service

Documentation

Overview

Authentication/authorization

Package service provides functionality to support all services

Index

• Constants
• Variables
• func ClearRequestContext(r *http.Request)
• func IsAuthentic(msg Signed, key []byte) (bool, error)
• func RequestContext(r *http.Request) context.Context
• func RequestContextAuth(r *http.Request) map[string]interface{}
• func SetRequestContext(r *http.Request, ctx *Context)
• func SetRequestContextVar(r *http.Request, key, value interface{})
• func Sign(msg Signable, key []byte) ([]byte, error)
• func TimeoutHandler(logFunc func(msg string, ctx ...interface{}), d time.Duration, h http.Handler) http.Handler
• type Authorization
  • func NewAuthorization(h func() hash.Hash) *Authorization
  • func (a *Authorization) Decode(key []byte) error
  • func (a *Authorization) Encode(key []byte) error
  • func (a *Authorization) Expires(t time.Time)
  • func (a *Authorization) Expiry() time.Time
  • func (a *Authorization) HashFunc() func() hash.Hash
  • func (a *Authorization) Message() ([]byte, error)
  • func (a *Authorization) ReadFrom(r io.Reader) (int64, error)
  • func (a *Authorization) Serialized() (string, error)
  • func (a *Authorization) Signature() ([]byte, error)
  • func (a *Authorization) WriteTo(w io.Writer) (int64, error)
• type Context
  • func NewContext(ctx context.Context, cfg config.Config, log log15.Logger) (*Context, error)
  • func (ctx *Context) APIKeychain() *Keychain
  • func (ctx *Context) Config() *config.Config
  • func (ctx *Context) Log() log15.Logger
  • func (ctx *Context) PaymentDB(ros ...dbRequestReadOnly) *sql.DB
  • func (ctx *Context) PrincipalDB(ros ...dbRequestReadOnly) *sql.DB
  • func (ctx *Context) RateLimitHandler(parent http.Handler) http.Handler
  • func (ctx *Context) SetPaymentDB(w, ro *sql.DB)
  • func (ctx *Context) SetPrincipalDB(w, ro *sql.DB)
  • func (ctx *Context) Value(key interface{}) interface{}
  • func (ctx *Context) WebKeychain() *Keychain
  • func (ctx *Context) WithValue(key, value interface{}) *Context
• type Keychain
  • func NewKeychain() *Keychain
  • func (k *Keychain) AddBinKey(key []byte)
  • func (k *Keychain) AddKey(newKey string) error
  • func (k *Keychain) BinKey() ([]byte, error)
  • func (k *Keychain) GenerateKey() ([]byte, error)
  • func (k *Keychain) Key() (string, error)
  • func (k *Keychain) KeyCount() int
  • func (k *Keychain) MatchKey(s Signed) ([]byte, error)
• type Signable
• type Signed

Constants

const (
	// ContextVarAuthKey is the name of the key under which the auth container
	// will be stored in request contexts
	ContextVarAuthKey = "Auth"
)

const (
	// MaxMsgSize is the maximum size the (encoded) content of an Authorization container
	// can have
	MaxMsgSize = 4096
)

Variables

var (
	ErrDecrypt       = errors.New("error decrypting container")
	ErrMsgSize       = errors.New("message too big")
	ErrInvalidKey    = errors.New("invalid key")
	ErrNoKeys        = errors.New("no keys in keychain")
	ErrNoMatchingKey = errors.New("no matching key for signature")
)

var (
	ErrTimedOut = errors.New("http Write: already timed out")
)

var ReadOnly = dbRequestReadOnly(true)

ReadOnly is a possible parameter for the ctx.xDB() methods. If this parameter is passed to the methods, they will attempt to return the read-only database connection

Functions

func ClearRequestContext

func ClearRequestContext(r *http.Request)

ClearRequestContext removes the associated context for the given request

func IsAuthentic

func IsAuthentic(msg Signed, key []byte) (bool, error)

IsAuthentic returns true if the signed message has a correct signature for the given key

func RequestContext

func RequestContext(r *http.Request) context.Context

RequestContext returns a request associated with the given request

func RequestContextAuth

func RequestContextAuth(r *http.Request) map[string]interface{}

RequestAuthUserKey returns a request associated with the given request

func SetRequestContext

func SetRequestContext(r *http.Request, ctx *Context)

SetRequestContext sets a new context for a request

func SetRequestContextVar

func SetRequestContextVar(r *http.Request, key, value interface{})

SetRequestContextVar associates a var with a request context

func Sign

func Sign(msg Signable, key []byte) ([]byte, error)

Sign signs a signable message with the given key and returns the signature

func TimeoutHandler

func TimeoutHandler(logFunc func(msg string, ctx ...interface{}), d time.Duration, h http.Handler) http.Handler

Types

type Authorization

type Authorization struct {
	Payload map[string]interface{}
	H       func() hash.Hash
	// contains filtered or unexported fields
}

Authorization is a container which can hold arbitrary authorization data, can be encrypted and signed and safely passed between services. As long as those share the same keychain, they are able to access the encrypted data.

func NewAuthorization

func NewAuthorization(h func() hash.Hash) *Authorization

NewAuthorization creates a new authorization container with the given Hash function for signing and key derivation

func (*Authorization) Decode

func (a *Authorization) Decode(key []byte) error

/ Decode decodes a container after it was read using the ReadFrom() method

func (*Authorization) Encode

func (a *Authorization) Encode(key []byte) error

Encode encodes the message, encrypting its contents and signing it with the given key

Encode() must be called prior to writing it using the WriteTo() method, otherwise secret data might be written to the Writer

func (*Authorization) Expires

func (a *Authorization) Expires(t time.Time)

Expires sets the expiry time

func (*Authorization) Expiry

func (a *Authorization) Expiry() time.Time

Expiry returns the expiry time

func (*Authorization) HashFunc

func (a *Authorization) HashFunc() func() hash.Hash

HashFunc implementing the Signable interface

func (*Authorization) Message

func (a *Authorization) Message() ([]byte, error)

Message implementing the Signable interface

func (*Authorization) ReadFrom

func (a *Authorization) ReadFrom(r io.Reader) (int64, error)

ReadFrom reads a serialized authorization container from the given reader

After the container is read, it should be decoded using the Decode() method

func (*Authorization) Serialized

func (a *Authorization) Serialized() (string, error)

func (*Authorization) Signature

func (a *Authorization) Signature() ([]byte, error)

Signature implementing the Signed interface

func (*Authorization) WriteTo

func (a *Authorization) WriteTo(w io.Writer) (int64, error)

WriteTo writes the serialized authorization container to the given writer

Prior to writing the container to a writer, it must be encoded using the Encode() method

type Context

type Context struct {
	context.Context
	// contains filtered or unexported fields
}

Context is a custom context which is used by the service pkg

func NewContext

func NewContext(ctx context.Context, cfg config.Config, log log15.Logger) (*Context, error)

NewContext creates a new service context for use in the service pkg

func (*Context) APIKeychain

func (ctx *Context) APIKeychain() *Keychain

Keychain returns the authorization container keychain associated with the context

func (*Context) Config

func (ctx *Context) Config() *config.Config

Config returns the config.Config associated with the context

func (*Context) Log

func (ctx *Context) Log() log15.Logger

Log returns the log15.Logger associated with the context

func (*Context) PaymentDB

func (ctx *Context) PaymentDB(ros ...dbRequestReadOnly) *sql.DB

PaymentDB returns the *sql.DB for the payment DB If the parameter(s) contain a service.ReadOnly, the read-only connection will be returned if present

func (*Context) PrincipalDB

func (ctx *Context) PrincipalDB(ros ...dbRequestReadOnly) *sql.DB

PrincipalDB returns the *sql.DB for the principal DB If the parameter(s) contain a service.ReadOnly, the read-only connection will be returned if present

func (*Context) RateLimitHandler

func (ctx *Context) RateLimitHandler(parent http.Handler) http.Handler

RateLimitHandler wraps the given handler with a context-wide rate limit

The capacity of the ctx.rateLimit buffered channel determines the maximum amount of concurrent requests on this context.

func (*Context) SetPaymentDB

func (ctx *Context) SetPaymentDB(w, ro *sql.DB)

SetPaymentDB sets the payment DB connection(s) It will panic if the write connection is nil

func (*Context) SetPrincipalDB

func (ctx *Context) SetPrincipalDB(w, ro *sql.DB)

SetPrincipalDB sets the principal DB connection(s) It will panic if the write connection is nil

func (*Context) Value

func (ctx *Context) Value(key interface{}) interface{}

Value wraps the Context.Value

func (*Context) WebKeychain

func (ctx *Context) WebKeychain() *Keychain

func (*Context) WithValue

func (ctx *Context) WithValue(key, value interface{}) *Context

SetValue creates a new service context with the given value

type Keychain

type Keychain struct {
	// contains filtered or unexported fields
}

Keychain stores (and rotates) keys for authorization container encryption

func NewKeychain

func NewKeychain() *Keychain

NewKeychain creates an empty keychain

func (*Keychain) AddBinKey

func (k *Keychain) AddBinKey(key []byte)

AddBinKey adds a binary key to the keychain

func (*Keychain) AddKey

func (k *Keychain) AddKey(newKey string) error

AddKey adds a (hex-encoded) key to the keychain

func (*Keychain) BinKey

func (k *Keychain) BinKey() ([]byte, error)

BinKey returns a binary key from the keychain which can be used to encrypt authorization containers

func (*Keychain) GenerateKey

func (k *Keychain) GenerateKey() ([]byte, error)

GenerateKey generates a random key, adds it to the keychain and returns the generated key

func (*Keychain) Key

func (k *Keychain) Key() (string, error)

Key returns a hex-encoded key from the keychain which can be used to encrypt authorization containers

func (*Keychain) KeyCount

func (k *Keychain) KeyCount() int

KeyCount returns the number of keys in the keychain

func (*Keychain) MatchKey

func (k *Keychain) MatchKey(s Signed) ([]byte, error)

MatchKey returns the key which was used to sign the Signed If no such key is in the keychain, it will return ErrNoMatchingKey

type Signable

type Signable interface {
	Message() ([]byte, error)
	HashFunc() func() hash.Hash
}

Signable is a type which can be signed

type Signed

type Signed interface {
	Signable
	Signature() ([]byte, error)
}

Signed is a type which has been signed The signature can be authenticated using the Signable interface and recreating the signature