sluis

package module
v1.65.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 5, 2026 License: MIT Imports: 1 Imported by: 0

README

sluis

CI

Formerly access-roster (CLI accessctl, now sluisctl). What changed and what deliberately did not: ADR 0035.

The policy is the product. sluis is one small OpenID provider and one policy file in git. The file turns the groups your people already have in the corporate directory, and the identities your machines already hold (a GitHub Actions job, a Kubernetes ServiceAccount), into one vocabulary of internal groups, gated per audience.

Everything that can read a claim gets that vocabulary minted into a token. Everything that cannot (GitHub teams, Slack channels) gets it reconciled into a membership by a controller that reads the same file. Nothing here authenticates anyone: sign-in, passwords and MFA stay with the corporate directory. sluis has no database of record and no users of its own. It runs as one process (ADR 0037). Why it exists and how it differs from an identity product: why sluis.

Who it is for

Platform teams that run a corporate directory and want one reviewed policy file to drive tokens, GitHub teams and Slack channels. It assumes AWS (Lambda, or Kubernetes with AWS storage) or an older Kubernetes install on the legacy store. It installs no identity store, no passwords and no MFA: those stay with the directory.

The model

  • Directory: where people and their groups come from.
  • Policy: the file in git that maps directory groups and machine identities to internal groups, per audience.
  • Issuer and controllers: one process that mints tokens and reconciles GitHub and Slack from the same file.
Shape What runs Start with
AWS Lambda one function, one role; DynamoDB state, SSM or OpenBao secrets, S3 blobs, KMS-wrapped signing AWS Lambda
Kubernetes on AWS (k8s-aws) one Deployment, one Pod Identity role; the same AWS adapters Kubernetes on AWS
Kubernetes, legacy store one Deployment; state in Kubernetes objects and Valkey (older installations) legacy store

The presets server, k8s-minimal and k8s-openbao are unavailable: they name adapters that are planned and not built (adapters). To choose between the shapes, read getting started.

Install and a worked example

Render the two documents from an installation file, then install the chart with them (tutorial):

sluisctl render --installation installation.yaml --out rendered/
helm install sluis oci://ghcr.io/truvity/charts/sluis \
  --version X.Y.Z --namespace sluis --create-namespace \
  --values values.yaml \
  --set-file documents.service=rendered/sluis.yaml --set-file documents.policy=rendered/policy.yaml

A minimal installation.yaml and every key are in the installation document.

Consumers

The sluis chart installs in truvity/gitops and a second, non-AWS estate. The Go module is imported by truvity/gitops (policy, in its render tests) and by truvity/gemaal (identity). CI workflows use sluisctl and the GitHub Action truvity/sluis; developers use sluisctl to mint credentials locally. The sluis service is a token audience for truvity/cloudflare (r2broker) and truvity/observability (vmauth).

Neighbours

  • openbao: sluis mints tokens; openbao trusts them and issues certificates (integration).
  • audit: every decision, sign-in, refusal and console action is one record, written by the issuer and the controllers.
  • workstation: sluisctl and awsctl both mint AWS credentials on a laptop; sluisctl is the estate path.

Documentation

docs/index.md is the one entry point, organised by what you are trying to do: tutorials (docs/getting-started/), tasks (docs/how-to/), reference (docs/reference/), explanation (docs/explanation/) and decisions (docs/decisions/). Upgrading is docs/how-to/upgrade/: v1.62, v1.63, v1.64. CHANGELOG.md says what changed, per version; the steps are in the upgrade pages. What is refused and why: safety. OpenID conformance results: conformance.

What ships

Every artifact is stamped by one tag, vX.Y.Z; pin one version of this repository.

Artifact Published at For
sluis chart and image oci://ghcr.io/truvity/charts/sluis, ghcr.io/truvity/sluis/sluis the installation on Kubernetes: one image, one chart, one Deployment (sluis serve, with the GitHub and Slack controllers as loops inside it, named in config.controllers). Chart values: chart README
resource-proxy image ghcr.io/truvity/sluis/resource-proxy the resource-server sidecar a consumer's chart names beside the container it fronts
sluis-lambda_<version>_linux_arm64.zip the release's assets the AWS Lambda function (arm64): the release zip, deployed unchanged by the Pulumi library
sluis_<version>_<os>_<arch> archives the release's assets the sluis binary (serve, migrate), the resource-proxy binary and the sluis-acceptance test binary
sluisctl the release's archives (sluisctl_<version>_<os>_<arch>), and a Nix flake on every release people on laptops and CI jobs: sign in, then kubeconfigs, AWS credentials, tokens for any audience, render and policy render
accessctl_<version>_<os>_<arch> the release's assets sluisctl under its old name, deprecated
sluis-config-schemas_<version>.tar.gz the release's assets the JSON Schemas of the service, policy and installation documents
sluis-audit-catalogue_<version>.tar.gz the release's assets the audit catalogue roster.yaml with every schema it references: the audit writer refuses to start without them
checksums.txt the release's assets SHA-256 of every archive above
Pulumi library github.com/truvity/sluis/deploy/pulumi (tag deploy/pulumi/vX.Y.Z) AWS infrastructure and the Lambda: Pulumi library
Go module github.com/truvity/sluis services and consoles in Go: verify a bearer, read the caller's groups (Go module)
TypeScript package @truvity/sluis on GitHub Packages console UIs: useIdentity() over /.access/whoami; Node services: verify a bearer
GitHub Action truvity/sluis@<commit> workflows: one exchange, then a kubeconfig, AWS profiles, or a GitHub App token
an Entra directory backend none planned: a second corporate directory behind the same workspace record

The rule that makes this repository public

Mechanism only. Nothing here names an account, a zone, a hostname, a cluster, an issuer or a secret path of any installation: every such thing is a value with a neutral example (example.com, acme, globex), and the installation supplies it from its own repository. The rule covers code, docs, the CHANGELOG, tests, commit messages and pull request text, and hack/leak-canary.sh enforces it in just check and in CI. This repository follows the shared component contract.

Status

Used in production by its maintainers; releases. Presets server, k8s-minimal and k8s-openbao are unavailable.

Development

devbox shell        # or direnv: Go, buf, golangci-lint, helm, just, lefthook
just check          # build, test, lint, chart-lint, telemetry, archive-check, docs-check, leak-canary, audit-catalogue, ts
just vuln           # govulncheck; separate from check, a new CVE must not turn it red
just generate       # proto to gen/ after a contract change; the generated code is committed

CONTRIBUTING.md has the conventions and the console's build order.

Releasing

Push a tag vX.Y.Z: the release workflow publishes the images, the chart, sluisctl and its Nix flake, the TypeScript package, the Go module and the Action at that version. The Pulumi library's tag is cut by the release itself, with its require pinned to the release. Auto-release cuts patch tags when changes merge to master; a minor needs its ## vX.Y.0 CHANGELOG heading and is tagged by hand.

Licence

MIT, see LICENSE.

Documentation

Overview

Package sluis carries the files this repository publishes as data.

Index

Constants

This section is empty.

Variables

View Source 
var ConfigSchemas embed.FS

ConfigSchemas are the schemas of the configuration documents, under schemas/config/: the three service documents and the policy document. They are generated by `just config-schemas` from internal/config and committed, so that a deployment can validate its file without this repository's code, and so that the binary validates against the very file a chart's tests do. schemas/config/v1/ holds the v1 service documents' schemas, frozen: a v1 document is held to its own schema before it is converted.

Functions

This section is empty.

Types

This section is empty.

Source Files

View all Source files

Directories

Path Synopsis
audit module
deploy/pulumi module
sdk module
Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
 Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
fake
Package fake is a directory backend held in memory, with a scriptable failure for every operation.
 Package fake is a directory backend held in memory, with a scriptable failure for every operation.
google
Package google reads a Google Workspace through the Admin SDK.
 Package google reads a Google Workspace through the Admin SDK.
cmd
acceptance command
Command acceptance exercises access-issuer against a real Kubernetes API server.
 Command acceptance exercises access-issuer against a real Kubernetes API server.
docsgen command
Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
 Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
resource-proxy command
Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
 Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
sluis command
Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
 Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
sluis-lambda command
Command sluis-lambda is sluis as ONE AWS Lambda function: one arm64 `bootstrap` binary in one zip, deployed as one function that serves API Gateway events and runs the controllers' passes.
 Command sluis-lambda is sluis as ONE AWS Lambda function: one arm64 `bootstrap` binary in one zip, deployed as one function that serves API Gateway events and runs the controllers' passes.
sluisctl command
Command sluisctl is what a person on a laptop runs.
 Command sluisctl is what a person on a laptop runs.
Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
 Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
deploy
pulumi module
pulumi/edge/cloudflare module
Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
 Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
gen
accessissuer/v1
accessissuer/v1/accessissuerv1connect
Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
 Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
directory/v1
directory/v1/directoryv1connect
Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
 Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
directoryroster/v1
directoryroster/v1/directoryrosterv1connect
Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
 Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
Package identity turns a token somebody else issued into the caller a listener acts on.
 Package identity turns a token somebody else issued into the caller a listener acts on.
resource
Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
 Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
internal
access
Package access decides who is at the console and what they may do.
 Package access decides who is at the console and what they may do.
app
Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
 Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
audit
Package audit is what sluis tells the audit trail.
 Package audit is what sluis tells the audit trail.
audit/audittest
Package audittest is a recorder a test can read back.
 Package audittest is a recorder a test can read back.
config
Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
 Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
config/duration
Package duration is the time span a configuration document spells as a Go duration string.
 Package duration is the time span a configuration document spells as a Go duration string.
config/gen command
Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
 Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
config/schema
Package schema builds the JSON Schema of each binary's configuration file.
 Package schema builds the JSON Schema of each binary's configuration file.
connector
Package connector turns a directory's own sign-in screen into a workspace the hub can read.
 Package connector turns a directory's own sign-in screen into a workspace the hub can read.
consoleauth
Package consoleauth is how a controller proves itself to the console.
 Package consoleauth is how a controller proves itself to the console.
demo
Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
 Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
docsgen
Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
 Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
emailaddr
Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
 Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
exports
Package exports copies secrets the console keeps OUT of the service, into the secret store a consumer reads (docs/decisions/0034).
 Package exports copies secrets the console keeps OUT of the service, into the secret store a consumer reads (docs/decisions/0034).
exportspec
Package exportspec is what an export is, as a policy document declares it, and the rules one is held to: which sources exist, what each takes, and which two exports would write one place (docs/decisions/0034).
 Package exportspec is what an export is, as a policy document declares it, and the rules one is held to: which sources exist, what each takes, and which two exports would write one place (docs/decisions/0034).
githubapp
Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
 Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
githubapp/catalogue
Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
 Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
githubapp/githubfake
Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
 Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
githubapp/mints
Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
 Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
githubroster/app
Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
 Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
githubroster/catalogueapp
Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
 Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
githubroster/connection
Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
githubroster/controller
Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
 Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
githubroster/link
Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
 Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
githubroster/reconcile
Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
 Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
githubroster/runnerapp
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
 Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
githubroster/status
Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
 Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
health
Package health serves the two probes, and keeps them different.
 Package health serves the two probes, and keeps them different.
hub
Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
 Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
hublocal
Package hublocal asks the directory about a person by CALLING it.
 Package hublocal asks the directory about a person by CALLING it.
issuer
Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
 Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
issuerapp
Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
 Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
kmsfake
Package kmsfake is a KMS that wraps data key pairs, for tests of the `kms-wrapped` signing adapter.
 Package kmsfake is a KMS that wraps data key pairs, for tests of the `kms-wrapped` signing adapter.
kube
Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
 Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
lambdaapp
Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/lambda.md).
 Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/lambda.md).
logsafe
Package logsafe makes a value safe to write into a log line.
 Package logsafe makes a value safe to write into a log line.
migrate
Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
 Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
port
Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/explanation/ports.md, and nothing else.
 Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/explanation/ports.md, and nothing else.
port/dynamodb
Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/explanation/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
 Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/explanation/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
port/invoke
Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/lambda.md).
 Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/lambda.md).
port/legacy
Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
 Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
port/matrixdoc
Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/adapters.md, from the adapter registry and the preset table.
 Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/adapters.md, from the adapter registry and the preset table.
port/matrixdoc/gen command
Command gen writes docs/reference/adapters.md.
 Command gen writes docs/reference/adapters.md.
port/memory
Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/explanation/ports.md and nothing more.
 Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/explanation/ports.md and nothing more.
port/observe
Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
 Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
port/openbao
Package openbao is the port.Export adapter over an OpenBao (or Vault) KV version 2 mount: a copy of a secret is one key under the mount, written with the HTTP API and nothing else.
 Package openbao is the port.Export adapter over an OpenBao (or Vault) KV version 2 mount: a copy of a secret is one key under the mount, written with the HTTP API and nothing else.
port/porttest
Package porttest is the conformance suite of docs/explanation/ports.md.
 Package porttest is the conformance suite of docs/explanation/ports.md.
port/s3blob
Package s3blob is the S3 adapter of port.Blob (docs/explanation/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
 Package s3blob is the S3 adapter of port.Blob (docs/explanation/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
port/secretsexport
Package secretsexport is the port.Export over the Secrets port: a copy of a secret OUT of the service is the Secrets path `export/<path>`, which the ssm adapter keeps at `/sluis/export/<path>` (docs/reference/storage-layout.md).
 Package secretsexport is the port.Export over the Secrets port: a copy of a secret OUT of the service is the Secrets path `export/<path>`, which the ssm adapter keeps at `/sluis/export/<path>` (docs/reference/storage-layout.md).
port/ssm
Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/explanation/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters.
 Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/explanation/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters.
portstore
Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
 Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
portstore/portstoretest
Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
 Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
rails
Package rails is what reconcilers share.
 Package rails is what reconcilers share.
resourceproxy
Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
 Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
rosterapp
Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
 Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
secrets
Package secrets resolves the secrets a service document declares, by name.
 Package secrets resolves the secrets a service document declares, by name.
server
Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
 Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
settings
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
 Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
slackapp
Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
 Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
slackapp/catalogue
Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
 Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
slackapp/catalogueapp
Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
 Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
slackapp/slackfake
Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
 Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
slackroster/app
Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
 Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
slackroster/apply
Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
 Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
slackroster/connection
Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
slackroster/controller
Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
 Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
slackroster/reconcile
Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
 Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
slackroster/status
Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
 Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
store
Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
 Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
telemetry
Package telemetry is the OpenTelemetry metrics both processes publish.
 Package telemetry is the OpenTelemetry metrics both processes publish.
testissuer
Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
 Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
valkey
Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
 Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
verify
Package verify turns a token somebody else issued into a proof this installation will act on.
 Package verify turns a token somebody else issued into a proof this installation will act on.
version
Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
 Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
 Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
storage module
Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.
 Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.