dynoid

Documentation

Index

• Constants
• func LocalTokenPath(audience string) string
• func ReadLocal(audience string) (string, error)
• type IssuerCallback
  • func AllowHerokuHost(host string) IssuerCallback
  • func AllowHerokuSpace(host string, spaceIDs ...string) IssuerCallback
• type MalformedTokenError
  • func (e *MalformedTokenError) Error() string
  • func (e *MalformedTokenError) Unwrap() error
• type Subject
  • func (s *Subject) LogValue() slog.Value
  • func (s *Subject) MarshalText() ([]byte, error)
  • func (s *Subject) String() string
  • func (s *Subject) UnmarshalText(text []byte) error
• type Token
  • func ReadLocalToken(ctx context.Context, audience string) (*Token, error)
  • func (t *Token) LogValue() slog.Value
• type UntrustedIssuerError
  • func (e *UntrustedIssuerError) Error() string
• type Verifier
  • func New(clientID string) *Verifier
  • func NewWithCallback(clientID string, callback IssuerCallback) *Verifier
  • func (v *Verifier) Verify(ctx context.Context, rawIDToken string) (*Token, error)

Constants

const (
	ErrMustCheckIssuer staticError = "must check issuer"
)

Functions

func LocalTokenPath

func LocalTokenPath(audience string) string

LocalTokenPath returns the path on disk to the token for the given audience

func ReadLocal

func ReadLocal(audience string) (string, error)

ReadLocal reads the local machines token for the given audience

Suitable for passing as a bearer token

Types

type IssuerCallback

type IssuerCallback func(issuer string) error

An IssuerCallback is called whenever a token is verified to ensure it matches some expected criteria.

func AllowHerokuHost

func AllowHerokuHost(host string) IssuerCallback

AllowHerokuHost verifies that the issuer is from Heroku for the given host domain

func AllowHerokuSpace

func AllowHerokuSpace(host string, spaceIDs ...string) IssuerCallback

AllowHerokuSpace verifies that the issuer is from Heroku for the given host and space id.

type MalformedTokenError

type MalformedTokenError struct {
	// contains filtered or unexported fields
}

Returned when the token doesn't match the expected format

func (*MalformedTokenError) Error

func (e *MalformedTokenError) Error() string

func (*MalformedTokenError) Unwrap

func (e *MalformedTokenError) Unwrap() error

type Subject

type Subject struct {
	AppID   string `json:"app_id"`
	AppName string `json:"app_name"`
	Dyno    string `json:"dyno"`
}

Subject contains information about the app and dyno the token was issued for

func (*Subject) LogValue

func (s *Subject) LogValue() slog.Value

func (*Subject) MarshalText

func (s *Subject) MarshalText() ([]byte, error)

func (*Subject) String

func (s *Subject) String() string

func (*Subject) UnmarshalText

func (s *Subject) UnmarshalText(text []byte) error

type Token

type Token struct {
	IDToken *oidc.IDToken `json:"-"`
	SpaceID string        `json:"space_id"`
	Subject *Subject      `json:"subject"`
}

Token contains all of the token information stored by Heroku when it's issued

func ReadLocalToken

func ReadLocalToken(ctx context.Context, audience string) (*Token, error)

ReadLocalToken reads the local machines token for the given audience and parses it

func (*Token) LogValue

func (t *Token) LogValue() slog.Value

type UntrustedIssuerError

type UntrustedIssuerError struct {
	Issuer string
}

Returned by an IssuerCallback getting an issuer it doesn't trust

func (*UntrustedIssuerError) Error

func (e *UntrustedIssuerError) Error() string

type Verifier

type Verifier struct {
	IssuerCallback IssuerCallback
	// contains filtered or unexported fields
}

A Verifier verifies a raw token with it's oids issuer and uses the IssuerCallback to ensure it's from a trusted source.

func New

func New(clientID string) *Verifier

Instantiate a new Verifier without an IssuerCallback set.

The IssuerCallback must be set before calling Verify or an error will be returned.

func NewWithCallback

func NewWithCallback(clientID string, callback IssuerCallback) *Verifier

Instantiate a new Verifier with the IssuerCallback set.

func (*Verifier) Verify

func (v *Verifier) Verify(ctx context.Context, rawIDToken string) (*Token, error)

Verify validates the given token with the OIDC provider and validates it against the IssuerCallback