Documentation
¶
Overview ¶
Package authpolicy resolves effective static and database policy.
Index ¶
- Variables
- func IsIndeterminate(err error) bool
- type CompiledBinding
- type DynamicTrustRow
- type IndeterminateError
- type PostgreSQL
- func (r *PostgreSQL) ClientExists(ctx context.Context, clientID string) (bool, error)
- func (r *PostgreSQL) Close()
- func (r *PostgreSQL) ResolveTrustBindings(ctx context.Context, clientID, issuerID string, ...) (bindings []CompiledBinding, finalErr error)
- func (r *PostgreSQL) ResolveTrustIssuer(ctx context.Context, clientID, issuerURL string) (issuerID string, issuer config.TrustIssuerConfig, finalErr error)
- func (r *PostgreSQL) ResolveUser(ctx context.Context, clientID, subject string, ...) (user ResolvedUser, finalErr error)
- type ResolvedClient
- type ResolvedTrustIssuer
- type ResolvedUser
- type Resolver
- func (r *Resolver) ResolveClient(ctx context.Context, clientID string, fresh bool) (ResolvedClient, error)
- func (r *Resolver) ResolveTrustBindings(ctx context.Context, client ResolvedClient, issuer ResolvedTrustIssuer) ([]config.EffectiveTrustBinding, error)
- func (r *Resolver) ResolveTrustIssuer(ctx context.Context, client ResolvedClient, issuerURL string) (ResolvedTrustIssuer, error)
- func (r *Resolver) ResolveUser(ctx context.Context, client ResolvedClient, subject string) (ResolvedUser, error)
Constants ¶
This section is empty.
Variables ¶
var ErrDenied = errors.New("auth denied")
ErrDenied marks a definitive, well-formed policy denial.
Functions ¶
func IsIndeterminate ¶
IsIndeterminate reports whether err is a retryable resolver failure.
Types ¶
type CompiledBinding ¶
type CompiledBinding struct {
ID, Subject, DiagnosticKey string
Groups []string
Schema *jsonschema.Schema
}
CompiledBinding combines current identity output with an immutable effective schema.
type DynamicTrustRow ¶
type DynamicTrustRow struct {
ClientID, IssuerID, BindingID, Subject string
RequiredClaims, PolicyClaims, BindingClaims map[string]json.RawMessage
Groups []string
}
DynamicTrustRow is one strict trust_bindings query input.
type IndeterminateError ¶
type IndeterminateError struct{ Err error }
IndeterminateError marks a resolver or malformed-result failure that callers may retry.
func (*IndeterminateError) Error ¶
func (e *IndeterminateError) Error() string
Error returns a non-sensitive failure description.
func (*IndeterminateError) Unwrap ¶
func (e *IndeterminateError) Unwrap() error
Unwrap returns the underlying resolver error.
type PostgreSQL ¶
type PostgreSQL struct {
// contains filtered or unexported fields
}
PostgreSQL resolves database policy and owns independent bounded caches.
func NewPostgreSQL ¶
func NewPostgreSQL(ctx context.Context, connectionString string, cfg config.PolicyDatabaseConfig, issuers map[string]config.TrustIssuerConfig, logger *slog.Logger) (*PostgreSQL, error)
NewPostgreSQL validates the connection string and creates a dedicated pgx pool.
func (*PostgreSQL) ClientExists ¶
ClientExists resolves and caches only definitive positive or negative existence results.
func (*PostgreSQL) ResolveTrustBindings ¶
func (r *PostgreSQL) ResolveTrustBindings(ctx context.Context, clientID, issuerID string, issuer config.TrustIssuerConfig) (bindings []CompiledBinding, finalErr error)
ResolveTrustBindings queries strict rows and compiles bindings using the resolved issuer policy.
func (*PostgreSQL) ResolveTrustIssuer ¶
func (r *PostgreSQL) ResolveTrustIssuer(ctx context.Context, clientID, issuerURL string) (issuerID string, issuer config.TrustIssuerConfig, finalErr error)
ResolveTrustIssuer resolves one current generic OIDC issuer by exact URL.
func (*PostgreSQL) ResolveUser ¶
func (r *PostgreSQL) ResolveUser(ctx context.Context, clientID, subject string, requireUserGroupsFromPolicy bool) (user ResolvedUser, finalErr error)
ResolveUser resolves a normalized subject and returns definitive groups or denial.
type ResolvedClient ¶
type ResolvedClient struct {
Config config.ClientConfig
// contains filtered or unexported fields
}
ResolvedClient contains effective client policy and resolver-owned identity.
type ResolvedTrustIssuer ¶
type ResolvedTrustIssuer struct {
ID string
Config config.TrustIssuerConfig
Dynamic bool
// contains filtered or unexported fields
}
ResolvedTrustIssuer contains effective issuer verification policy and resolver-owned identity.
type ResolvedUser ¶
type ResolvedUser struct{ Groups []string }
ResolvedUser contains the effective current groups for a user.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver gives static clients deterministic precedence over database policy.
func NewResolver ¶
func NewResolver(cfg *config.Config, policyDatabase *PostgreSQL) *Resolver
NewResolver combines static configuration with an optional policy database.
func (*Resolver) ResolveClient ¶
func (r *Resolver) ResolveClient(ctx context.Context, clientID string, fresh bool) (ResolvedClient, error)
ResolveClient resolves effective policy for a client supplied by static or database policy. Fresh bypasses the existence cache for required pre-issuance checks.
func (*Resolver) ResolveTrustBindings ¶
func (r *Resolver) ResolveTrustBindings(ctx context.Context, client ResolvedClient, issuer ResolvedTrustIssuer) ([]config.EffectiveTrustBinding, error)
ResolveTrustBindings returns effective trust bindings for a client and resolved issuer.
func (*Resolver) ResolveTrustIssuer ¶
func (r *Resolver) ResolveTrustIssuer(ctx context.Context, client ResolvedClient, issuerURL string) (ResolvedTrustIssuer, error)
ResolveTrustIssuer resolves an exact token issuer without trusting unverified token claims as configuration.
func (*Resolver) ResolveUser ¶
func (r *Resolver) ResolveUser(ctx context.Context, client ResolvedClient, subject string) (ResolvedUser, error)
ResolveUser returns effective current user policy without exposing its storage.
Source Files