Documentation
¶
Overview ¶
Package auth issues and verifies caller API tokens without storing secrets.
Index ¶
- Variables
- type Authenticator
- type IssuedToken
- type PreparedToken
- type Principal
- type PrincipalType
- type Service
- func (service *Service) Activate(ctx context.Context, prepared PreparedToken) error
- func (service *Service) Authenticate(ctx context.Context, secret string) (Principal, error)
- func (service *Service) AuthenticateRequest(request *http.Request) (Principal, error)
- func (service *Service) Issue(ctx context.Context, principalType PrincipalType, subjectID string) (IssuedToken, error)
- func (service *Service) Revoke(ctx context.Context, keyID string) error
Constants ¶
This section is empty.
Variables ¶
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type IssuedToken ¶
type PreparedToken ¶
type PreparedToken struct {
KeyID string
Secret string
PrincipalType PrincipalType
SubjectID string
}
func Prepare ¶
func Prepare(principalType PrincipalType, subjectID string) (PreparedToken, error)
Prepare creates a credential without making it authenticatable. Callers can durably persist the returned secret before Activate commits its hash. This split is what makes external credential rotation recoverable across a crash.
type Principal ¶
type Principal struct {
Type PrincipalType
SubjectID string
KeyID string
}
type PrincipalType ¶
type PrincipalType string
const ( PrincipalCaller PrincipalType = "caller" PrincipalWorker PrincipalType = "worker" )
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService(store storeapi.TokenStore) *Service
func (*Service) Activate ¶
func (service *Service) Activate(ctx context.Context, prepared PreparedToken) error
Activate commits a prepared credential. It is idempotent for the exact same key, secret, type, and subject so a journal can safely replay after a crash.
func (*Service) Authenticate ¶
func (*Service) AuthenticateRequest ¶
AuthenticateRequest accepts the current model-provider authentication headers. Bearer is used by OpenAI-compatible clients; Anthropic-compatible clients use X-Api-Key. Any other Authorization scheme is rejected rather than being ambiguously combined with X-Api-Key.
func (*Service) Issue ¶
func (service *Service) Issue(ctx context.Context, principalType PrincipalType, subjectID string) (IssuedToken, error)
Source Files