auth

Documentation

Index

• Constants
• Variables
• func WithUserClaims(ctx context.Context, claims *Claims) context.Context
• type Claims
  • func UserClaimsFromContext(ctx context.Context) *Claims
  • func (c *Claims) CheckAttributes(required []string) bool
• type Config
  • func (c Config) Validate() error
• type InMemKey
• type InMemStore
  • func NewInMemStore() *InMemStore
  • func (s *InMemStore) Close() error
  • func (s *InMemStore) GetDel(ctx context.Context, key string) error
  • func (s *InMemStore) SetEx(ctx context.Context, key string, ttl time.Duration) error
• type NoopTokenVerifier
  • func (t *NoopTokenVerifier) Verify(ctx context.Context, token string) (*Claims, error)
• type OIDCABACConfig
• type OIDCConfig
• type OIDCTokenVerifier
  • func NewOIDCTokenVerifier(ctx context.Context, cfg *OIDCConfig) (*OIDCTokenVerifier, error)
  • func (t *OIDCTokenVerifier) Verify(ctx context.Context, token string) (*Claims, error)
• type RedisConfig
• type RedisStore
  • func NewRedisStore(ctx context.Context, tp trace.TracerProvider, cfg *RedisConfig) (*RedisStore, error)
  • func (s *RedisStore) Close() error
  • func (s *RedisStore) GetDel(ctx context.Context, key string) error
  • func (s *RedisStore) SetEx(ctx context.Context, key string, ttl time.Duration) error
• type TicketConfig
• type TicketProvider
  • func NewTicketProvider(ctx context.Context, store TicketStore, rander io.Reader) *TicketProvider
  • func (t *TicketProvider) Check(ctx context.Context, ticket *string) error
  • func (t *TicketProvider) Close() error
  • func (t *TicketProvider) Request(ctx context.Context) (string, error)
• type TicketStore
• type TokenVerifier

Constants

const TicketTTL = time.Second * 5

Variables

var ErrKeyNotFound = errors.New("key not found")

var ErrUnauthorized error = errors.New("unauthorized")

Functions

func WithUserClaims

func WithUserClaims(ctx context.Context, claims *Claims) context.Context

WithUserClaims puts the user claims into the current context.

Types

type Claims

type Claims struct {
	Email         string   `json:"email,omitempty"`
	EmailVerified bool     `json:"email_verified,omitempty"`
	Attributes    []string `json:"-"`
}

func UserClaimsFromContext

func UserClaimsFromContext(ctx context.Context) *Claims

UserClaimsFromContext returns the user claims from the context. A nil value is returned if they are not found.

func (*Claims) CheckAttributes

func (c *Claims) CheckAttributes(required []string) bool

CheckAttributes verifies all required attributes are present in the claim attributes. It always verifies if the claim is nil (authentication disabled) or the attributes are nil (access control disabled). Attributes are verified by exact match or by having an ancestor with wildcard. For example, a claim with "*" or "package:*" as one of it's attributes will verify all package actions, like "package:list", "package:read", etc.

type Config

type Config struct {
	Enabled bool
	OIDC    *OIDCConfig
	Ticket  *TicketConfig
}

func (Config) Validate

func (c Config) Validate() error

Validate implements config.ConfigurationValidator.

type InMemKey

type InMemKey struct {
	// contains filtered or unexported fields
}

type InMemStore

type InMemStore struct {
	// contains filtered or unexported fields
}

func NewInMemStore

func NewInMemStore() *InMemStore

func (*InMemStore) Close

func (s *InMemStore) Close() error

func (*InMemStore) GetDel

func (s *InMemStore) GetDel(ctx context.Context, key string) error

func (*InMemStore) SetEx

func (s *InMemStore) SetEx(ctx context.Context, key string, ttl time.Duration) error

type NoopTokenVerifier

type NoopTokenVerifier struct{}

func (*NoopTokenVerifier) Verify

func (t *NoopTokenVerifier) Verify(ctx context.Context, token string) (*Claims, error)

type OIDCABACConfig

type OIDCABACConfig struct {
	Enabled            bool
	ClaimPath          string
	ClaimPathSeparator string
	ClaimValuePrefix   string
	UseRoles           bool
	RolesMapping       map[string][]string
}

type OIDCConfig

type OIDCConfig struct {
	ProviderURL            string
	ClientID               string
	SkipEmailVerifiedCheck bool

	// Attribute Based Access Control configuration.
	ABAC OIDCABACConfig
}

type OIDCTokenVerifier

type OIDCTokenVerifier struct {
	// contains filtered or unexported fields
}

func NewOIDCTokenVerifier

func NewOIDCTokenVerifier(ctx context.Context, cfg *OIDCConfig) (*OIDCTokenVerifier, error)

func (*OIDCTokenVerifier) Verify

func (t *OIDCTokenVerifier) Verify(ctx context.Context, token string) (*Claims, error)

type RedisConfig

type RedisConfig struct {
	Address string
	Prefix  string
}

type RedisStore

type RedisStore struct {
	// contains filtered or unexported fields
}

RedisStore is an implementation of TicketStore based on Redis.

func NewRedisStore

func NewRedisStore(ctx context.Context, tp trace.TracerProvider, cfg *RedisConfig) (*RedisStore, error)

func (*RedisStore) Close

func (s *RedisStore) Close() error

func (*RedisStore) GetDel

func (s *RedisStore) GetDel(ctx context.Context, key string) error

func (*RedisStore) SetEx

func (s *RedisStore) SetEx(ctx context.Context, key string, ttl time.Duration) error

type TicketConfig

type TicketConfig struct {
	Redis *RedisConfig
}

type TicketProvider

type TicketProvider struct {
	// contains filtered or unexported fields
}

TicketProvider issues WebSocket authentication tickets.

func NewTicketProvider

func NewTicketProvider(ctx context.Context, store TicketStore, rander io.Reader) *TicketProvider

NewTicketProvider creates a new TicketProvider. The provider is no-op when the store is nil.

func (*TicketProvider) Check

func (t *TicketProvider) Check(ctx context.Context, ticket *string) error

Check that a ticket is known to the provider, not including tickets that exceeded the time-to-live attribute.

func (*TicketProvider) Close

func (t *TicketProvider) Close() error

Close closes the provider, releasing resources associated to the store.

func (*TicketProvider) Request

func (t *TicketProvider) Request(ctx context.Context) (string, error)

Request a new ticket.

type TicketStore

type TicketStore interface {
	// SetEx persists a key with a timeout.
	SetEx(ctx context.Context, key string, ttl time.Duration) error
	// GetDel checks whether a key exists in the store. It returns
	// ErrKeyNotFound if the key was not found or expired.
	GetDel(ctx context.Context, key string) error
	// Close the client.
	Close() error
}

TicketStore persists expirable tickets.

type TokenVerifier

type TokenVerifier interface {
	Verify(ctx context.Context, token string) (*Claims, error)
}