auth

package
v0.1.15 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2023 License: MPL-2.0 Imports: 27 Imported by: 0

Documentation

Overview

Package auth is responsible for authentication

Index

Constants

View Source 
const (
	SiteAdminID       = "user-site-admin"
	SiteAdminUsername = "site-admin"
)

Variables

View Source 
var ErrCannotDeleteOnlyOwner = errors.New("cannot remove the last owner")
View Source 
var ErrRemovingOwnersTeamNotPermitted = errors.New("the owners team cannot be deleted")
View Source 
var (
	SiteAdmin = User{ID: SiteAdminID, Username: SiteAdminUsername}
)

Functions

func NewService 

func NewService(opts Options) *service

func NewTeamCommand added in v0.1.9 

func NewTeamCommand(api *otfapi.Client) *cobra.Command

func NewUserCommand added in v0.1.9 

func NewUserCommand(api *otfapi.Client) *cobra.Command

Types

type AuthService 

type AuthService interface {
	TeamService
	UserService
}

type Authorizer added in v0.1.15 

type Authorizer struct {
	logr.Logger
}

Authorizer authorizes access to a team

func (*Authorizer) CanAccess added in v0.1.15 

func (a *Authorizer) CanAccess(ctx context.Context, action rbac.Action, teamID string) (internal.Subject, error)

type Client 

type Client struct {
	internal.JSONAPIClient

	AuthService
}

func (*Client) AddTeamMembership 

func (c *Client) AddTeamMembership(ctx context.Context, teamID string, usernames []string) error

AddTeamMembership adds users to a team via HTTP.

func (*Client) CreateTeam 

func (c *Client) CreateTeam(ctx context.Context, organization string, opts CreateTeamOptions) (*Team, error)

CreateTeam creates a team via HTTP/JSONAPI.

func (*Client) CreateUser 

func (c *Client) CreateUser(ctx context.Context, username string, _ ...NewUserOption) (*User, error)

CreateUser creates a user via HTTP/JSONAPI. Options are ignored.

func (*Client) DeleteTeam 

func (c *Client) DeleteTeam(ctx context.Context, id string) error

DeleteTeam deletes a team via HTTP/JSONAPI.

func (*Client) DeleteUser 

func (c *Client) DeleteUser(ctx context.Context, username string) error

DeleteUser deletes a user via HTTP/JSONAPI.

func (*Client) GetTeam 

func (c *Client) GetTeam(ctx context.Context, organization, name string) (*Team, error)

GetTeam retrieves a team via HTTP/JSONAPI.

func (*Client) RemoveTeamMembership 

func (c *Client) RemoveTeamMembership(ctx context.Context, teamID string, usernames []string) error

RemoveTeamMembership removes users from a team via HTTP.

type CreateTeamOptions 

type CreateTeamOptions struct {
	// Name of team to create
	Name *string `json:"name" schema:"name,required"`

	OrganizationAccessOptions

	// TFE fields that OTF does not support but persists merely to pass the
	// go-tfe integration tests
	SSOTeamID  *string
	Visibility *string
}

type CreateUserOptions added in v0.1.15 

type CreateUserOptions struct {
	Username string `json:"username"`
}

type NewUserOption 

type NewUserOption func(*User)

func WithTeams 

func WithTeams(memberships ...*Team) NewUserOption

type Options 

type Options struct {
	*sql.DB
	*tfeapi.Responder
	html.Renderer
	internal.HostnameService
	organization.OrganizationService
	logr.Logger
}

type OrganizationAccess 

type OrganizationAccess struct {
	ManageWorkspaces bool // admin access on all workspaces
	ManageVCS        bool // manage VCS providers
	ManageModules    bool // manage module registry

	// TFE fields that OTF does not support but persists merely to pass the
	// go-tfe integration tests
	ManageProviders       bool
	ManagePolicies        bool
	ManagePolicyOverrides bool
}

OrganizationAccess defines a team's organization access.

type OrganizationAccessOptions added in v0.0.50 

type OrganizationAccessOptions struct {
	ManageWorkspaces *bool `schema:"manage_workspaces"`
	ManageVCS        *bool `schema:"manage_vcs"`
	ManageModules    *bool `schema:"manage_modules"`

	// TFE fields that OTF does not support but persists merely to pass the
	// go-tfe integration tests
	ManageProviders       *bool
	ManagePolicies        *bool
	ManagePolicyOverrides *bool
}

OrganizationAccessOptions defines access to be granted upon team creation or to grant/rescind to/from an existing team.

type OrganizationService 

type OrganizationService organization.Service

Aliases to disambiguate service names when embedded together.

type Team 

type Team struct {
	ID           string    `jsonapi:"primary,teams"`
	CreatedAt    time.Time `jsonapi:"attribute" json:"created-at"`
	Name         string    `jsonapi:"attribute" json:"name"`
	Organization string    `jsonapi:"attribute" json:"organization"`

	Access OrganizationAccess

	// TFE fields that OTF does not support but persists merely to pass the
	// go-tfe integration tests
	Visibility string
	SSOTeamID  *string
}

Team is a group of users sharing a level of authorization.

func CreateTestTeam 

func CreateTestTeam(t *testing.T, db *sql.DB, organization *organization.Organization) *Team

func NewTestTeam 

func NewTestTeam(t *testing.T, organization string) *Team

func (*Team) CanAccessOrganization added in v0.1.15 

func (t *Team) CanAccessOrganization(action rbac.Action, org string) bool

func (*Team) CanAccessSite added in v0.1.15 

func (t *Team) CanAccessSite(action rbac.Action) bool

func (*Team) CanAccessTeam added in v0.1.15 

func (t *Team) CanAccessTeam(action rbac.Action, id string) bool

func (*Team) CanAccessWorkspace added in v0.1.15 

func (t *Team) CanAccessWorkspace(action rbac.Action, policy internal.WorkspacePolicy) bool

func (*Team) IsOwner added in v0.1.15 

func (t *Team) IsOwner(organization string) bool

func (*Team) IsOwners 

func (t *Team) IsOwners() bool

func (*Team) IsSiteAdmin added in v0.1.15 

func (t *Team) IsSiteAdmin() bool

func (*Team) OrganizationAccess 

func (t *Team) OrganizationAccess() OrganizationAccess

func (*Team) Organizations added in v0.1.15 

func (t *Team) Organizations() []string

func (*Team) String 

func (t *Team) String() string

func (*Team) Update 

func (t *Team) Update(opts UpdateTeamOptions) error

type TeamCLI added in v0.1.9 

type TeamCLI struct {
	AuthService
}

type TeamService 

type TeamService interface {
	CreateTeam(ctx context.Context, organization string, opts CreateTeamOptions) (*Team, error)
	GetTeam(ctx context.Context, organization, team string) (*Team, error)
	GetTeamByID(ctx context.Context, teamID string) (*Team, error)
	GetTeamByTokenID(ctx context.Context, teamTokenID string) (*Team, error)
	ListTeams(ctx context.Context, organization string) ([]*Team, error)
	ListTeamMembers(ctx context.Context, teamID string) ([]*User, error)
	UpdateTeam(ctx context.Context, teamID string, opts UpdateTeamOptions) (*Team, error)
	DeleteTeam(ctx context.Context, teamID string) error
}

type UpdateTeamOptions 

type UpdateTeamOptions struct {
	Name *string

	OrganizationAccessOptions

	// TFE fields that OTF does not support but persists merely to pass the
	// go-tfe integration tests
	SSOTeamID  *string
	Visibility *string
}

type User 

type User struct {
	ID        string    `jsonapi:"primary,users"`
	CreatedAt time.Time `jsonapi:"attribute" json:"created-at"`
	UpdatedAt time.Time `jsonapi:"attribute" json:"updated-at"`
	SiteAdmin bool      `jsonapi:"attribute" json:"site-admin"`

	// username is globally unique
	Username string `jsonapi:"attribute" json:"username"`

	// user belongs to many teams
	Teams []*Team
}

User represents an OTF user account.

func NewUser 

func NewUser(username string, opts ...NewUserOption) *User

func UserFromContext 

func UserFromContext(ctx context.Context) (*User, error)

UserFromContext retrieves a user from a context

func (*User) CanAccessOrganization 

func (u *User) CanAccessOrganization(action rbac.Action, org string) bool

func (*User) CanAccessSite 

func (u *User) CanAccessSite(action rbac.Action) bool

func (*User) CanAccessTeam added in v0.1.15 

func (u *User) CanAccessTeam(action rbac.Action, teamID string) bool

func (*User) CanAccessWorkspace 

func (u *User) CanAccessWorkspace(action rbac.Action, policy internal.WorkspacePolicy) bool

func (*User) IsOwner 

func (u *User) IsOwner(organization string) bool

IsOwner determines if user is an owner of an organization

func (*User) IsSiteAdmin 

func (u *User) IsSiteAdmin() bool

IsSiteAdmin determines whether user is a site admin. A user is a site admin in either of two cases: (1) their account has been promoted to site admin (think sudo) (2) the account is *the* site admin (think root)

func (*User) IsTeamMember 

func (u *User) IsTeamMember(teamID string) bool

IsTeamMember determines whether user is a member of the given team.

func (*User) Organizations 

func (u *User) Organizations() []string

Organizations returns the user's membership of organizations (indirectly via their membership of teams).

NOTE: always returns a non-nil slice

func (*User) String 

func (u *User) String() string

type UserCLI added in v0.1.9 

type UserCLI struct {
	UserService
}

type UserListOptions 

type UserListOptions struct {
	Organization *string
	TeamName     *string
}

UserListOptions are options for the ListUsers endpoint.

type UserService 

type UserService interface {
	CreateUser(ctx context.Context, username string, opts ...NewUserOption) (*User, error)
	GetUser(ctx context.Context, spec UserSpec) (*User, error)
	ListUsers(ctx context.Context) ([]*User, error)
	ListOrganizationUsers(ctx context.Context, organization string) ([]*User, error)
	DeleteUser(ctx context.Context, username string) error
	AddTeamMembership(ctx context.Context, teamID string, usernames []string) error
	RemoveTeamMembership(ctx context.Context, teamID string, usernames []string) error
	SetSiteAdmins(ctx context.Context, usernames ...string) error
}

type UserSpec 

type UserSpec struct {
	UserID                *string
	Username              *string
	AuthenticationTokenID *string
}

func (UserSpec) LogValue 

func (s UserSpec) LogValue() slog.Value

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.