config

package
v2.6.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 6, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package config provides JSONC configuration loading and validation.

Index

Constants

View Source 
const DefaultSigningAlgorithm = "RS256"

Variables

This section is empty.

Functions

func ParseDuration 

func ParseDuration(value string) (time.Duration, error)

ParseDuration parses a positive Go duration string.

func PublicEndpointURL 

func PublicEndpointURL(issuer, endpoint string) string

PublicEndpointURL builds an externally visible endpoint solely from a validated issuer.

func ValidTrustBindingID 

func ValidTrustBindingID(id string) bool

ValidTrustBindingID reports whether id satisfies the shared static and dynamic binding identifier contract.

Types

type ClientConfig 

type ClientConfig struct {
	RedirectURIs                []string             `json:"redirect_uris,omitempty"`
	UserGroupMapping            string               `json:"user_group_mapping,omitempty"`
	RequireUserGroupsFromPolicy *bool                `json:"require_user_groups_from_policy,omitempty"`
	RefreshTokens               RefreshTokenConfig   `json:"refresh_tokens,omitempty"`
	TrustBindings               []TrustBindingConfig `json:"trust_bindings,omitempty"`
	DPoP                        DPoPConfig           `json:"dpop,omitempty"`
	RequirePAR                  bool                 `json:"require_par,omitempty"`
}

ClientConfig defines OIDC client-specific configuration. Each client can have custom redirect URIs and a user group mapping.

func (*ClientConfig) ShouldRequireUserGroupsFromPolicy 

func (c *ClientConfig) ShouldRequireUserGroupsFromPolicy(policyDefault *bool) bool

ShouldRequireUserGroupsFromPolicy returns whether policy must resolve user groups. It checks the client-specific setting first, falling back to the policy default. If neither is set, it defaults to true.

type ClientLookupCacheConfig 

type ClientLookupCacheConfig struct {
	TTL         Duration `json:"ttl,omitempty"`
	NegativeTTL Duration `json:"negative_ttl,omitempty"`
	MaxEntries  int      `json:"max_entries,omitempty"`
}

ClientLookupCacheConfig bounds positive and negative client existence lookups.

type Config 

type Config struct {
	Schema              string                       `json:"$schema,omitempty"`
	IssuerURL           string                       `json:"issuer_url"`
	HomepageURL         string                       `json:"homepage_url,omitempty"`
	HTTPListenAddr      string                       `json:"http_listen_addr"`
	ServingCertificate  *ServingCertificateConfig    `json:"serving_certificate,omitempty"`
	SigningAlgorithm    string                       `json:"signing_algorithm,omitempty"`
	JWKSKID             string                       `json:"jwks_kid,omitempty"`
	AccessTokenTTL      Duration                     `json:"access_token_ttl,omitempty"`
	IDTokenTTL          Duration                     `json:"id_token_ttl,omitempty"`
	Secrets             SecretsConfig                `json:"secrets"`
	UserLoginConnectors map[string]ConnectorConfig   `json:"user_login_connectors"`
	ServiceTokenIssuers map[string]TrustIssuerConfig `json:"service_token_issuers,omitempty"`
	TemplatesDir        string                       `json:"templates_dir,omitempty"`
	Email               *EmailConfig                 `json:"email,omitempty"`
	StaticPolicy        StaticPolicyConfig           `json:"static_policy,omitzero"`
	StateDatabase       *StateDatabaseConfig         `json:"state_database,omitempty"`
	PolicyDatabase      *PolicyDatabaseConfig        `json:"policy_database,omitempty"`
}

Config represents the top-level configuration structure for truster.

func Load 

func Load(path string) (*Config, error)

Load reads and parses a JSONC configuration file from the given path. It validates the configuration and returns an error if validation fails. The path parameter must be non-empty.

func Parse 

func Parse(data []byte) (*Config, error)

Parse parses and validates JSONC configuration data.

type ConnectorConfig 

type ConnectorConfig struct {
	Type              string         `json:"type"`
	DisplayName       string         `json:"display_name"`
	Order             int            `json:"order,omitempty"`
	CredentialsSecret string         `json:"credentials_secret,omitempty"`
	Scopes            []string       `json:"scopes"`
	Google            *GoogleConfig  `json:"google,omitempty"`
	GitHub            *GitHubConfig  `json:"github,omitempty"`
	Generic           *GenericConfig `json:"generic,omitempty"`
}

ConnectorConfig defines the upstream OAuth provider configuration. Supports Google, GitHub, and generic OAuth2/OIDC providers.

type DPoPConfig 

type DPoPConfig struct {
	Mode             string `json:"mode,omitempty"`
	SigningAlgorithm string `json:"signing_algorithm,omitempty"`
}

DPoPConfig controls sender-constrained proof requirements for a client.

type Duration 

type Duration time.Duration

Duration is a positive configuration duration. Its JSON representation uses the Go standard library duration syntax.

func (Duration) Duration 

func (d Duration) Duration() time.Duration

Duration returns the standard-library duration value.

func (Duration) MarshalJSON 

func (d Duration) MarshalJSON() ([]byte, error)

MarshalJSON emits a canonical duration string, or null for an absent duration.

func (*Duration) UnmarshalJSON 

func (d *Duration) UnmarshalJSON(data []byte) error

UnmarshalJSON parses a canonical human duration and records its presence.

type EffectiveTrustBinding 

type EffectiveTrustBinding struct {
	ID, Policy, Issuer, Subject string
	Groups                      []string
	Schema                      *jsonschema.Schema
}

EffectiveTrustBinding is an immutable startup-compiled auth rule.

type EmailConfig 

type EmailConfig struct {
	VerificationMode string           `json:"verification_mode"`
	OTPSecretName    string           `json:"otp_secret_name"`
	OTPTTL           Duration         `json:"otp_ttl,omitempty"`
	SMTP             *SMTPConfig      `json:"smtp,omitempty"`
	Turnstile        *TurnstileConfig `json:"turnstile,omitempty"`
}

EmailConfig controls optional email verification and direct email authentication.

type GenericConfig 

type GenericConfig struct {
	AuthorizationURL   string                `json:"authorization_url"`
	TokenURL           string                `json:"token_url"`
	UserinfoURL        string                `json:"userinfo_url"`
	EmailField         string                `json:"email_field,omitempty"`          // JSON field name for email in userinfo response
	EmailVerifiedField string                `json:"email_verified_field,omitempty"` // JSON field name for email verification status
	SubjectField       string                `json:"subject_field,omitempty"`
	Refresh            *GenericRefreshConfig `json:"refresh,omitempty"`
}

GenericConfig contains generic OAuth2/OIDC provider configuration options.

type GenericRefreshConfig 

type GenericRefreshConfig struct {
	Scopes              []string          `json:"scopes,omitempty"`
	AuthorizationParams map[string]string `json:"authorization_params,omitempty"`
}

GenericRefreshConfig configures renewable upstream credential acquisition.

type GitHubConfig 

type GitHubConfig struct {
	Hostname string `json:"hostname"`
}

GitHubConfig contains GitHub-specific OAuth configuration options.

type GoogleConfig 

type GoogleConfig struct {
	HostedDomain string `json:"hd"`
}

GoogleConfig contains Google-specific OAuth configuration options.

type PolicyBuildCacheConfig 

type PolicyBuildCacheConfig struct {
	MaxEntries int `json:"max_entries,omitempty"`
}

PolicyBuildCacheConfig bounds immutable built trust policy artifacts.

type PolicyClientDefaults 

type PolicyClientDefaults struct {
	RequireUserGroupsFromPolicy *bool              `json:"require_user_groups_from_policy,omitempty"`
	RefreshTokens               RefreshTokenConfig `json:"refresh_tokens,omitempty"`
	DPoP                        DPoPConfig         `json:"dpop,omitempty"`
	RequirePAR                  bool               `json:"require_par,omitempty"`
}

PolicyClientDefaults defines settings shared by dynamically resolved clients.

type PolicyDatabaseConfig 

type PolicyDatabaseConfig struct {
	Driver                 string                  `json:"driver"`
	ConnectionStringSecret string                  `json:"connection_string_secret"`
	RedirectURIs           []string                `json:"redirect_uris"`
	ClientDefaults         PolicyClientDefaults    `json:"client_defaults,omitempty"`
	Queries                PolicyQueries           `json:"queries,omitempty"`
	ClientLookupCache      ClientLookupCacheConfig `json:"client_lookup_cache,omitempty"`
	PolicyBuildCache       PolicyBuildCacheConfig  `json:"policy_build_cache,omitempty"`
	QueryTimeout           Duration                `json:"query_timeout,omitempty"`
	MaxConnections         int32                   `json:"max_connections,omitempty"`
	MaxTrustRows           int                     `json:"max_trust_rows,omitempty"`
	MaxGroups              int                     `json:"max_groups,omitempty"`
	MaxGroupBytes          int                     `json:"max_group_bytes,omitempty"`
	MaxJSONBytes           int                     `json:"max_json_bytes,omitempty"`
}

PolicyDatabaseConfig configures a supplemental policy database.

type PolicyQueries 

type PolicyQueries struct {
	ClientExists  string `json:"client_exists"`
	UserAccess    string `json:"user_access"`
	TrustBindings string `json:"trust_bindings"`
}

PolicyQueries contains the three parameterized policy database queries.

type RefreshTokenConfig 

type RefreshTokenConfig struct {
	Enabled            bool     `json:"enabled,omitempty"`
	AllowOfflineAccess bool     `json:"allow_offline_access,omitempty"`
	SessionIdleTTL     Duration `json:"session_idle_ttl,omitempty"`
	SessionAbsoluteTTL Duration `json:"session_absolute_ttl,omitempty"`
	OfflineIdleTTL     Duration `json:"offline_idle_ttl,omitempty"`
	OfflineAbsoluteTTL Duration `json:"offline_absolute_ttl,omitempty"`
}

RefreshTokenConfig controls refresh issuance and snapshotted grant lifetimes.

type SMTPConfig 

type SMTPConfig struct {
	Host              string `json:"host"`
	Port              int    `json:"port"`
	FromName          string `json:"from_name"`
	FromAddress       string `json:"from_address"`
	CredentialsSecret string `json:"credentials_secret"`
	TLSMode           string `json:"tls_mode,omitempty"`
}

SMTPConfig configures the verification email SMTP transport.

type SecretsConfig 

type SecretsConfig struct {
	Provider          string `json:"provider"`
	SigningKeyName    string `json:"signing_key_name"`
	EncryptionKeyName string `json:"encryption_key_name,omitempty"`
	AWSRegion         string `json:"aws_region,omitempty"`
	AzureKeyVaultURL  string `json:"azure_keyvault_url"`
	FileDirectory     string `json:"file_directory,omitempty"`
}

SecretsConfig defines the secrets provider configuration. Supports AWS Secrets Manager, AWS Systems Manager Parameter Store, Google Secret Manager, Azure Key Vault, file, and env-based secrets.

type ServingCertificateConfig 

type ServingCertificateConfig struct {
	CertificateFile string `json:"certificate_file"`
	PrivateKeyFile  string `json:"private_key_file"`
}

ServingCertificateConfig configures the certificate used by the HTTPS server.

type StateDatabaseConfig 

type StateDatabaseConfig struct {
	Driver                 string                         `json:"driver,omitempty"`
	Path                   string                         `json:"path,omitempty"`
	ConnectionStringSecret string                         `json:"connection_string_secret,omitempty"`
	MaxConnections         int                            `json:"max_connections,omitempty"`
	QueryTimeout           Duration                       `json:"query_timeout,omitempty"`
	Migrations             *StateDatabaseMigrationsConfig `json:"migrations,omitempty"`
}

StateDatabaseConfig configures the authoritative protocol-state database.

type StateDatabaseMigrationsConfig 

type StateDatabaseMigrationsConfig struct {
	ConnectionStringSecret string `json:"connection_string_secret,omitempty"`
}

StateDatabaseMigrationsConfig configures the optional migration-only database credential.

type StaticPolicyConfig 

type StaticPolicyConfig struct {
	RequireUserGroupsFromPolicy *bool                          `json:"require_user_groups_from_policy,omitempty"`
	DefaultRedirectURIs         []string                       `json:"default_redirect_uris,omitempty"`
	UserGroupMappings           map[string]map[string][]string `json:"user_group_mappings,omitempty"`
	TrustPolicies               map[string]TrustPolicyConfig   `json:"trust_policies,omitempty"`
	Clients                     map[string]ClientConfig        `json:"clients,omitempty"`
}

StaticPolicyConfig contains authorization policy defined in the configuration file.

type TrustBindingConfig 

type TrustBindingConfig struct {
	ID          string                     `json:"id"`
	TrustPolicy string                     `json:"trust_policy"`
	Subject     *string                    `json:"subject,omitempty"`
	Groups      []string                   `json:"groups,omitempty"`
	Claims      map[string]json.RawMessage `json:"claims,omitempty"`
	Effective   *EffectiveTrustBinding     `json:"-"`
}

TrustBindingConfig allows one policy for a downstream client.

type TrustIssuerConfig 

type TrustIssuerConfig struct {
	Provider    string   `json:"provider"`
	IssuerURL   string   `json:"issuer_url,omitempty"`
	SigningAlgs []string `json:"signing_algs,omitempty"`
	MaxTokenAge Duration `json:"max_token_age,omitempty"`
}

TrustIssuerConfig configures external OIDC verification.

type TrustPolicyConfig 

type TrustPolicyConfig struct {
	Issuer         string                     `json:"issuer"`
	Subject        string                     `json:"subject,omitempty"`
	Groups         []string                   `json:"groups,omitempty"`
	RequiredClaims map[string]json.RawMessage `json:"required_claims,omitempty"`
	Claims         map[string]json.RawMessage `json:"claims,omitempty"`
}

TrustPolicyConfig defines reusable claim restrictions and identity output.

type TurnstileConfig 

type TurnstileConfig struct {
	SiteKey    string                   `json:"site_key"`
	SecretName string                   `json:"secret_name"`
	RemoteIP   *TurnstileRemoteIPConfig `json:"remote_ip,omitempty"`
}

TurnstileConfig configures Cloudflare Turnstile verification.

type TurnstileRemoteIPConfig added in v2.3.0 

type TurnstileRemoteIPConfig struct {
	Source string `json:"source"`
	Header string `json:"header,omitempty"`
}

TurnstileRemoteIPConfig selects the trusted source of the visitor IP sent to Turnstile.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.