Help us shape the future of Go! Take the 2026 Go Developer Survey

security

package
v1.9.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Overview

Package security defines the authorization boundary for remote Dispatch operators.

Index

Constants

View Source 
const (
	OperatorRead  = "dispatch.installation.read"
	OperatorWrite = "dispatch.installation.write"
	PayloadRead   = "dispatch.installation.payload.read"
	Subscribe     = "dispatch.installation.subscribe"
	Federation    = "dispatch.installation.federation"
)
View Source 
const CheckTimeout = 5 * time.Second
View Source 
const StreamLifetime = 5 * time.Minute

Variables

View Source 
var (
	ErrUnauthenticated = errors.New("dispatch: authentication required")
	ErrForbidden       = errors.New("dispatch: access denied")
	ErrUnavailable     = errors.New("dispatch: authorization unavailable")
)

Functions

func BulkTarget 

func BulkTarget(queue string, limit int, before time.Time, dryRun bool) (string, error)

BulkTarget describes the effective bounded replay or purge selection.

func CreationTarget 

func CreationTarget(kind, name, queue string) (string, error)

CreationTarget identifies the input selector before an output ID exists.

func Metadata 

func Metadata(p Principal) durable.AuditMetadata

Metadata retains the verified machine actor kind. It never copies raw claims.

func ResourceTarget 

func ResourceTarget(prefix id.Prefix, raw string) (string, error)

ResourceTarget captures a typed identifier, never an arbitrary request value.

Types

type AuditService 

type AuditService struct {
	// contains filtered or unexported fields
}

AuditService is a shared activation handle. Route copies keep this pointer; Activate verifies its binding after migrations. The extension enables remote admission only after the engine starts successfully. A zero or inactive handle fails closed.

func (*AuditService) AcceptanceFailures 

func (a *AuditService) AcceptanceFailures() uint64

AcceptanceFailures counts local audit acceptance failures, without provider text or recursive audit events. Persisted unresolved attempts survive restart.

func (*AuditService) Activate 

func (a *AuditService) Activate(ctx context.Context, store durable.OutboxStore, catalog durable.NamespaceStore, resource Resource, namespace string, allowNamespaceFallback bool) error

Activate verifies the persisted host binding; caller input never selects it.

func (*AuditService) Deactivate 

func (a *AuditService) Deactivate()

type Authenticator 

type Authenticator interface {
	Authenticate(context.Context, *http.Request) (Principal, error)
}

type AuthenticatorFunc 

type AuthenticatorFunc func(context.Context, *http.Request) (Principal, error)

func (AuthenticatorFunc) Authenticate 

func (f AuthenticatorFunc) Authenticate(ctx context.Context, r *http.Request) (Principal, error)

type Authorizer 

type Authorizer interface {
	Authorize(context.Context, Principal, string, Resource) error
}

type AuthorizerFunc 

type AuthorizerFunc func(context.Context, Principal, string, Resource) error

func (AuthorizerFunc) Authorize 

func (f AuthorizerFunc) Authorize(ctx context.Context, p Principal, a string, r Resource) error

type Boundary 

type Boundary struct {
	Resource   Resource
	Authorizer Authorizer
	Audit      *AuditService
}

Boundary always denies incomplete configuration and bounds policy work.

func (Boundary) AcceptOutcome 

func (b Boundary) AcceptOutcome(ctx context.Context, o durable.LegacyOutcome) error

func (Boundary) AuthenticationDenied 

func (b Boundary) AuthenticationDenied(ctx context.Context, op Operation) error

AuthenticationDenied records anonymous admission without retaining credentials or provider errors. Audit failure never changes the denial into authorization.

func (Boundary) BeginCommand 

func (b Boundary) BeginCommand(ctx context.Context, p Principal, op Operation) (attempt CommandAttempt, auditErr error)

func (Boundary) Check 

func (b Boundary) Check(ctx context.Context, p Principal, op Operation) error

func (Boundary) CheckNamespace 

func (b Boundary) CheckNamespace(ctx context.Context, p Principal, op Operation, namespace string) error

CheckNamespace uses an already resolved authorized namespace for successful read auditing. Unresolved and denied attempts always use the host binding.

func (Boundary) DurableReadsReady 

func (b Boundary) DurableReadsReady() bool

DurableReadsReady preserves the extension's post-start admission barrier.

func (Boundary) FinishCommand 

func (b Boundary) FinishCommand(ctx context.Context, a CommandAttempt, success bool) error

func (Boundary) RecordDurableRead 

func (b Boundary) RecordDurableRead(ctx context.Context, p Principal, action, outcome, namespace string, targets ...durable.Key) error

RecordDurableRead accepts denial and sensitive-read audit before protected data leaves the operator service. Successful scope comes from the persisted catalog.

type CommandAttempt 

type CommandAttempt struct{ Record durable.LegacyAttempt }

CommandAttempt identifies durable evidence accepted before legacy execution.

func (CommandAttempt) CaptureOutcome 

func (a CommandAttempt) CaptureOutcome(success bool) (durable.LegacyOutcome, error)

CaptureOutcome allocates one immutable outcome for safe persistence retries.

type ForgeAuthenticator 

type ForgeAuthenticator struct {
	Registry  func() (auth.Registry, error)
	Providers []string
}

ForgeAuthenticator resolves providers on every request. Only provider-attested explicit credentials are accepted, including after an upstream cookie bridge.

func NewForgeAuthenticator 

func NewForgeAuthenticator(registry func() (auth.Registry, error), providers ...string) *ForgeAuthenticator

func (*ForgeAuthenticator) Authenticate 

func (a *ForgeAuthenticator) Authenticate(ctx context.Context, r *http.Request) (Principal, error)

type Operation 

type Operation struct {
	Action  string
	Payload bool
	// AuditAction is the registered operation, separate from its Warden permission.
	AuditAction string
	Target      string
}

func ContractOperation 

func ContractOperation(intent string) (op Operation)

func DWPOperation 

func DWPOperation(method string) (op Operation)

func RESTOperation 

func RESTOperation(method, path string) (op Operation)

RESTOperation uses the registered method and template, never a request label.

func (Operation) Mutating 

func (op Operation) Mutating() bool

type OutcomeUnconfirmedError 

type OutcomeUnconfirmedError struct{ AttemptID string }

OutcomeUnconfirmedError means execution may have succeeded. Retrying the command is unsafe; reconcile the retained attempt instead.

func (*OutcomeUnconfirmedError) Error 

func (e *OutcomeUnconfirmedError) Error() string

func (*OutcomeUnconfirmedError) Unwrap 

func (e *OutcomeUnconfirmedError) Unwrap() error

type Principal 

type Principal struct{ Subject, Kind string }

Principal is a verified server identity. Request filters never establish authority.

func FromContract 

func FromContract(p fc.Principal) (Principal, error)

func FromForge 

func FromForge(a *auth.AuthContext) (Principal, error)

func (Principal) Validate 

func (p Principal) Validate() error

type Resource 

type Resource struct{ InstallationID, PolicyTenant string }

type WardenAuthorizer 

type WardenAuthorizer struct {
	Engine func() (*warden.Engine, error)
}

WardenAuthorizer resolves the host policy engine lazily. Unhandled obligations deny even an otherwise allowed decision.

func (*WardenAuthorizer) Authorize 

func (a *WardenAuthorizer) Authorize(ctx context.Context, p Principal, action string, r Resource) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.