sluis

package module
v1.74.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 9, 2026 License: MIT Imports: 1 Imported by: 0

README

sluis

sluis turns the proofs you already have into short-lived tokens under one policy file. audit keeps a tamper-evident record. One tag, one version.

CI Release

Deliverable Published at
sluis and audit images ghcr.io/truvity/sluis/*, ghcr.io/truvity/audit/*
Helm charts sluis, audit oci://ghcr.io/truvity/charts/sluis, oci://ghcr.io/truvity/charts/audit
sluisctl, audit CLI, Lambda zips the GitHub release
Go modules (root, storage, audit, Pulumi libraries) github.com/truvity/sluis[/<dir>], tagged with the release
@truvity/sluis, @truvity/audit, @truvity/audit-react GitHub Packages
GitHub Action truvity/sluis@<commit>

Who it is for

Platform teams that drive tokens, GitHub teams and Slack channels from one reviewed policy file. Applications that need an audit trail an auditor can verify.

The model

A policy file maps directory groups and machine identities to groups. sluis mints tokens and reconciles GitHub and Slack from it; audit records what it did. See concepts.

Install and a worked example

sluisctl render --installation installation.yaml --out rendered/
helm install sluis oci://ghcr.io/truvity/charts/sluis --version X.Y.Z --namespace sluis --create-namespace \
  --values values.yaml --set-file documents.service=rendered/sluis.yaml --set-file documents.policy=rendered/policy.yaml
Try it without a credential
cat > /tmp/demo.yaml <<'YAML'
demo: true
store: memory
allowInsecure: true
issuerURL: http://localhost:8099
publicURL: http://localhost:8099/console
listen: {address: ":8099"}
probes: {address: ":7099"}
YAML
go run ./cmd/sluis serve --config /tmp/demo.yaml

Open http://localhost:8099/console/ and choose Continue with the demonstration directory.

Consumers

Consumer Uses
Estates the Helm charts or the Pulumi libraries
Services the Go module or @truvity/sluis
CI jobs the GitHub Action and sluisctl
People sluisctl

Neighbours

Neighbour Role
OpenBao trusts sluis tokens and issues certificates; can be audit's key provider
Cloudflare fronts the Lambda shape; can hold audit's archive on R2

Documentation

Topic Where
The site https://truvity.github.io/sluis/
Tutorials sluis, audit
Every deliverable artifacts
Upgrades the CHANGELOG links an upgrade page from each breaking entry

The rule that makes this repository public

Mechanism only: no account, hostname or secret path of an installation. hack/leak-canary.sh enforces it.

Status

Used in production by its maintainers. audit may break in a minor, with a Breaking: entry. Report vulnerabilities as SECURITY.md says.

Development

Run devbox shell, then just check. See CONTRIBUTING.

Releasing

By hand, as a pushed tag vX.Y.Z. See CONTRIBUTING.

Licence

MIT, see LICENSE.

Documentation

Overview

Package sluis carries the files this repository publishes as data.

Index

Constants

This section is empty.

Variables

View Source 
var ConfigSchemas embed.FS

ConfigSchemas are the schemas of the configuration documents, under schemas/config/: the three service documents and the policy document. They are generated by `just config-schemas` from internal/config and committed, so that a deployment can validate its file without this repository's code, and so that the binary validates against the very file a chart's tests do. schemas/config/v1/ holds the v1 service documents' schemas, frozen: a v1 document is held to its own schema before it is converted.

Functions

This section is empty.

Types

This section is empty.

Source Files

View all Source files

Directories

Path Synopsis
audit module
deploy/pulumi module
sdk module
Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
 Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
fake
Package fake is a directory backend held in memory, with a scriptable failure for every operation.
 Package fake is a directory backend held in memory, with a scriptable failure for every operation.
google
Package google reads a Google Workspace through the Admin SDK.
 Package google reads a Google Workspace through the Admin SDK.
cmd
acceptance command
Command acceptance exercises access-issuer against a real Kubernetes API server.
 Command acceptance exercises access-issuer against a real Kubernetes API server.
docsgen command
Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
 Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
resource-proxy command
Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
 Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
sluis command
Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
 Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
sluis-lambda command
Command sluis-lambda is sluis as ONE AWS Lambda function: one arm64 `bootstrap` binary in one zip, deployed as one function that serves API Gateway events and runs the controllers' passes.
 Command sluis-lambda is sluis as ONE AWS Lambda function: one arm64 `bootstrap` binary in one zip, deployed as one function that serves API Gateway events and runs the controllers' passes.
sluisctl command
Command sluisctl is what a person on a laptop runs.
 Command sluisctl is what a person on a laptop runs.
Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
 Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
deploy
pulumi module
pulumi/edge/cloudflare module
Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
 Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
gen
accessissuer/v1
accessissuer/v1/accessissuerv1connect
Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
 Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
directory/v1
directory/v1/directoryv1connect
Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
 Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
directoryroster/v1
directoryroster/v1/directoryrosterv1connect
Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
 Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
Package identity turns a token somebody else issued into the caller a listener acts on.
 Package identity turns a token somebody else issued into the caller a listener acts on.
resource
Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
 Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
internal
access
Package access decides who is at the console and what they may do.
 Package access decides who is at the console and what they may do.
app
Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
 Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
audit
Package audit is what sluis tells the audit trail.
 Package audit is what sluis tells the audit trail.
audit/audittest
Package audittest is a recorder a test can read back.
 Package audittest is a recorder a test can read back.
awsretry
Package awsretry is the retryer of the SSM clients sluis reads its configuration and secrets with.
 Package awsretry is the retryer of the SSM clients sluis reads its configuration and secrets with.
clientcreds
Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`).
 Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`).
cloudflare
Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
 Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
cloudflare/cfapi
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
 Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
cloudflare/minter
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
 Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
config
Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
 Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
config/duration
Package duration is the time span a configuration document spells as a Go duration string.
 Package duration is the time span a configuration document spells as a Go duration string.
config/gen command
Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
 Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
config/schema
Package schema builds the JSON Schema of each binary's configuration file.
 Package schema builds the JSON Schema of each binary's configuration file.
connector
Package connector turns a directory's own sign-in screen into a workspace the hub can read.
 Package connector turns a directory's own sign-in screen into a workspace the hub can read.
consoleauth
Package consoleauth is how a controller proves itself to the console.
 Package consoleauth is how a controller proves itself to the console.
demo
Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
 Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
docsgen
Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
 Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
emailaddr
Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
 Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
githubapp
Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
 Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
githubapp/catalogue
Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
 Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
githubapp/githubfake
Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
 Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
githubapp/mints
Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
 Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
githubroster/app
Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
 Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
githubroster/catalogueapp
Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
 Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
githubroster/connection
Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
githubroster/controller
Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
 Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
githubroster/link
Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
 Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
githubroster/reconcile
Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
 Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
githubroster/runnerapp
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
 Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
githubroster/status
Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
 Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
health
Package health serves the two probes, and keeps them different.
 Package health serves the two probes, and keeps them different.
hub
Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
 Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
hublocal
Package hublocal asks the directory about a person by CALLING it.
 Package hublocal asks the directory about a person by CALLING it.
issuer
Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
 Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
issuerapp
Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
 Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
kube
Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
 Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
lambdaapp
Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/sluis/lambda.md).
 Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/sluis/lambda.md).
migrate
Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
 Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
port
Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/concepts/sluis/ports.md, and nothing else.
 Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/concepts/sluis/ports.md, and nothing else.
port/dynamodb
Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/concepts/sluis/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
 Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/concepts/sluis/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
port/invoke
Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/sluis/lambda.md).
 Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","target":"<id>"} (docs/reference/sluis/lambda.md).
port/legacy
Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
 Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
port/matrixdoc
Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/sluis/adapters.md, from the adapter registry and the preset table.
 Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/sluis/adapters.md, from the adapter registry and the preset table.
port/matrixdoc/gen command
Command gen writes docs/reference/sluis/adapters.md.
 Command gen writes docs/reference/sluis/adapters.md.
port/memory
Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/concepts/sluis/ports.md and nothing more.
 Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/concepts/sluis/ports.md and nothing more.
port/observe
Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
 Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
port/openbao
Package openbao is the secrets adapter over an OpenBao (or Vault) KV version 2 mount, written with the HTTP API and nothing else (see Secrets).
 Package openbao is the secrets adapter over an OpenBao (or Vault) KV version 2 mount, written with the HTTP API and nothing else (see Secrets).
port/porttest
Package porttest is the conformance suite of docs/concepts/sluis/ports.md.
 Package porttest is the conformance suite of docs/concepts/sluis/ports.md.
port/porttest/grantcost
Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it.
 Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it.
port/s3blob
Package s3blob is the S3 adapter of port.Blob (docs/concepts/sluis/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
 Package s3blob is the S3 adapter of port.Blob (docs/concepts/sluis/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
port/ssm
Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/concepts/sluis/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters.
 Package ssm is the AWS Systems Manager Parameter Store adapter of port.Secrets (docs/concepts/sluis/ports.md, "Secrets"): dynamic secrets and the exports as SecureString parameters.
portstore
Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
 Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
portstore/portstoretest
Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
 Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
rails
Package rails is what reconcilers share.
 Package rails is what reconcilers share.
resourceproxy
Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
 Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
rosterapp
Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
 Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
secrets
Package secrets resolves the secrets a service document declares, by name.
 Package secrets resolves the secrets a service document declares, by name.
secretstore
Package secretstore is sluis's view of its secrets on a state.Store under layout v4 (docs/decisions/0041-the-secret-contract.md).
 Package secretstore is sluis's view of its secrets on a state.Store under layout v4 (docs/decisions/0041-the-secret-contract.md).
server
Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
 Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
settings
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
 Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
slackapp
Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
 Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
slackapp/catalogue
Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
 Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
slackapp/catalogueapp
Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
 Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
slackapp/slackfake
Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
 Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
slackroster/app
Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
 Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
slackroster/apply
Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
 Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
slackroster/connection
Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
slackroster/controller
Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
 Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
slackroster/reconcile
Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
 Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
slackroster/status
Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
 Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
store
Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
 Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
telemetry
Package telemetry is the OpenTelemetry metrics both processes publish.
 Package telemetry is the OpenTelemetry metrics both processes publish.
testissuer
Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
 Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
valkey
Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
 Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
verify
Package verify turns a token somebody else issued into a proof this installation will act on.
 Package verify turns a token somebody else issued into a proof this installation will act on.
version
Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
 Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
 Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
storage module
Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.
 Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.