Documentation
¶
Overview ¶
Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
A preset (config.CloudflarePreset) names a DISABLED prototype token whose policies and condition are the rights; sluis clones them into a new account token that expires, and either stores it for consumers to read (external/cloudflare/<preset>, schema cloudflare/v1) or hands it to a granted caller. This package is the vocabulary that the pieces share:
- Token and NewToken, the two shapes of an account token the rest of the code speaks, as raw JSON for what must be copied exactly;
- CheckPrototype, the refusals a prototype must pass before it is cloned;
- the naming of minted tokens (StoredName, OnDemandName, Prefix), which is the only thing that says a token is sluis's to delete;
- R2Secret, how R2 derives an S3 secret from a token's value.
minter does the work over an API interface; cfapi is the real client over net/http. docs/guides/sluis/cloudflare-tokens.md is the operator's guide.
Index ¶
Constants ¶
const ( StatusActive = shared.StatusActive StatusDisabled = shared.StatusDisabled StatusExpired = shared.StatusExpired )
Status of a token in Cloudflare.
const ( ReasonPrototypeActive = shared.ReasonPrototypeActive ReasonPrototypeForbidden = shared.ReasonPrototypeForbidden ReasonPrototypeMissing = shared.ReasonPrototypeMissing ConditionIPKey = shared.ConditionIPKey )
The reasons a prototype is refused, and the condition's client-IP key.
Variables ¶
var ( R2Secret = shared.R2Secret Prefix = shared.Prefix StoredName = shared.StoredName OnDemandName = shared.OnDemandName SplitName = shared.SplitName IsOwn = shared.IsOwn IsStored = shared.IsStored Caller = shared.Caller ValidateInstance = shared.ValidateInstance ForbiddenGroup = shared.ForbiddenGroup ForbiddenGroupWith = shared.ForbiddenGroupWith GroupIDs = shared.GroupIDs CheckPrototype = shared.CheckPrototype IsPrototypeError = shared.IsPrototypeError ClonePolicies = shared.ClonePolicies CloneCondition = shared.CloneCondition )
The functions of the shared vocabulary.
var ErrNotFound = shared.ErrNotFound
ErrNotFound is a token Cloudflare does not have.
Functions ¶
This section is empty.
Types ¶
type PrototypeError ¶
type PrototypeError = shared.PrototypeError
PrototypeError is a prototype that must not be cloned.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
|
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4. |
|
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
|
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller. |