Documentation
¶
Overview ¶
Package authtoken implements the one-time session token store used by yarilo-auth to hand off authenticated sessions to backend pods without replaying credentials.
Flow:
- Login pod authenticates the client via the yarilo-auth AUTH command.
- On success yarilo-auth issues a token (Store.Issue) and returns it in the OK response as "token=<hex>".
- Login pod forwards the token to the backend in the preamble (XCLIENT TOKEN=<hex>).
- Backend calls yarilo-auth VERIFY <id> <token>.
- Store.Validate consumes the token (one-time) and returns the bound username and session ID so the backend can enter authenticated state without running passdb again.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type RedisOption ¶
type RedisOption func(*RedisStore)
RedisOption tunes a RedisStore at construction, mirroring locks' options.
func WithKeyPrefix ¶
func WithKeyPrefix(p string) RedisOption
WithKeyPrefix overrides the Redis key prefix. Empty is ignored (keeps the default), so a blank config value does not erase the namespace.
type RedisStore ¶
type RedisStore struct {
// contains filtered or unexported fields
}
RedisStore is a Redis-backed one-time token store. GETDEL provides atomic consume; Redis TTL replaces the background sweeper.
func NewRedis ¶
func NewRedis(client *redis.Client, ttl time.Duration, opts ...RedisOption) *RedisStore
NewRedis returns a RedisStore. The caller owns the client lifecycle; Close is a no-op.
func (*RedisStore) Close ¶
func (s *RedisStore) Close()
Close is a no-op; the caller manages the Redis client lifecycle.
func (*RedisStore) Consume ¶
func (s *RedisStore) Consume(tok string) bool
Consume removes tok once its session is established (#2259).
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store issues session tokens (32 random bytes, hex), valid for the TTL until the backend whose session opened consumes it (#2259); a sweeper purges the rest.
func (*Store) Consume ¶
Consume removes tok once a session it opened is established, so it cannot open a second one. Reports whether it was there.
Source Files