Documentation
¶
Overview ¶
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
Everything else an operator sees — the internal groups, what they add, the lifetimes, the clients, the intervals — is deployment configuration, shown read-only.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDeclared = errors.New("settings: declared by the deployment")
ErrDeclared is returned when the deployment owns what is being changed.
Functions ¶
This section is empty.
Types ¶
type Memory ¶
type Memory struct {
// contains filtered or unexported fields
}
Memory is a Store in process memory: the prototype's, and the fake behind tests of the one that persists.
func NewMemory ¶
func NewMemory(declared OAuthClient) *Memory
NewMemory returns a store, optionally seeded with a declared client.
func (*Memory) OAuthClient ¶
func (m *Memory) OAuthClient(_ context.Context) (OAuthClient, error)
OAuthClient implements Store.
type OAuthClient ¶
type OAuthClient struct {
ID string
Secret string
// Declared marks a client the chart named, which the console shows
// but cannot change.
Declared bool
}
OAuthClient is the client an installation registered once with its directory backend: it drives both admin consent and operator sign-in.
func (OAuthClient) Configured ¶
func (c OAuthClient) Configured() bool
Configured reports whether both halves are present.
type Store ¶
type Store interface {
// OAuthClient returns the client, which may be unconfigured.
OAuthClient(ctx context.Context) (OAuthClient, error)
}
Store keeps what the deployment configured for the console to read.
It used to keep what the console WROTE — the OAuth client somebody pasted in, and the memberships layer. Neither is written any more: the client is a Secret, delivered the way every other credential in the estate is, and who is in which internal group is the policy, rendered from the installation's own access model and reviewed in git.
Source Files