Directories
¶
| Path | Synopsis |
|---|---|
|
Package access decides who is at the console and what they may do.
|
Package access decides who is at the console and what they may do. |
|
Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
|
Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners. |
|
Package audit is what sluis tells the audit trail.
|
Package audit is what sluis tells the audit trail. |
|
audittest
Package audittest is a recorder a test can read back.
|
Package audittest is a recorder a test can read back. |
|
Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`).
|
Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`). |
|
Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
|
Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts. |
|
duration
Package duration is the time span a configuration document spells as a Go duration string.
|
Package duration is the time span a configuration document spells as a Go duration string. |
|
gen
command
Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
|
Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema. |
|
schema
Package schema builds the JSON Schema of each binary's configuration file.
|
Package schema builds the JSON Schema of each binary's configuration file. |
|
Package connector turns a directory's own sign-in screen into a workspace the hub can read.
|
Package connector turns a directory's own sign-in screen into a workspace the hub can read. |
|
Package consoleauth is how a controller proves itself to the console.
|
Package consoleauth is how a controller proves itself to the console. |
|
Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
|
Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected. |
|
Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
|
Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs. |
|
Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
|
Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased. |
|
Package exports copies secrets the console keeps OUT of the service, into the secret store a consumer reads (docs/decisions/0034).
|
Package exports copies secrets the console keeps OUT of the service, into the secret store a consumer reads (docs/decisions/0034). |
|
Package exportspec is what an export is, as a policy document declares it, and the rules one is held to: which sources exist, what each takes, and which two exports would write one place (docs/decisions/0034).
|
Package exportspec is what an export is, as a policy document declares it, and the rules one is held to: which sources exist, what each takes, and which two exports would write one place (docs/decisions/0034). |
|
Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
|
Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them. |
|
catalogue
Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
|
Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it. |
|
githubfake
Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
|
Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it. |
|
mints
Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
|
Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them. |
|
githubroster
|
|
|
app
Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
|
Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it. |
|
catalogueapp
Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
|
Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key. |
|
connection
Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
|
Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it. |
|
controller
Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
|
Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report. |
|
link
Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
|
Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it. |
|
reconcile
Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
|
Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there. |
|
runnerapp
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
|
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation. |
|
status
Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
|
Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it. |
|
Package health serves the two probes, and keeps them different.
|
Package health serves the two probes, and keeps them different. |
|
Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
|
Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend. |
|
Package hublocal asks the directory about a person by CALLING it.
|
Package hublocal asks the directory about a person by CALLING it. |
|
Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
|
Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens. |
|
Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
|
Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it. |
|
Package kmsfake is a KMS that wraps data key pairs, for tests of the `kms-wrapped` signing adapter.
|
Package kmsfake is a KMS that wraps data key pairs, for tests of the `kms-wrapped` signing adapter. |
|
Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
|
Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects. |
|
Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/lambda.md).
|
Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/lambda.md). |
|
Package logsafe makes a value safe to write into a log line.
|
Package logsafe makes a value safe to write into a log line. |
|
Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
|
Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`. |
|
Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/explanation/ports.md, and nothing else.
|
Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/explanation/ports.md, and nothing else. |
|
dynamodb
Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/explanation/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
|
Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/explanation/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes. |
|
invoke
Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/lambda.md).
|
Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/lambda.md). |
|
legacy
Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
|
Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey. |
|
matrixdoc
Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/adapters.md, from the adapter registry and the preset table.
|
Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/adapters.md, from the adapter registry and the preset table. |
|
matrixdoc/gen
command
Command gen writes docs/reference/adapters.md.
|
Command gen writes docs/reference/adapters.md. |
|
memory
Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/explanation/ports.md and nothing more.
|
Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/explanation/ports.md and nothing more. |
|
observe
Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
|
Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced. |
|
openbao
Package openbao is the port.Export adapter over an OpenBao (or Vault) KV version 2 mount: a copy of a secret is one key under the mount, written with the HTTP API and nothing else.
|
Package openbao is the port.Export adapter over an OpenBao (or Vault) KV version 2 mount: a copy of a secret is one key under the mount, written with the HTTP API and nothing else. |
|
porttest
Package porttest is the conformance suite of docs/explanation/ports.md.
|
Package porttest is the conformance suite of docs/explanation/ports.md. |
|
porttest/grantcost
Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it.
|
Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it. |
|
s3blob
Package s3blob is the S3 adapter of port.Blob (docs/explanation/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
|
Package s3blob is the S3 adapter of port.Blob (docs/explanation/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots. |
|
secretsexport
Package secretsexport is the port.Export over the Secrets port: a copy of a secret OUT of the service is the Secrets path `export/<path>`, which the ssm adapter keeps at `/sluis/export/<path>` (docs/reference/storage-layout.md).
|
Package secretsexport is the port.Export over the Secrets port: a copy of a secret OUT of the service is the Secrets path `export/<path>`, which the ssm adapter keeps at `/sluis/export/<path>` (docs/reference/storage-layout.md). |
|
ssm
Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/explanation/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters.
|
Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/explanation/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters. |
|
Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
|
Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential. |
|
portstoretest
Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
|
Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets. |
|
Package rails is what reconcilers share.
|
Package rails is what reconcilers share. |
|
Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
|
Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis. |
|
Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
|
Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes. |
|
Package secrets resolves the secrets a service document declares, by name.
|
Package secrets resolves the secrets a service document declares, by name. |
|
Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
|
Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port. |
|
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
|
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there. |
|
Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
|
Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place. |
|
catalogue
Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
|
Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for. |
|
catalogueapp
Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
|
Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token. |
|
slackfake
Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
|
Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it. |
|
slackroster
|
|
|
app
Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
|
Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it. |
|
apply
Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
|
Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply). |
|
connection
Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
|
Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it. |
|
controller
Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
|
Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report. |
|
reconcile
Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
|
Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there. |
|
status
Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
|
Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it. |
|
Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
|
Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them. |
|
Package telemetry is the OpenTelemetry metrics both processes publish.
|
Package telemetry is the OpenTelemetry metrics both processes publish. |
|
Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
|
Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer. |
|
Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
|
Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in. |
|
Package verify turns a token somebody else issued into a proof this installation will act on.
|
Package verify turns a token somebody else issued into a proof this installation will act on. |
|
Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
|
Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster. |
Click to show internal directories.
Click to hide internal directories.