Documentation
¶
Overview ¶
Package googlefn is the Google module's function: the directory refresh, on a schedule ({"kind":"refresh"}, every workspace) or for one workspace ({"kind":"refresh","workspace":"<id>"}), the check of its own secrets, and the module's calls: the console's Workspace service (`console.*`, caller class `console`) and the sign-in (`identify`, `sign_in_url`, caller class `issuer`). It has no HTTP surface. The issuer reads the snapshot the refresh writes (D-v176-6 a) and calls the module for everything else.
The sign-in is a call to this function on every login. It has no provisioned concurrency (D-v176-11 a), so the first sign-in after the function has been idle pays its cold start: the function opens its storage, its secrets and every workspace's reader before it answers. That cost is accepted and documented (docs/reference/lambda.md); the issuer shows a clear page when the call does not finish. It registers itself with internal/lambdaapp; cmd/sluis-google and the lambda build of cmd/sluis import it.
Index ¶
- Variables
- func Check(doc *config.SluisGoogle) func(context.Context) (deploycheck.Report, error)
- func CheckFile(file string) func(context.Context) (deploycheck.Report, error)
- func Handler(log *slog.Logger, ...) *lambdaapp.HTTP
- func Refresh(ctx context.Context, p Puller, workspace string) (lambdaapp.RefreshResult, error)
- func Server(log *slog.Logger, open func(context.Context) (*googleconsole.Service, error)) *modcall.Server
- func WithCalls(h *lambdaapp.HTTP, s *modcall.Server) *lambdaapp.HTTP
- type Puller
Constants ¶
This section is empty.
Variables ¶
var Kinds = []string{config.SecretWorkspaceKey, config.SecretSignInClientID, config.SecretSignInClientSecret}
Kinds are the kinds of secret the module's check reads: the workspaces' keys and the OAuth client that reopens a workspace connected by consent. The issuer's keys, the sign-in client of the issuer's own document and the policy's client secrets are not the module's, and its check does not report them.
Functions ¶
func Check ¶
func Check(doc *config.SluisGoogle) func(context.Context) (deploycheck.Report, error)
Check is the {"kind":"check"} answer for the document: the secrets it declares the module reads, of the module's own kinds, read from SSM.
func CheckFile ¶
CheckFile is the {"kind":"check"} answer of the function whose document is in file: the adapters the function builds at start and in a refresh tick (State, the blobs, the secrets, the audit sink), built from the document and refused with the setting that is missing; then the secrets it declares. Nothing it reaches mutates. The document is read again when asked, which is once per deploy.
func Handler ¶
func Handler(log *slog.Logger, refresh func(ctx context.Context, workspace string) (lambdaapp.RefreshResult, error), check func(context.Context) (deploycheck.Report, error)) *lambdaapp.HTTP
Handler is the function's entry: refresh events, of every workspace (workspace is empty) or of one, and the {"kind":"check"} answer. It answers no tick, no run, no module call and no HTTP request.
func Refresh ¶
Refresh runs one refresh over every workspace (workspace is empty) or the one named. The leases are in the module's table, shared by every invocation, so the pass needs no opt-in for a lease held in the process's own memory.
Source Files