auth

type Authenticator struct {
	// contains filtered or unexported fields
}

type ExpiredVerifier interface {
	VerifyExpired(ctx context.Context, raw string) (types.Token, error)
}

type HashParams struct {
	MemoryKiB uint32
	Time      uint32
	Threads   uint8
}

type Options struct {
	CacheSize int
	CacheTTL  time.Duration
	// Concurrency bounds the password hashes computed at once; zero means
	// GOMAXPROCS. Each costs the hash's memory parameter, so without a bound
	// a flood of wrong passwords could exhaust memory.
	Concurrency int
	// Now supplies the time; nil means time.Now.
	Now func() time.Time
	// Hash is the cost of the dummy hash checked for unknown users; the
	// zero value means the production parameters. Tests set tiny costs.
	Hash HashParams
	// Tokens verifies access and reference tokens; nil refuses every token.
	Tokens TokenVerifier
	// Groups names the groups new users join automatically, which the
	// transient user of a transient token joins (types.IdentityTransient);
	// nil means none.
	Groups store.GroupStore
}

type Principal struct {
	Name      string
	Admin     bool
	Anonymous bool
	Groups    []string
	// Scope is the scope of the access token the request presented; empty
	// for a password or anonymous request, which act with the user's full
	// permissions. Scopes only narrow (decision 0005); the permission
	// evaluator applies them.
	Scope types.Scope
	// TokenID is the id of the access or reference token the request
	// presented; empty for a password or anonymous request. The token API's
	// "me" resolves to it, and encryptedPassword refuses token callers.
	TokenID string
	// TokenExpires is when that token expires; zero for a password, an
	// anonymous request or a token that never expires. A registry token
	// obtained with a token lives no longer (decision 0005).
	TokenExpires time.Time
	// Registry is what a registry token grants, nil for any other
	// credential. Such a principal reaches the registry's routes alone.
	Registry *types.RegistryAccess
	// Identity is how the token's subject resolved to a user: transient or
	// synthetic for a token from an OIDC exchange, transient for one an
	// administrator minted for a name that is no stored user; a registry
	// token obtained with it keeps it (decision 0005).
	Identity types.TokenIdentity
	// TokenParent is, for a registry token, the stored token it descends
	// from: a registry token it obtains descends from the same one.
	TokenParent string
	// PasswordExpired marks a principal whose correct password has expired.
	// The middleware lets it through only to change its own password.
	PasswordExpired bool
	// Password marks a principal that a user name and password
	// authenticated, which the Access token API refuses while
	// token.allow_basic_auth is off (#385). An empty TokenID cannot stand
	// for it: anonymous and hand-built principals have none either.
	Password bool
	// contains filtered or unexported fields
}

type Refresher struct {
	User    string
	TokenID string
}

type TokenVerifier interface {
	Verify(ctx context.Context, raw string) (types.Token, error)
}