 

type RefreshTokenConfig struct {
	Enabled            bool     `json:"enabled,omitempty"`
	AllowOfflineAccess bool     `json:"allow_offline_access,omitempty"`
	SessionIdleTTL     Duration `json:"session_idle_ttl,omitempty"`
	SessionAbsoluteTTL Duration `json:"session_absolute_ttl,omitempty"`
	OfflineIdleTTL     Duration `json:"offline_idle_ttl,omitempty"`
	OfflineAbsoluteTTL Duration `json:"offline_absolute_ttl,omitempty"`
}

RefreshTokenConfig controls refresh issuance and snapshotted grant lifetimes.

type SMTPConfig 

type SMTPConfig struct {
	Host              string `json:"host"`
	Port              int    `json:"port"`
	FromName          string `json:"from_name"`
	FromAddress       string `json:"from_address"`
	CredentialsSecret string `json:"credentials_secret"`
	TLSMode           string `json:"tls_mode,omitempty"`
}

SMTPConfig configures the verification email SMTP transport.

type SecretsConfig 

type SecretsConfig struct {
	Provider          string `json:"provider"`
	SigningKeyName    string `json:"signing_key_name"`
	EncryptionKeyName string `json:"encryption_key_name,omitempty"`
	AWSRegion         string `json:"aws_region,omitempty"`
	AzureKeyVaultURL  string `json:"azure_keyvault_url"`
	FileDirectory     string `json:"file_directory,omitempty"`
}

SecretsConfig defines the secrets provider configuration. Supports AWS Secrets Manager, AWS Systems Manager Parameter Store, Google Secret Manager, Azure Key Vault, file, and env-based secrets.

type ServingCertificateConfig 

type ServingCertificateConfig struct {
	CertificateFile string `json:"certificate_file"`
	PrivateKeyFile  string `json:"private_key_file"`
}

ServingCertificateConfig configures the certificate used by the HTTPS server.

type StateDatabaseConfig 

type StateDatabaseConfig struct {
	Driver                 string                         `json:"driver,omitempty"`
	Path                   string                         `json:"path,omitempty"`
	ConnectionStringSecret string                         `json:"connection_string_secret,omitempty"`
	MaxConnections         int                            `json:"max_connections,omitempty"`
	QueryTimeout           Duration                       `json:"query_timeout,omitempty"`
	Migrations             *StateDatabaseMigrationsConfig `json:"migrations,omitempty"`
}

StateDatabaseConfig configures the authoritative protocol-state database.

type StateDatabaseMigrationsConfig 

type StateDatabaseMigrationsConfig struct {
	ConnectionStringSecret string `json:"connection_string_secret,omitempty"`
}

StateDatabaseMigrationsConfig configures the optional migration-only database credential.

type StaticPolicyConfig 

type StaticPolicyConfig struct {
	RequireUserGroupsFromPolicy *bool                          `json:"require_user_groups_from_policy,omitempty"`
	DefaultRedirectURIs         []string                       `json:"default_redirect_uris,omitempty"`
	UserGroupMappings           map[string]map[string][]string `json:"user_group_mappings,omitempty"`
	TrustPolicies               map[string]TrustPolicyConfig   `json:"trust_policies,omitempty"`
	Clients                     map[string]ClientConfig        `json:"clients,omitempty"`
}

StaticPolicyConfig contains authorization policy defined in the configuration file.

type TrustBindingConfig 

type TrustBindingConfig struct {
	ID          string                     `json:"id"`
	TrustPolicy string                     `json:"trust_policy"`
	Subject     *string                    `json:"subject,omitempty"`
	Groups      []string                   `json:"groups,omitempty"`
	Claims      map[string]json.RawMessage `json:"claims,omitempty"`
	Effective   *EffectiveTrustBinding     `json:"-"`
}

TrustBindingConfig allows one policy for a downstream client.

type TrustIssuerConfig 

type TrustIssuerConfig struct {
	Provider    string   `json:"provider"`
	IssuerURL   string   `json:"issuer_url,omitempty"`
	SigningAlgs []string `json:"signing_algs,omitempty"`
	MaxTokenAge Duration `json:"max_token_age,omitempty"`
}

TrustIssuerConfig configures external OIDC verification.

type TrustPolicyConfig 

type TrustPolicyConfig struct {
	Issuer         string                     `json:"issuer"`
	Subject        string                     `json:"subject,omitempty"`
	Groups         []string                   `json:"groups,omitempty"`
	RequiredClaims map[string]json.RawMessage `json:"required_claims,omitempty"`
	Claims         map[string]json.RawMessage `json:"claims,omitempty"`
}

TrustPolicyConfig defines reusable claim restrictions and identity output.

type TurnstileConfig 

type TurnstileConfig struct {
	SiteKey    string                   `json:"site_key"`
	SecretName string                   `json:"secret_name"`
	RemoteIP   *TurnstileRemoteIPConfig `json:"remote_ip,omitempty"`
}

TurnstileConfig configures Cloudflare Turnstile verification.

type TurnstileRemoteIPConfig added in v2.3.0 

type TurnstileRemoteIPConfig struct {
	Source string `json:"source"`
	Header string `json:"header,omitempty"`
}

TurnstileRemoteIPConfig selects the trusted source of the visitor IP sent to Turnstile.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.