auth

package
v3.83.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: AGPL-3.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// CommunityOrgID is the organization UUID for unauthenticated community access.
	CommunityOrgID = "3674ddf9-67cc-4a2d-9b16-a591f6d4412d" // nosec G101 — intentional community access; not a secret

	// CommunityAPIKey is the API key for unauthenticated community access.
	CommunityAPIKey = "6e40f1c324576b65f85dc3c9ff93d31eb65298836b46b540fa18825b47174ce8" // nosec G101 — intentional community access; not a secret
)
View Source 
const CredentialsDirEnv = "VULNETIX_CREDENTIALS_DIR"

CredentialsDirEnv overrides the default home credential directory (~/.vulnetix). Project credentials are unaffected.

View Source 
const KeychainSetupURL = "https://vulnetix.com/docs/cli/keychain"

KeychainSetupURL points users at documentation for enabling an OS keychain / Secret Service backend when none is detected.

View Source 
const PackageFirewallHost = "packages.vulnetix.com"

Variables

This section is empty.

Functions

func AllSourceStatus 

func AllSourceStatus() []string

AllSourceStatus returns a compact summary of every credential source and whether it is set / found. Useful for diagnostics.

func CredentialSource 

func CredentialSource() string

CredentialSource returns the name of the credential source that would win in the LoadCredentials precedence chain, or "none" if nothing is configured.

func GetAuthHeader 

func GetAuthHeader(creds *Credentials) string

GetAuthHeader returns the Authorization header value for the given credentials

func IsCommunity 

func IsCommunity(creds *Credentials) bool

IsCommunity returns true when the given credentials match the embedded community fallback.

func KeyringAvailable added in v3.52.0 

func KeyringAvailable() error

KeyringAvailable reports whether a usable OS keychain backend is present. It returns nil when the keychain can be used, or a descriptive error (with OS-specific guidance and KeychainSetupURL) when it cannot — so callers can fall back to file storage and give the user actionable feedback.

Detection: a Get on a non-existent probe account returns keyring.ErrNotFound when a backend is present (Windows/macOS always; Linux with a running Secret Service). Any other error means no usable backend for this GOOS.

func NetrcPath added in v3.15.1 

func NetrcPath() (string, error)

NetrcPath returns the platform-specific netrc path used by Go and curl-like tools.

func RemoveCredentials 

func RemoveCredentials() error

RemoveCredentials removes stored credentials from all file-based stores and clears any HMAC secret held in the OS keychain.

func SaveCredentials 

func SaveCredentials(creds *Credentials, store CredentialStore) error

SaveCredentials persists credentials to the specified store.

When creds.HMACInKeyring is set, the HMAC Secret is written to the OS keychain (not the file) and stripped from the on-disk JSON; metadata (org, method, token, apikey) is still written to the home/project file. A keychain failure is returned so the caller can fall back to file storage.

func SaveCredentialsInDir added in v3.54.0 

func SaveCredentialsInDir(creds *Credentials, store CredentialStore, baseDir string) error

SaveCredentialsInDir persists credentials using baseDir for home/keyring metadata when provided.

func StripOrgPrefix added in v3.56.2 

func StripOrgPrefix(org, value string) string

StripOrgPrefix removes a leading "<org>:" from an ApiKey value.

The account GUI presents the ApiKey as "<orgId>:<hex>", and users paste that whole string. GetAuthHeader prepends the org itself, so an unstripped value would be sent as "ApiKey <org>:<org>:<hex>" and rejected with HTTP 401. `auth login` has always stripped it; the environment-variable and netrc paths did not, so a pasted GUI key worked interactively and failed in CI.

Types

type AuthMethod 

type AuthMethod string

AuthMethod represents the authentication method to use 

const (
	// DirectAPIKey uses a pre-computed API key hex digest sent as ApiKey header
	DirectAPIKey AuthMethod = "apikey"
	// SigV4 uses AWS Signature Version 4 for token exchange
	SigV4 AuthMethod = "sigv4"
	// Token uses an Authentik API token ("Tokens and App passwords") sent as a
	// Bearer header. This is the current, self-service credential; apikey/sigv4
	// are legacy.
	Token AuthMethod = "token"
)

func ValidateMethod 

func ValidateMethod(method string) (AuthMethod, error)

ValidateMethod checks if the given string is a valid AuthMethod

type CredentialStore 

type CredentialStore string

CredentialStore represents where credentials are persisted 

const (
	StoreHome    CredentialStore = "home"    // ~/.vulnetix/credentials.json
	StoreProject CredentialStore = "project" // .vulnetix/credentials.json
	StoreKeyring CredentialStore = "keyring" // system keyring (stub)
)

func ValidateStore 

func ValidateStore(store string) (CredentialStore, error)

ValidateStore checks if the given string is a valid CredentialStore

type Credentials 

type Credentials struct {
	OrgID  string     `json:"org_id"`
	APIKey string     `json:"api_key,omitempty"` // hex digest for Direct API Key
	Secret string     `json:"secret,omitempty"`  // secret key for SigV4 (Authentik-sourced HMAC secret)
	Token  string     `json:"token,omitempty"`   // Authentik API token (Bearer)
	Method AuthMethod `json:"method"`

	// HMACInKeyring is true when the SigV4/HMAC Secret is stored in the OS
	// keychain rather than inline in this credentials file. When set, Secret is
	// empty on disk and hydrated from the keychain at load time.
	HMACInKeyring bool `json:"hmac_in_keyring,omitempty"`

	// TokenInKeyring and APIKeyInKeyring mirror HMACInKeyring for Bearer and
	// legacy ApiKey credentials. The credential file keeps only metadata.
	TokenInKeyring  bool `json:"token_in_keyring,omitempty"`
	APIKeyInKeyring bool `json:"api_key_in_keyring,omitempty"`
}

Credentials holds authentication credentials for the Vulnetix API

func CommunityCredentials 

func CommunityCredentials() *Credentials

CommunityCredentials returns a Credentials struct for the embedded community fallback. The returned credentials use DirectAPIKey auth and go through the exact same auth pipeline as any registered user.

func CredentialStatus 

func CredentialStatus() (string, *Credentials)

CredentialStatus returns a human-readable description of the current auth state

func LoadCredentials 

func LoadCredentials() (*Credentials, error)

LoadCredentials loads credentials using the following precedence:

  1. Authentik API token (VULNETIX_API_TOKEN env; org resolved server-side)
  2. Direct API Key env vars (VULNETIX_API_KEY + VULNETIX_ORG_ID)
  3. SigV4 env vars (VVD_ORG + VVD_SECRET)
  4. Project dotfile (.vulnetix/credentials.json)
  5. Home directory (~/.vulnetix/credentials.json)
  6. Package Firewall netrc entry (packages.vulnetix.com)

func LoadNetrcCredentials added in v3.15.1 

func LoadNetrcCredentials() (*Credentials, error)

LoadNetrcCredentials loads Package Firewall credentials from netrc as Direct API Key auth.

type NetrcInfo added in v3.15.1 

type NetrcInfo struct {
	Path         string
	Found        bool
	MachineFound bool
	Secure       bool
	OrgID        string
	APIKey       string
	Err          error
}

NetrcInfo describes the Vulnetix Package Firewall entry in netrc.

func NetrcStatus added in v3.15.1 

func NetrcStatus() NetrcInfo

NetrcStatus reports whether netrc contains usable Vulnetix credentials.

type SourceStatus added in v3.54.0 

type SourceStatus struct {
	Label  string
	State  string
	Detail string
	Active bool
}

SourceStatus describes one credential source for status output.

func AllSourceStatusDetailed added in v3.54.0 

func AllSourceStatusDetailed() []SourceStatus

AllSourceStatusDetailed returns structured credential-source status.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.