Documentation
¶
Overview ¶
Package dataaccessclient holds client-side plumbing shared by the iam-data-access smoke test and its bootstrap-ancestor-grant tool. It has no build tag on purpose: the smoke test package is //go:build smoke and the bootstrap tool is untagged, and neither could import the other directly.
Index ¶
- Constants
- func AssignmentInput(subject *relationshipspb.Subject, object *relationshipspb.Object) *relationshipspb.RelationshipInput
- func AuthContext(ctx context.Context, serviceToken, jwt, gatewayHeaderValue string) context.Context
- func Dial(addr string, insecureConn bool) (*grpc.ClientConn, error)
- func GatewayContext(ctx context.Context, gatewayHeaderValue string) context.Context
- func MintJWT(ctx context.Context, railsBaseURL, pat string) (string, error)
- func Subject(id Identity) *relationshipspb.Subject
- type Identity
Constants ¶
const AncestorID = "019f7f64-768f-7e71-ac3d-ca6d41ad16de"
AncestorID is the fixed object id the smoke-test service account holds a standing relationships-admin grant on. See docs/smoke-tests.md.
const ArtifactAdminRoleID = "019ed9d4-7d50-7249-9baa-52594d2d645b"
ArtifactAdminRoleID is the "Artifact Admin" role, the only role accepted for a grant on a non-organization object. See docs/smoke-tests.md.
const GatewayHeaderName = "x-gitlab-svc"
GatewayHeaderName is the header the GATE sandbox's L1 gateway routes on. Fixed; only the value varies per target service.
const ServiceTokenHeader = "gitlab-iam-data-access-token"
ServiceTokenHeader is the metadata header carrying the iam-data-access service token.
Variables ¶
This section is empty.
Functions ¶
func AssignmentInput ¶
func AssignmentInput(subject *relationshipspb.Subject, object *relationshipspb.Object) *relationshipspb.RelationshipInput
AssignmentInput builds a relationship granting subject the Artifact Admin role on object — the only role WriteRelationships accepts for a non-organization object.
func AuthContext ¶
AuthContext returns ctx carrying the service token and end-user JWT a data-access caller needs, plus the gateway routing header.
func Dial ¶
func Dial(addr string, insecureConn bool) (*grpc.ClientConn, error)
Dial opens a gRPC client connection to addr. TLS is used by default; pass insecure=true only for local testing against a plaintext dev instance.
func GatewayContext ¶ added in v1.39.2
GatewayContext returns ctx carrying only the gateway routing header. Needed even for RPCs that take no credentials: the sandbox's L1 gateway routes on this header alone, and without it the call lands on GitLab Rails, which answers with an HTML error page rather than gRPC. An empty gatewayHeaderValue adds nothing, for a target reached directly (Runway).
func MintJWT ¶
MintJWT calls Rails' /token_exchange endpoint and returns the signed JWT. pat must belong to a dedicated GitLab Service Account, not a CI job token or a human user's token — see docs/smoke-tests.md for why.
func Subject ¶
func Subject(id Identity) *relationshipspb.Subject
Subject builds the subject.identity message for id. Origin is always ORIGIN_ORGANIZATION: token exchange only mints organization-scoped identities.
Types ¶
type Identity ¶
Identity is the subset of the nested `gitlab` claim these clients need to build a matching subject.identity. Origin isn't included: callers always use ORIGIN_ORGANIZATION, since token exchange only mints organization-scoped user identities.
func DecodeIdentity ¶
DecodeIdentity reads the `gitlab` claim out of a JWT's payload segment. It does not verify the signature: the token came straight from Rails over TLS using our own PAT, so there's no untrusted party to verify against.
Source Files