sluis

package module
v1.76.10 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 15, 2026 License: MIT Imports: 1 Imported by: 0

README

sluis

sluis turns the proofs you already have into short-lived tokens under one policy file. audit keeps a tamper-evident record. One tag, one version.

CI Release

Deliverable Published at
sluis and audit images ghcr.io/truvity/sluis/*, ghcr.io/truvity/audit/*
Helm charts sluis, audit oci://ghcr.io/truvity/charts/sluis, oci://ghcr.io/truvity/charts/audit
sluisctl, audit CLI, Lambda zips the GitHub release
Go modules (root, storage, audit, Pulumi libraries) github.com/truvity/sluis[/<dir>], tagged with the release
@truvity/sluis, @truvity/audit, @truvity/audit-react GitHub Packages
GitHub Action truvity/sluis@<commit>

Who it is for

Platform teams that drive tokens, GitHub teams and Slack channels from one reviewed policy file. Applications that need an audit trail an auditor can verify.

The model

A policy file maps directory groups and machine identities to groups. sluis mints tokens and reconciles GitHub and Slack from it; audit records what it did. See concepts.

Install and a worked example

sluisctl render --installation installation.yaml --out rendered/
helm install sluis oci://ghcr.io/truvity/charts/sluis --version X.Y.Z --namespace sluis --create-namespace \
  --values values.yaml --set-file documents.service=rendered/sluis.yaml --set-file documents.policy=rendered/policy.yaml
Try it without a credential
cat > /tmp/demo.yaml <<'YAML'
demo: true
store: memory
allowInsecure: true
issuerURL: http://localhost:8099
publicURL: http://localhost:8099/console
listen: {address: ":8099"}
probes: {address: ":7099"}
YAML
go run ./cmd/sluis serve --config /tmp/demo.yaml

Open http://localhost:8099/console/ and choose Continue with the demonstration directory.

Consumers

Consumer Uses
Estates the Helm charts or the Pulumi libraries
Services the Go module or @truvity/sluis
CI jobs the GitHub Action and sluisctl
People sluisctl

Neighbours

Neighbour Role
OpenBao trusts sluis tokens and issues certificates; can be audit's key provider
Cloudflare fronts the Lambda shape; can hold audit's archive on R2

Documentation

Topic Where
The site https://truvity.github.io/sluis/
Tutorials sluis, audit
Every deliverable artifacts
Upgrades the CHANGELOG links an upgrade page from each breaking entry

The rule that makes this repository public

Mechanism only: no account, hostname or secret path of an installation. hack/leak-canary.sh enforces it.

Status

Used in production by its maintainers. audit may break in a minor, with a Breaking: entry. Report vulnerabilities as SECURITY.md says.

Development

Run devbox shell, then just check. See CONTRIBUTING.

Releasing

By hand, as a pushed tag vX.Y.Z. See CONTRIBUTING.

Licence

MIT, see LICENSE.

Documentation

Overview

Package sluis carries the files this repository publishes as data.

Index

Constants

This section is empty.

Variables

View Source 
var ConfigSchemas embed.FS

ConfigSchemas are the schemas of the configuration documents, under schemas/config/: the three service documents and the policy document. They are generated by `just config-schemas` from internal/config and committed, so that a deployment can validate its file without this repository's code, and so that the binary validates against the very file a chart's tests do. schemas/config/v1/ holds the v1 service documents' schemas, frozen: a v1 document is held to its own schema before it is converted.

Functions

This section is empty.

Types

This section is empty.

Source Files

View all Source files

Directories

Path Synopsis
audit module
deploy/pulumi module
sdk module
Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
 Package backend is the contract a directory backend implements: read-only access to one tenant's accounts, groups and domains, plus the credential handling that gets there.
fake
Package fake is a directory backend held in memory, with a scriptable failure for every operation.
 Package fake is a directory backend held in memory, with a scriptable failure for every operation.
google
Package google reads a Google Workspace through the Admin SDK.
 Package google reads a Google Workspace through the Admin SDK.
Package blobprefix names every key prefix that sluis reads or writes in the blob store on layout v5, and is the one place they are defined.
 Package blobprefix names every key prefix that sluis reads or writes in the blob store on layout v5, and is the one place they are defined.
cmd
acceptance command
Command acceptance exercises access-issuer against a real Kubernetes API server.
 Command acceptance exercises access-issuer against a real Kubernetes API server.
docsgen command
Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
 Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.
resource-proxy command
Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
 Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.
sluis command
Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
 Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.
sluis-backup command
Command sluis-backup is the backup module as an AWS Lambda function.
 Command sluis-backup is the backup module as an AWS Lambda function.
sluis-cloudflare command
Command sluis-cloudflare is the Cloudflare module as an AWS Lambda function: the STS minter and the credential rotation, answering other modules' calls.
 Command sluis-cloudflare is the Cloudflare module as an AWS Lambda function: the STS minter and the credential rotation, answering other modules' calls.
sluis-github command
Command sluis-github is the GitHub module's controller as an AWS Lambda function: the organisations' team passes and the links pass, on a schedule or when the console asks.
 Command sluis-github is the GitHub module's controller as an AWS Lambda function: the organisations' team passes and the links pass, on a schedule or when the console asks.
sluis-google command
Command sluis-google is the Google module as an AWS Lambda function: the directory refresh of the connected workspaces, on a schedule or for one workspace.
 Command sluis-google is the Google module as an AWS Lambda function: the directory refresh of the connected workspaces, on a schedule or for one workspace.
sluis-issuer command
Command sluis-issuer is the issuer module as an AWS Lambda function: the issuer, the signer and the console in one process, in one arm64 `bootstrap` binary (docs/decisions/0072).
 Command sluis-issuer is the issuer module as an AWS Lambda function: the issuer, the signer and the console in one process, in one arm64 `bootstrap` binary (docs/decisions/0072).
sluis-slack command
Command sluis-slack is the Slack module's controller as an AWS Lambda function: the workspaces' user-group passes, on a schedule or when the console asks.
 Command sluis-slack is the Slack module's controller as an AWS Lambda function: the workspaces' user-group passes, on a schedule or when the console asks.
sluisctl command
Command sluisctl is what a person on a laptop runs.
 Command sluisctl is what a person on a laptop runs.
Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
 Package config is sluis's configuration as a public, stable surface: the documents a process is started with, how to load and check them, and the installation document an estate writes once and renders them from.
deploy
spec
Package spec holds the names the deploy libraries give AWS resources and the checks of the values an installation hands them, without the Pulumi SDK.
 Package spec holds the names the deploy libraries give AWS resources and the checks of the values an installation hands them, without the Pulumi SDK.
pulumi module
pulumi/edge/cloudflare module
Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
 Package frontend embeds the built console, so that the hub is one binary with no static-file deployment beside it and the SPA is same-origin with the API it calls.
gen
accessissuer/v1
accessissuer/v1/accessissuerv1connect
Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
 Package accessissuer.v1 is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
directory/v1
directory/v1/directoryv1connect
Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
 Package directory.v1 is the directory contract: liveness and flat group membership for the corporate directories an installation owns.
directoryroster/v1
directoryroster/v1/directoryrosterv1connect
Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
 Package directoryroster.v1 is the operator contract of the hub: the workspaces it holds credentials for, its settings, and access to the hub itself.
sluis/v1
sluis/v1/sluisv1connect
SessionService (the issuer's part of package sluis.v1) is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
 SessionService (the issuer's part of package sluis.v1) is what the issuer answers ABOUT itself, as opposed to the OpenID surface it answers protocol on.
Package identity turns a token somebody else issued into the caller a listener acts on.
 Package identity turns a token somebody else issued into the caller a listener acts on.
resource
Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
 Package resource is the resource-server half of the Model Context Protocol's authorization spec, for one protected resource.
internal
access
Package access decides who is at the console and what they may do.
 Package access decides who is at the console and what they may do.
adaptercheck
Package adaptercheck is the half of a deploy's post-deploy check that the secrets check is not: it builds every adapter a module's function builds at start and in a tick, from the function's own document, and refuses with the setting that is missing.
 Package adaptercheck is the half of a deploy's post-deploy check that the secrets check is not: it builds every adapter a module's function builds at start and in a tick, from the function's own document, and refuses with the setting that is missing.
app
Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
 Package app assembles the directory hub from its configuration: the stores, the snapshot cache, the backends, the policy, the connectors, the recovery path and the three listeners.
audit
Package audit is what sluis tells the audit trail.
 Package audit is what sluis tells the audit trail.
audit/audittest
Package audittest is a recorder a test can read back.
 Package audittest is a recorder a test can read back.
awsretry
Package awsretry is the retryer of the SSM clients sluis reads its configuration and secrets with.
 Package awsretry is the retryer of the SSM clients sluis reads its configuration and secrets with.
backup
Package backup is the archive format of a sluis backup (format 2).
 Package backup is the archive format of a sluis backup (format 2).
backup/app
Package app assembles the backup module as a process of its own (docs/decisions/0071): the storage it reads an installation from, the archive bucket and the age recipients it writes to (or, in the restore role, the age identity it reads with), the audit trail, and the job that runs under the backup lease (internal/backup/job).
 Package app assembles the backup module as a process of its own (docs/decisions/0071): the storage it reads an installation from, the archive bucket and the age recipients it writes to (or, in the restore role, the age identity it reads with), the audit trail, and the job that runs under the backup lease (internal/backup/job).
backup/export
Package export reads an installation through the ports and writes it into a backup archive (backup.Writer).
 Package export reads an installation through the ports and writes it into a backup archive (backup.Writer).
backup/job
Package job runs the backup module's work: one backup under the backup lease, its status and retention records, the audit records, the listing of the archive and the prune.
 Package job runs the backup module's work: one backup under the backup lease, its status and retention records, the audit records, the listing of the archive and the prune.
backup/restore
Package restore writes a backup (backup.Reader, verified whole when it was opened) into an installation of layout v5, and shows beforehand what that would do.
 Package restore writes a backup (backup.Reader, verified whole when it was opened) into an installation of layout v5, and shows beforehand what that would do.
backup/restorejob
Package restorejob is the restore function's work: one restore at a time, asynchronous, with every module under maintenance while it writes (docs/decisions/0071 and 0072, point 9).
 Package restorejob is the restore function's work: one restore at a time, asynchronous, with every module under maintenance while it writes (docs/decisions/0071 and 0072, point 9).
backup/rpc
Package rpc is the backup module as another module sees it (docs/decisions/0071): the status of the backups, the list of what the archive holds, and a backup now, as methods of the `backup` module over internal/modcall.
 Package rpc is the backup module as another module sees it (docs/decisions/0071): the status of the backups, the list of what the archive holds, and a backup now, as methods of the `backup` module over internal/modcall.
clientcreds
Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`).
 Package clientcreds keeps the secrets of confidential OIDC clients the issuer generates itself (a policy client written `secret: {generate: true}`).
cloudflare
Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
 Package cloudflare is sluis as the STS for Cloudflare: short-lived account API tokens and R2 credentials handed out on proof of identity, because Cloudflare has no web-identity federation of its own.
cloudflare/app
Package app assembles the Cloudflare module as a process of its own (docs/decisions/0071): the minter of ADR 0070 and its scheduled rotation, with the secrets store, the leases and the audit trail they need, and nothing of the issuer, the directory hub or another provider.
 Package app assembles the Cloudflare module as a process of its own (docs/decisions/0071): the minter of ADR 0070 and its scheduled rotation, with the secrets store, the leases and the audit trail they need, and nothing of the issuer, the directory hub or another provider.
cloudflare/cfapi
Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
 Package cfapi is the real client of Cloudflare's API for the minter: an account reached with a token, over plain net/http against https://api.cloudflare.com/client/v4.
cloudflare/minter
Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
 Package minter does what sluis does as the STS for Cloudflare: clone a preset's prototype into a short-lived account token, keep the stored one fresh on a schedule, sweep its own expired tokens, and mint on demand for a granted caller.
cloudflare/rpc
Package rpc is the Cloudflare minter as another module sees it (docs/decisions/0071 D93 a): the on-demand mint and the grants listing, as methods of the `cloudflare` module over internal/modcall.
 Package rpc is the Cloudflare minter as another module sees it (docs/decisions/0071 D93 a): the on-demand mint and the grants listing, as methods of the `cloudflare` module over internal/modcall.
config
Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
 Package config is what each process of this repository is configured with: four documents, each read from one file and validated against a JSON Schema before anything starts.
config/duration
Package duration is the time span a configuration document spells as a Go duration string.
 Package duration is the time span a configuration document spells as a Go duration string.
config/gen command
Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
 Command gen writes the configuration schemas into schemas/config/, and embeds them in the chart's values schema.
config/schema
Package schema builds the JSON Schema of each binary's configuration file.
 Package schema builds the JSON Schema of each binary's configuration file.
connectalias
Package connectalias serves one Connect service under a second name.
 Package connectalias serves one Connect service under a second name.
connector
Package connector turns a directory's own sign-in screen into a workspace the hub can read.
 Package connector turns a directory's own sign-in screen into a workspace the hub can read.
consoleauth
Package consoleauth is how a controller proves itself to the console.
 Package consoleauth is how a controller proves itself to the console.
consoleauthz
Package consoleauthz is the console's authorization rules for a module that runs a console operation on the caller snapshot (consolecall.Caller).
 Package consoleauthz is the console's authorization rules for a module that runs a console operation on the caller snapshot (consolecall.Caller).
consolecall
Package consolecall is the plumbing for the console's provider operations once they live in the provider's module (docs/decisions/0071, v1.76 D-v176-1 b): the console authenticates a person, snapshots who they are, and asks the module to do the work as that snapshot.
 Package consolecall is the plumbing for the console's provider operations once they live in the provider's module (docs/decisions/0071, v1.76 D-v176-1 b): the console authenticates a person, snapshots who they are, and asks the module to do the work as that snapshot.
demo
Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
 Package demo builds the demonstration tenants the prototype runs on: fixture accounts and groups held in memory, no credential and no network, so that every use-case can be walked through before a real directory is connected.
deploycheck
Package deploycheck verifies, at deploy time, that every secret a service document and its policy declare is in the installation's SSM, so that a missing or mistyped one is found by the deploy and not by the first person to sign in (secrets are read when first used, not at start).
 Package deploycheck verifies, at deploy time, that every secret a service document and its policy declare is in the installation's SSM, so that a missing or mistyped one is found by the deploy and not by the first person to sign in (secrets are read when first used, not at start).
docsgen
Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
 Package docsgen writes the generated regions of the documentation from the files that are the source of truth: the JSON schemas, the audit catalogue, the chart's golden alert render and the ADRs.
emailaddr
Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
 Package emailaddr splits addresses the way the hub routes them: by the domain after the last '@', lower-cased.
githubapp
Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
 Package githubapp is the part of GitHub's App API that connecting an organisation needs — creating an App from a manifest, finding where it is installed, and uninstalling it — and the part linking a person's GitHub account needs: authorizing the link App as themselves, and reading back who they are and which addresses GitHub verified for them.
githubapp/catalogue
Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
 Package catalogue is GitHub Apps declared as data: what each App is called, which organisation owns it, what it may do, and — for a later exchange that mints installation tokens — which groups may ask for how much of it.
githubapp/console
Package console is the GitHub module's half of the console: the handlers for connecting an organisation, the Apps view, the catalogue and runner Apps, the link App and people's links, moved out of the shared console so that the process which serves the console holds no App private key, no webhook secret and no connection record (docs/decisions/0071, v1.76 D-v176-1 b).
 Package console is the GitHub module's half of the console: the handlers for connecting an organisation, the Apps view, the catalogue and runner Apps, the link App and people's links, moved out of the shared console so that the process which serves the console holds no App private key, no webhook secret and no connection record (docs/decisions/0071, v1.76 D-v176-1 b).
githubapp/githubfake
Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
 Package githubfake is one GitHub organisation, in memory, answering the calls the controller makes and changing as they change it.
githubapp/githubtokens
Package githubtokens is how another module asks the GitHub module for an installation token (docs/decisions/0071): a Minter port, the in-process implementation that holds the App's key and talks to GitHub, and the modcall pair (Register, Client) that carries the same call as the `github` module's `mint_installation` method.
 Package githubtokens is how another module asks the GitHub module for an installation token (docs/decisions/0071): a Minter port, the in-process implementation that holds the App's key and talks to GitHub, and the modcall pair (Register, Client) that carries the same call as the `github` module's `mint_installation` method.
githubapp/mints
Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
 Package mints keeps the last installation tokens asked of each GitHub App, so that an App's page can show them.
githubroster/app
Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
 Package app assembles the GitHub controller from its configuration: the policy's GitHub table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials mounted beside it.
githubroster/appid
Package appid is what the three sorts of GitHub App share: one id space.
 Package appid is what the three sorts of GitHub App share: one id space.
githubroster/catalogueapp
Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
 Package catalogueapp is what creating a catalogue App leaves behind: the App's record, and its key.
githubroster/connection
Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a GitHub organisation leaves behind, shared by the service that writes it and the controller that reads it.
githubroster/consolewire
Package consolewire is what the console and the GitHub module agree on for the operations that moved into the module (v1.76 D-v176-1 b): the method names, and the values the protobuf contract has no room for, such as a flow's hand-over of a one-time code.
 Package consolewire is what the console and the GitHub module agree on for the operations that moved into the module (v1.76 D-v176-1 b): the method names, and the values the protobuf contract has no room for, such as a flow's hand-over of a one-time code.
githubroster/controller
Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
 Package controller is the GitHub controller's loop: every pass, for every organisation the policy binds, read what GitHub holds and who holds the bound groups, decide, act where the organisation is enabled, and report.
githubroster/link
Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
 Package link is what a person linking their GitHub account leaves behind, shared by the service that writes a link and the controller that keeps checking it.
githubroster/reconcile
Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
 Package reconcile is what the GitHub controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what GitHub holds, what one organisation should look like and what to change to get there.
githubroster/runnerapp
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
 Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
githubroster/status
Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
 Package status is the contract between the GitHub controller and the console: what the controller last did to each organisation, and why, written where the console can read it.
googleapp/console
Package console is the Google module's half of the console: the Workspace service (the directories an operator connects), the consent and the key upload that connect one, and the sign-in's Identify.
 Package console is the Google module's half of the console: the Workspace service (the directories an operator connects), the consent and the key upload that connect one, and the sign-in's Identify.
googleroster/app
Package app assembles the Google module from its own document (apiVersion sluis-google/v1): the hub's refresh writer.
 Package app assembles the Google module from its own document (apiVersion sluis-google/v1): the hub's refresh writer.
health
Package health serves the two probes, and keeps them different.
 Package health serves the two probes, and keeps them different.
hub
Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
 Package hub is the directory hub: the workspaces it holds credentials for, the snapshots it keeps of them, the routing from an email address to the workspace that serves it, and the freshness policy that decides whether a read is answered from a snapshot or from the backend.
hublocal
Package hublocal asks the directory about a person by CALLING it.
 Package hublocal asks the directory about a person by CALLING it.
hubwire
Package hubwire is the wiring a hub needs for the workspaces a deployment declares and the ones a console connected: bring the declared ones up with their key read lazily, and reopen the stored ones.
 Package hubwire is the wiring a hub needs for the workspaces a deployment declares and the ones a console connected: bring the declared ones up with their key read lazily, and reopen the stored ones.
issuer
Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
 Package issuer is the token service: it verifies proofs produced elsewhere, applies the shared policy, and issues tokens.
issuerapp
Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
 Package issuerapp assembles the token service from its configuration: the policy, the door to the hub, the signing key, the verifiers that turn somebody else's token into a proof, and the OpenID surface over all of it.
kube
Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
 Package kube keeps what a console changes in the hub's own namespace, as plain Kubernetes objects.
lambdaapp
Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/sluis/lambda.md).
 Package lambdaapp runs sluis as ONE AWS Lambda function: one binary, one zip, one function (docs/reference/sluis/lambda.md).
lambdaapp/backupfn
Package backupfn is the backup module's Lambda function, and the restore function of the same zip (`backup.role: restore`).
 Package backupfn is the backup module's Lambda function, and the restore function of the same zip (`backup.role: restore`).
lambdaapp/cloudflarefn
Package cloudflarefn is the Cloudflare module's Lambda function: it answers other modules' calls and has no HTTP surface.
 Package cloudflarefn is the Cloudflare module's Lambda function: it answers other modules' calls and has no HTTP surface.
lambdaapp/githubfn
Package githubfn is the GitHub module's function: the organisations' team passes and the links pass, on a schedule (`tick`) or when the console asks (`run`), and the installation-token mint, the `github` module's `mint_installation` method, which the issuer calls over modcall through its `live-issuer` alias and no other class may (D-v176-7 a: one function serves both, with the concurrency limit and the mint deadline of the one).
 Package githubfn is the GitHub module's function: the organisations' team passes and the links pass, on a schedule (`tick`) or when the console asks (`run`), and the installation-token mint, the `github` module's `mint_installation` method, which the issuer calls over modcall through its `live-issuer` alias and no other class may (D-v176-7 a: one function serves both, with the concurrency limit and the mint deadline of the one).
lambdaapp/googlefn
Package googlefn is the Google module's function: the directory refresh, on a schedule ({"kind":"refresh"}, every workspace) or for one workspace ({"kind":"refresh","workspace":"<id>"}), the check of its own secrets, and the module's calls: the console's Workspace service (`console.*`, caller class `console`) and the sign-in (`identify`, `sign_in_url`, caller class `issuer`).
 Package googlefn is the Google module's function: the directory refresh, on a schedule ({"kind":"refresh"}, every workspace) or for one workspace ({"kind":"refresh","workspace":"<id>"}), the check of its own secrets, and the module's calls: the console's Workspace service (`console.*`, caller class `console`) and the sign-in (`identify`, `sign_in_url`, caller class `issuer`).
lambdaapp/issuerfn
Package issuerfn is the issuer module's Lambda function: the issuer, the signer and the console in one process (docs/decisions/0072), assembled from the same pieces the Kubernetes process is.
 Package issuerfn is the issuer module's Lambda function: the issuer, the signer and the console in one process (docs/decisions/0072), assembled from the same pieces the Kubernetes process is.
lambdaapp/lambdatest
Package lambdatest is a container-free end-to-end harness for the Lambda functions: an httptest server that speaks the Lambda Invoke API and routes FunctionName plus Qualifier to in-process lambdaapp.Function handlers.
 Package lambdatest is a container-free end-to-end harness for the Lambda functions: an httptest server that speaks the Lambda Invoke API and routes FunctionName plus Qualifier to in-process lambdaapp.Function handlers.
lambdaapp/slackfn
Package slackfn is the Slack module's controller function: the workspaces' user-group passes, on a schedule (`tick`) or when the console asks (`run`).
 Package slackfn is the Slack module's controller function: the workspaces' user-group passes, on a schedule (`tick`) or when the console asks (`run`).
lazy
Package lazy holds a value that is read on its first use and read again when it is older than its time to live.
 Package lazy holds a value that is read on its first use and read again when it is older than its time to live.
maintenance
Package maintenance is the flag that says a module is being restored, and the gate every module reads before it writes (docs/decisions/0072, decision 9).
 Package maintenance is the flag that says a module is being restored, and the gate every module reads before it writes (docs/decisions/0072, decision 9).
memo
Package memo remembers the outcome of a pure, expensive check by a hash of its input.
 Package memo remembers the outcome of a pure, expensive check by a hash of its input.
migrate
Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
 Package migrate copies the service's State from any adapter to any other through the ports and the domain stores (ADR 0031), and is the whole of `sluis migrate`.
modcall
Package modcall is how one module calls another (docs/decisions/0071 D93 a): a typed request and response over one of three transports, behind one Go interface chosen by configuration.
 Package modcall is how one module calls another (docs/decisions/0071 D93 a): a typed request and response over one of three transports, behind one Go interface chosen by configuration.
modcall/dial
Package dial is how a process turns the routing its document names into a modcall.Caller: Dial builds the modcall.Router for a modcall.Config, with the Lambda transport only in a build with the `lambda` tag, so that the Kubernetes build carries no Lambda client.
 Package dial is how a process turns the routing its document names into a modcall.Caller: Dial builds the modcall.Router for a modcall.Config, with the Lambda transport only in a build with the `lambda` tag, so that the Kubernetes build carries no Lambda client.
modcall/lambdacall
Package lambdacall is the Lambda transport of internal/modcall: a call is a synchronous lambda:InvokeFunction of the callee's `live-<class>` alias for the caller class with the JSON envelope as payload, and a function answers one with Serve.
 Package lambdacall is the Lambda transport of internal/modcall: a call is a synchronous lambda:InvokeFunction of the callee's `live-<class>` alias for the caller class with the JSON envelope as payload, and a function answers one with Serve.
modserve
Package modserve is the listener a GitHub or Slack module answers the issuer on, on Kubernetes (docs/decisions/0071): `POST /rpc` with a projected ServiceAccount token that a TokenReview accepts for the module's audience and that belongs to the issuer's ServiceAccount.
 Package modserve is the listener a GitHub or Slack module answers the issuer on, on Kubernetes (docs/decisions/0071): `POST /rpc` with a projected ServiceAccount token that a TokenReview accepts for the module's audience and that belongs to the issuer's ServiceAccount.
module
Package module is the contract of a role of the service: the one thing `sluis <module>` starts (docs/decisions/0071).
 Package module is the contract of a role of the service: the one thing `sluis <module>` starts (docs/decisions/0071).
module/backup
Package backup is the backup role: a scheduled export of the installation into an encrypted archive (docs/decisions/0071, decision 9), as a process of its own.
 Package backup is the backup role: a scheduled export of the installation into an encrypted archive (docs/decisions/0071, decision 9), as a process of its own.
module/cloudflare
Package cloudflare is the Cloudflare role: the STS minter's scheduled rotation (docs/decisions/0070), as a process of its own.
 Package cloudflare is the Cloudflare role: the STS minter's scheduled rotation (docs/decisions/0070), as a process of its own.
module/github
Package github is the GitHub role: the GitHub controller's loop, as a process of its own.
 Package github is the GitHub role: the GitHub controller's loop, as a process of its own.
module/google
Package google is the Google role: the hub's refresh writer, as a process of its own.
 Package google is the Google role: the hub's refresh writer, as a process of its own.
module/issuer
Package issuer is the issuer module (docs/decisions/0072): the issuer, the signer (internal/signer, in this process; no separate signer binary exists) and the console in one process.
 Package issuer is the issuer module (docs/decisions/0072): the issuer, the signer (internal/signer, in this process; no separate signer binary exists) and the console in one process.
module/slack
Package slack is the Slack role: the Slack controller's loop, as a process of its own.
 Package slack is the Slack role: the Slack controller's loop, as a process of its own.
port
Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/concepts/sluis/ports.md, and nothing else.
 Package port is the storage, signalling and identity edge of the service: small interfaces with the semantics in docs/concepts/sluis/ports.md, and nothing else.
port/dynamodb
Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/concepts/sluis/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
 Package dynamodb is the DynamoDB adapter of the State, Index and Trigger ports (docs/concepts/sluis/ports.md, ADR 0027): one table, shared by every replica and every process, so a lease is exclusive across pods and a notification crosses processes.
port/invoke
Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","controller":"<kind>","target":"<id>"} (docs/reference/sluis/lambda.md).
 Package invoke is the Trigger of a deployment that runs as AWS Lambda functions: "this target has work" is an asynchronous invoke of the function that runs the target's pass, with the payload {"kind":"run","controller":"<kind>","target":"<id>"} (docs/reference/sluis/lambda.md).
port/legacy
Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
 Package legacy is the TEMPORARY adapter that implements the ports by wrapping today's storage exactly: the Kubernetes ConfigMaps and Secrets of internal/kube and the Valkey of internal/valkey.
port/matrixdoc
Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/sluis/adapters.md, from the adapter registry and the preset table.
 Package matrixdoc renders the adapter compatibility and implementation matrix, docs/reference/sluis/adapters.md, from the adapter registry and the preset table.
port/matrixdoc/gen command
Command gen writes docs/reference/sluis/adapters.md.
 Command gen writes docs/reference/sluis/adapters.md.
port/memory
Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/concepts/sluis/ports.md and nothing more.
 Package memory is the in-memory adapter: every port, in process memory, with the semantics of docs/concepts/sluis/ports.md and nothing more.
port/observe
Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
 Package observe wraps the storage ports so that each call is timed, counted by how it ended, and traced.
port/openbao
Package openbao is the secrets adapter over an OpenBao (or Vault) KV version 2 mount, written with the HTTP API and nothing else (see Secrets).
 Package openbao is the secrets adapter over an OpenBao (or Vault) KV version 2 mount, written with the HTTP API and nothing else (see Secrets).
port/porttest
Package porttest is the conformance suite of docs/concepts/sluis/ports.md.
 Package porttest is the conformance suite of docs/concepts/sluis/ports.md.
port/porttest/grantcost
Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it.
 Package grantcost measures what one token grant costs the storage ports -- the State and Index calls, the directory snapshot reads, and the times the hub is asked about a person -- through the real issuer behind its real HTTP surface, over whichever adapter a test hands it.
port/s3blob
Package s3blob is the S3 adapter of port.Blob (docs/concepts/sluis/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
 Package s3blob is the S3 adapter of port.Blob (docs/concepts/sluis/ports.md, "Blob"): whole objects under one bucket and one key prefix, for the status reports and the directory snapshots.
port/ssm
Package ssm registers the `ssm` Secrets adapter: the installation's secrets in AWS Systems Manager Parameter Store, in layout v4 (docs/decisions/0041-the-secret-contract.md).
 Package ssm registers the `ssm` Secrets adapter: the installation's secrets in AWS Systems Manager Parameter Store, in layout v4 (docs/decisions/0041-the-secret-contract.md).
portstore
Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
 Package portstore keeps the domain stores (workspaces and their credentials, GitHub organisations and their Apps, a person's GitHub link, the Slack records) on the ports of internal/port: State for the records and Secrets for every credential.
portstore/portstoretest
Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
 Package portstoretest is the harness every test of a domain store on the ports runs over: State and Secrets in memory, with a way to open another "process" onto the same State and Secrets.
rails
Package rails is what reconcilers share.
 Package rails is what reconcilers share.
refusal
Package refusal is how this service says no.
 Package refusal is how this service says no.
rekey
Package rekey is `sluis secrets rekey`: it re-writes the SecureString parameters below an installation's secrets root under the KMS key the document names (`secrets.kmsKeyId`), so that every parameter of the installation is encrypted with one estate key.
 Package rekey is `sluis secrets rekey`: it re-writes the SecureString parameters below an installation's secrets root under the KMS key the document names (`secrets.kmsKeyId`), so that every parameter of the installation is encrypted with one estate key.
resourceproxy
Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
 Package resourceproxy is the machinery of cmd/resource-proxy: a sidecar that puts a sluis resource server's front door on a stock MCP server (or any HTTP service) that knows nothing about sluis.
rosterapp
Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
 Package rosterapp assembles the whole of sluis as ONE process: the directory connectors, the snapshot and its refresher, the policy, the OpenID provider, the login page and the console and, when the service document names them (`controllers`), the GitHub and Slack controllers, which run their loops beside them and answer to the same probes.
secrets
Package secrets resolves the secrets a service document declares, by name.
 Package secrets resolves the secrets a service document declares, by name.
secretstore
Package secretstore is sluis's view of its secrets on a state.Store under layout v4 (docs/decisions/0041-the-secret-contract.md).
 Package secretstore is sluis's view of its secrets on a state.Store under layout v4 (docs/decisions/0041-the-secret-contract.md).
secretstore/secretrec
Package secretrec is a state.Store that records the full address of every read and write, for the tests that pin which path a caller uses on a secrets layout.
 Package secretrec is a state.Store that records the full address of every read and write, for the tests that pin which path a caller uses on a secrets layout.
server
Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
 Package server maps the hub onto its two listeners: DirectoryService for consumers on the API port, and the operator services plus the console on the console port.
settings
Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
 Package settings keeps the two things an operator can change from the console: the OAuth client used for admin consent and for sign-in, and the memberships added there.
signer
Package signer is the only place a signing key is used or opened (docs/decisions/0071).
 Package signer is the only place a signing key is used or opened (docs/decisions/0071).
slackapp
Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
 Package slackapp is the part of Slack's Web API the Slack controller needs to make a workspace's channels match who is entitled to be in them — and the part the console needs to connect a workspace in the first place.
slackapp/catalogue
Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
 Package catalogue is Slack Apps declared as data: which workspace each belongs to, what it is called and which bot scopes it asks for.
slackapp/catalogueapp
Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
 Package catalogueapp is what creating a catalogue Slack App leaves behind: the App's record, its client credentials and, once installed, its bot token.
slackapp/console
Package console is the Slack module's half of the console: what an operator does to Slack through the console (connecting a workspace, creating and installing Apps, defining channels and Slack Connect channels) runs here, on the module's own records and credentials, as the caller the console authorized (docs/decisions/0071, v1.76 D-v176-1 b).
 Package console is the Slack module's half of the console: what an operator does to Slack through the console (connecting a workspace, creating and installing Apps, defining channels and Slack Connect channels) runs here, on the module's own records and credentials, as the caller the console authorized (docs/decisions/0071, v1.76 D-v176-1 b).
slackapp/slackfake
Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
 Package slackfake is Slack, in memory: several workspaces behind one server, answering the calls the Slack controller makes and changing as they change it.
slackroster/app
Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
 Package app assembles the Slack controller from its configuration: the policy's slack table, the console it reads with its own ServiceAccount token, the report it writes, and the credentials and records mounted beside it.
slackroster/apply
Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
 Package apply is the part of the Slack reconciler that touches Slack: it reads a workspace whole (Observe) and carries out what reconcile.Decision decided (Apply).
slackroster/connection
Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
 Package connection is what connecting a Slack workspace leaves behind, shared by the service that writes it and the controller that reads it.
slackroster/controller
Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
 Package controller is the Slack controller: for every workspace the policy declares, read what Slack holds and who holds the groups the channels are bound to, decide, act where the workspace is enabled, and report.
slackroster/reconcile
Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
 Package reconcile is what the Slack controller decides, with no network in it: from the policy's bindings, the holders of the groups they name, and what one workspace holds, what its channels should contain and what to change to get there.
slackroster/status
Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
 Package status is the contract between the Slack controller and the console: what the controller last did to each workspace, and why, written where the console can read it.
store
Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
 Package store builds the storage ports once, from configuration, for the apps to be handed: the one place that knows which adapter backs them.
telemetry
Package telemetry is the OpenTelemetry metrics both processes publish.
 Package telemetry is the OpenTelemetry metrics both processes publish.
testissuer
Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
 Package testissuer is an OpenID provider just real enough to verify a token against: a discovery document, a key set, and a signer.
valkey
Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
 Package valkey is the Valkey driver of the legacy adapter (internal/port/legacy): the connection, its failover handling, and the one State that the issuer's logins in progress, the hub's snapshots and the refresh leases are all kept in.
verify
Package verify turns a token somebody else issued into a proof this installation will act on.
 Package verify turns a token somebody else issued into a proof this installation will act on.
version
Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
 Package version carries the build's identity, so that an operator looking at a console can say which build they are looking at without asking a cluster.
Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
 Package policy is the schema both services load: seven tables that answer four questions and no others — who is in which internal group, what a group adds to a token, how long a token lives, and which client may be issued one — plus one OPTIONAL eighth, Vocabulary, that answers none of the four itself and instead constrains what a name used to answer them is allowed to mean.
compile
Package compile derives the policy's tables from an access model: who holds which internal group, for how long, and which directory groups, CI jobs and workloads admit a caller to it.
 Package compile derives the policy's tables from an access model: who holds which internal group, for how long, and which directory groups, CI jobs and workloads admit a caller to it.
storage module
Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.
 Package tokens trades one token for another, and writes the two shapes a credential helper has to speak.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.