Documentation
¶
Overview ¶
Package artifactregistry provides a client for exchanging a GitLab session token for a short-lived GitLab Artifact Registry access token via the POST /api/v4/token_exchange endpoint.
It lives under internal/api rather than beside the command that uses it so that the glab auth docker credential helper can consume it too once it learns about artifact registries: command packages must not import each other.
Index ¶
Constants ¶
const ( // MinDuration is the shortest lifetime a caller may request through // ExchangeToken: the server's actual floor. These tokens cannot be // revoked once minted, and AppSec is pushing for shorter-lived tokens // (gitlab#601725, artifact-registry#229), so the CLI does not add a // floor of its own above the server's: a caller asking for less // exposure should never be blocked from getting it. MinDuration = 1 * time.Second // MaxDuration is the longest lifetime a caller may request through // ExchangeToken. A CLI-side choice, not a server contract; see // MinDuration. MaxDuration = 12 * time.Hour // DefaultDuration is what callers get when they do not choose a // duration explicitly, e.g. `glab artifact-registry get-token` with no // --duration. A CLI-side choice, independent of MinDuration and of the // server's own 5-minute default, which applies only when expires_in is // omitted entirely (see ExchangeDefaultToken). DefaultDuration = 15 * time.Minute // DockerHelperDuration is the token lifetime the Docker credential helper // requests for every artifact-registry exchange it makes. Docker invokes // the helper with no way to pass a duration, so this is the only lever; // it is entirely independent of `get-token`, which always validates and // uses its own --duration flag (defaulting to DefaultDuration, not // MinDuration). It is deliberately longer than MinDuration: a docker // pull/push holds the credential for the whole operation, not just the // initial handshake, and a token expiring mid-pull hard-fails it. // Changing it changes how long every docker pull/push's token stays valid. DockerHelperDuration = time.Hour )
Variables ¶
This section is empty.
Functions ¶
func ValidateDuration ¶
ValidateDuration reports whether d is within [MinDuration, MaxDuration]. This is an advisory, CLI-side guard so flag parsing fails fast with a clear message; it is not a mirror of server policy, which can change independently (artifact-registry#229) and whose 400 response is always the authoritative answer.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client exchanges a GitLab session token for a short-lived Artifact Registry access token.
func (*Client) ExchangeDefaultToken ¶
func (c *Client) ExchangeDefaultToken(ctx context.Context) (*ExchangeResult, error)
ExchangeDefaultToken exchanges the caller's GitLab credential for a short-lived Artifact Registry access token, omitting expires_in so the server applies its own default lifetime. Callers that only read the token's claims and then discard it, like `status`, want the server default rather than a CLI-chosen duration.
func (*Client) ExchangeToken ¶
func (c *Client) ExchangeToken(ctx context.Context, duration time.Duration) (*ExchangeResult, error)
ExchangeToken exchanges the caller's GitLab credential for a short-lived Artifact Registry access token valid for duration. duration must be within [MinDuration, MaxDuration].
type ExchangeResult ¶
type ExchangeResult struct {
// Token is the raw, encoded access token returned by the server. Nothing
// here verifies its signature; it is trustworthy because of the TLS
// connection to the issuing host. Treat it as a bearer credential for
// tokenExchangeAudience and hand it to nothing else.
Token string `json:"token"`
// ExpiresAt is the token's expiry, taken from its exp claim.
ExpiresAt time.Time `json:"expires_at"`
// Issuer is the token's iss claim.
Issuer string `json:"issuer"`
// Subject is the token's sub claim.
Subject string `json:"subject"`
// Audience is the token's aud claim: what it is scoped to. Printing this
// is what distinguishes an Artifact-Registry-scoped token from just "a
// token GitLab issued".
Audience string `json:"audience"`
}
ExchangeResult is the decoded result of a successful token exchange. The claim-derived fields are populated here so callers never have to decode the token a second time.
func (ExchangeResult) MarshalJSON ¶
func (r ExchangeResult) MarshalJSON() ([]byte, error)
MarshalJSON redacts Token so json.Marshal(ExchangeResult) never leaks the bearer token, protecting callers that marshal the whole struct instead of a printer-local subset of its fields.
func (ExchangeResult) String ¶
func (r ExchangeResult) String() string
String redacts Token so logging or formatting an ExchangeResult with %v or %+v never leaks the bearer token.
Source Files