Documentation
¶
Overview ¶
Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
A preset (config.CloudflarePreset) names a DISABLED prototype token whose policies and condition are the rights; sluis clones them into a new account token that expires, and either stores it for consumers to read (external/cloudflare/<preset>, schema cloudflare/v1) or hands it to a granted caller. This package is the vocabulary that the pieces share:
- Token and NewToken, the two shapes of an account token the rest of the code speaks, as raw JSON for what must be copied exactly;
- CheckPrototype, the refusals a prototype must pass before it is cloned;
- the naming of minted tokens (StoredName, OnDemandName, Prefix), which is the only thing that says a token is sluis's to delete;
- R2Secret, how R2 derives an S3 secret from a token's value.
minter does the work over an API interface; cfapi is the real client over net/http. docs/guides/sluis/cloudflare-tokens.md is the operator's guide.
Index ¶
Constants ¶
const ( StatusActive = shared.StatusActive StatusDisabled = shared.StatusDisabled StatusExpired = shared.StatusExpired )
Status of a token in Cloudflare.
const ( ReasonPrototypeActive = shared.ReasonPrototypeActive ReasonPrototypeForbidden = shared.ReasonPrototypeForbidden ReasonPrototypeMissing = shared.ReasonPrototypeMissing ConditionIPKey = shared.ConditionIPKey )
The reasons a prototype is refused, and the condition's client-IP key.
Variables ¶
var ( R2Secret = shared.R2Secret Prefix = shared.Prefix StoredName = shared.StoredName OnDemandName = shared.OnDemandName SplitName = shared.SplitName IsOwn = shared.IsOwn IsStored = shared.IsStored Caller = shared.Caller ValidateInstance = shared.ValidateInstance ForbiddenGroup = shared.ForbiddenGroup ForbiddenGroupWith = shared.ForbiddenGroupWith GroupIDs = shared.GroupIDs CheckPrototype = shared.CheckPrototype IsPrototypeError = shared.IsPrototypeError ClonePolicies = shared.ClonePolicies CloneCondition = shared.CloneCondition )
The functions of the shared vocabulary.
var ErrNotFound = shared.ErrNotFound
ErrNotFound is a token Cloudflare does not have.
Functions ¶
This section is empty.
Types ¶
type PrototypeError ¶
type PrototypeError = shared.PrototypeError
PrototypeError is a prototype that must not be cloned.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package app assembles the Cloudflare module as a process of its own (docs/decisions/0071): the minter of ADR 0070 and its scheduled rotation, with the secrets store, the leases and the audit trail they need, and nothing of the issuer, the directory hub or another provider.
|
Package app assembles the Cloudflare module as a process of its own (docs/decisions/0071): the minter of ADR 0070 and its scheduled rotation, with the secrets store, the leases and the audit trail they need, and nothing of the issuer, the directory hub or another provider. |
|
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
|
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4. |
|
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
|
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller. |
|
Package rpc is the Cloudflare minter as another module sees it (docs/decisions/0071 D93 a): the on-demand mint and the grants listing, as methods of the `cloudflare` module over internal/modcall.
|
Package rpc is the Cloudflare minter as another module sees it (docs/decisions/0071 D93 a): the on-demand mint and the grants listing, as methods of the `cloudflare` module over internal/modcall. |