api

package
v0.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 2, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GenerateSecret 

func GenerateSecret() string

GenerateSecret creates a random secret string.

func HasScope 

func HasScope(record *TokenRecord, required TokenScope, group string) bool

HasScope checks if a token record has the required scope for a given group.

func HasScopeForAction 

func HasScopeForAction(record *TokenRecord, required TokenScope, group string, action string) bool

HasScopeForAction checks scope group and, when present, the action allowlist.

func IsExpired 

func IsExpired(record *TokenRecord) bool

IsExpired checks if a token has expired.

func ListenAndServe 

func ListenAndServe(ctx context.Context, service *app.Service, vault string, port int, logf func(string, ...any), options ...ServerOptions) error

func VerifySecret 

func VerifySecret(record *TokenRecord, secret string) bool

VerifySecret checks if a plaintext secret matches the stored hash.

Types

type AuditEntry 

type AuditEntry struct {
	Timestamp string `json:"ts"`
	TokenID   string `json:"token_id"`
	Method    string `json:"method"`
	Path      string `json:"path"`
	Scope     string `json:"scope,omitempty"`
	Group     string `json:"group,omitempty"`
	Status    int    `json:"status"`
}

AuditEntry represents a single audit log entry.

type AuditLogger 

type AuditLogger struct {
	// contains filtered or unexported fields
}

AuditLogger writes audit entries to a JSONL file.

func NewAuditLogger 

func NewAuditLogger(path string) (*AuditLogger, error)

NewAuditLogger creates a new audit logger writing to the given path.

func (*AuditLogger) Close 

func (l *AuditLogger) Close() error

Close closes the audit log file.

func (*AuditLogger) Log 

func (l *AuditLogger) Log(entry AuditEntry) error

Log writes an audit entry to the log file.

type AuthMode 

type AuthMode int

AuthMode defines the authentication mode for the API server. 

const (
	AuthModeUnset     AuthMode = iota // zero value: no auth (tests)
	AuthModeTemp                      // default: temp token in memory
	AuthModeTokenFile                 // --token-file: long-lived tokens from file
	AuthModeNone                      // --no-auth: no auth, loopback only
)

type CachePolicy 

type CachePolicy struct {
	MaxAge int    // seconds
	Scope  string // "public" or "private"
}

CachePolicy defines caching parameters for a route.

type DispatcherOptions 

type DispatcherOptions struct {
	AllowWrite bool
}

type FileTokenStore 

type FileTokenStore struct {
	// contains filtered or unexported fields
}

FileTokenStore stores tokens in a JSON file.

func NewFileTokenStore 

func NewFileTokenStore(path string) (*FileTokenStore, error)

NewFileTokenStore creates or opens a file-based token store.

func (*FileTokenStore) Create 

func (f *FileTokenStore) Create(record *TokenRecord) error

Create stores a new token record to the file.

func (*FileTokenStore) Delete 

func (f *FileTokenStore) Delete(id string) error

Delete removes a token by ID from the file.

func (*FileTokenStore) Get 

func (f *FileTokenStore) Get(id string) (*TokenRecord, error)

Get retrieves a token by ID from the file.

func (*FileTokenStore) List 

func (f *FileTokenStore) List() ([]*TokenRecord, error)

List returns all token records from the file.

func (*FileTokenStore) Update 

func (f *FileTokenStore) Update(record *TokenRecord) error

Update modifies an existing token record in the file.

func (*FileTokenStore) Verify 

func (f *FileTokenStore) Verify(secret string) (*TokenRecord, error)

Verify checks a secret against all stored tokens in the file.

type HTTPRPCRequest 

type HTTPRPCRequest struct {
	ID     string         `json:"id,omitempty"`
	Method string         `json:"method"`
	Params map[string]any `json:"params,omitempty"`
}

type MemoryTokenStore 

type MemoryTokenStore struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

MemoryTokenStore stores tokens in process memory.

func NewMemoryTokenStore 

func NewMemoryTokenStore() *MemoryTokenStore

NewMemoryTokenStore creates a new in-memory token store.

func (*MemoryTokenStore) Create 

func (m *MemoryTokenStore) Create(record *TokenRecord) error

Create stores a new token record.

func (*MemoryTokenStore) Delete 

func (m *MemoryTokenStore) Delete(id string) error

Delete removes a token by ID.

func (*MemoryTokenStore) Get 

func (m *MemoryTokenStore) Get(id string) (*TokenRecord, error)

Get retrieves a token by ID.

func (*MemoryTokenStore) List 

func (m *MemoryTokenStore) List() ([]*TokenRecord, error)

List returns all token records.

func (*MemoryTokenStore) Update 

func (m *MemoryTokenStore) Update(record *TokenRecord) error

Update modifies an existing token record.

func (*MemoryTokenStore) Verify 

func (m *MemoryTokenStore) Verify(secret string) (*TokenRecord, error)

Verify checks a secret against all stored tokens.

type RPCDispatcher 

type RPCDispatcher struct {
	// contains filtered or unexported fields
}

func NewRPCDispatcher 

func NewRPCDispatcher(service *app.Service, vault string) *RPCDispatcher

func NewRPCDispatcherWithOptions 

func NewRPCDispatcherWithOptions(service *app.Service, vault string, options DispatcherOptions) *RPCDispatcher

func (*RPCDispatcher) Call 

func (d *RPCDispatcher) Call(ctx context.Context, req RPCRequest) (domain.Projection, error)

type RPCRequest 

type RPCRequest struct {
	Method string         `json:"method"`
	Params map[string]any `json:"params,omitempty"`
}

type RouteInfo 

type RouteInfo struct {
	Group    string
	Method   string
	Action   string
	Readonly bool
}

RouteInfo describes a route's group and method for scope checking.

type ScopeTarget 

type ScopeTarget struct {
	Groups  []string `json:"groups,omitempty"`
	Actions []string `json:"actions,omitempty"`
}

ScopeTarget defines which groups and actions a scope covers.

type Server 

type Server struct {
	// contains filtered or unexported fields
}

func NewServer 

func NewServer(service *app.Service, vault string) *Server

func NewServerWithOptions 

func NewServerWithOptions(service *app.Service, vault string, options ServerOptions) *Server

func (*Server) Handler 

func (s *Server) Handler() http.Handler

type ServerOptions 

type ServerOptions struct {
	AllowWrite   bool
	AuthMode     AuthMode
	TokenFile    string
	ExposeGroups []string
	HideGroups   []string
	Logger       *zap.Logger
}

type TokenRecord 

type TokenRecord struct {
	ID          string                     `json:"id"`
	SecretHash  string                     `json:"secret_hash"`
	Salt        string                     `json:"salt"`
	Scope       map[TokenScope]ScopeTarget `json:"scope"`
	Label       string                     `json:"label,omitempty"`
	CreatedAt   string                     `json:"created_at"`
	ExpiresAt   string                     `json:"expires_at,omitempty"`
	LastUsedAt  string                     `json:"last_used_at,omitempty"`
	RotatedFrom string                     `json:"rotated_from,omitempty"`
	CreatedBy   string                     `json:"created_by"`
}

TokenRecord represents a stored API token.

func GenerateTokenRecord 

func GenerateTokenRecord(label string, scope map[TokenScope]ScopeTarget, expiresAt string, createdBy string) (*TokenRecord, string)

GenerateTokenRecord creates a new token record and returns it along with the plaintext secret.

type TokenScope 

type TokenScope string

TokenScope defines the permission scope of a token. 

const (
	ScopeRead  TokenScope = "read"  // All GET routes
	ScopeWrite TokenScope = "write" // All mutation routes
	ScopeAdmin TokenScope = "admin" // Token management itself
)

type TokenStore 

type TokenStore interface {
	Verify(secret string) (*TokenRecord, error)
	Create(record *TokenRecord) error
	Get(id string) (*TokenRecord, error)
	List() ([]*TokenRecord, error)
	Delete(id string) error
	Update(record *TokenRecord) error
}

TokenStore is the interface for token persistence and verification.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.