auth

Documentation

Index

• Constants
• Variables
• type Auth
  • func Start(ctx context.Context, conn *nats.Conn, opts ...Option) (*Auth, error)
  • func (a *Auth) Check(ctx context.Context, req CheckRequest) (bool, error)
  • func (a *Auth) Close() error
  • func (a *Auth) List(ctx context.Context, req ListRequest) error
  • func (a *Auth) Start(ctx context.Context, opts ...Option) error
• type CheckRequest
• type Group
• type ListRequest
• type Option
  • func WithAdminGroups(group string) Option
• type Permissions
  • func (p *Permissions) AllowRules() []Rule
  • func (p *Permissions) DenyRules() []Rule
• type RBAC
  • func (r *RBAC) Check(ctx context.Context, req Request) bool
  • func (r *RBAC) Close() error
  • func (r *RBAC) HandleRoleBindingEvent(event hz.Event) (hz.Result, error)
  • func (r *RBAC) HandleRoleEvent(event hz.Event) (hz.Result, error)
  • func (r *RBAC) Start(ctx context.Context) error
• type Request
• type RequestSubject
• type Role
  • func (Role) ObjectGroup() string
  • func (Role) ObjectKind() string
  • func (Role) ObjectVersion() string
• type RoleBinding
  • func (RoleBinding) ObjectGroup() string
  • func (RoleBinding) ObjectKind() string
  • func (RoleBinding) ObjectVersion() string
• type RoleBindingSpec
• type RoleRef
  • func RoleRefFromRole(role Role) RoleRef
• type RoleSpec
• type Rule
• type Sessions
  • func (s *Sessions) Delete(ctx context.Context, session string) error
  • func (s *Sessions) Get(ctx context.Context, session string) (UserInfo, error)
  • func (s *Sessions) New(ctx context.Context, user UserInfo) (string, error)
  • func (s *Sessions) Start(ctx context.Context) error
• type Subject
• type UserInfo
• type Verb

Constants

const (
	// GroupSystemAuthenticated is a group all users with a session belong to.
	// It is a way of identifying "anyone who is authenticated".
	GroupSystemAuthenticated = "system:authenticated"
)

Variables

var (
	ErrAuthenticationMissing = &hz.Error{
		Status:  http.StatusBadRequest,
		Message: "missing authentication header",
	}
	ErrInvalidCredentials = &hz.Error{
		Status:  http.StatusUnauthorized,
		Message: "invalid credentials",
	}
	ErrForbidden = &hz.Error{
		Status:  http.StatusForbidden,
		Message: "forbidden",
	}
)

Types

type Auth

type Auth struct {
	Conn *nats.Conn

	Sessions *Sessions
	RBAC     *RBAC
	// contains filtered or unexported fields
}

func Start

func Start(
	ctx context.Context,
	conn *nats.Conn,
	opts ...Option,
) (*Auth, error)

func (*Auth) Check

func (a *Auth) Check(
	ctx context.Context,
	req CheckRequest,
) (bool, error)

func (*Auth) Close

func (a *Auth) Close() error

func (*Auth) List

func (a *Auth) List(
	ctx context.Context,
	req ListRequest,
) error

func (*Auth) Start

func (a *Auth) Start(
	ctx context.Context,
	opts ...Option,
) error

type CheckRequest

type CheckRequest struct {
	Session string
	Verb    Verb
	Object  hz.ObjectKeyer
}

type Group

type Group struct {
	Name       string
	Namespaces map[string]*Permissions
}

type ListRequest

type ListRequest struct {
	Session    string
	ObjectList *hz.ObjectList
}

Verb is implied (read).

type Option

type Option func(*authorizerOptions)

func WithAdminGroups

func WithAdminGroups(group string) Option

type Permissions

type Permissions struct {
	Allow []Rule `json:"allow"`
	Deny  []Rule `json:"deny"`
}

func (*Permissions) AllowRules

func (p *Permissions) AllowRules() []Rule

func (*Permissions) DenyRules

func (p *Permissions) DenyRules() []Rule

type RBAC

type RBAC struct {
	Conn *nats.Conn
	// TODO: RoleBindings and Roles maps are not thread safe.
	// E.g. HandleRoleEvent and refresh both write and read from Roles.
	RoleBindings map[string]RoleBinding
	Roles        map[string]Role

	Permissions map[string]*Group

	AdminGroup string
	// contains filtered or unexported fields
}

func (*RBAC) Check

func (r *RBAC) Check(ctx context.Context, req Request) bool

func (*RBAC) Close

func (r *RBAC) Close() error

func (*RBAC) HandleRoleBindingEvent

func (r *RBAC) HandleRoleBindingEvent(event hz.Event) (hz.Result, error)

func (*RBAC) HandleRoleEvent

func (r *RBAC) HandleRoleEvent(event hz.Event) (hz.Result, error)

func (*RBAC) Start

func (r *RBAC) Start(ctx context.Context) error

type Request

type Request struct {
	Subject RequestSubject
	Verb    Verb
	Object  hz.ObjectKeyer
}

Request is a request to check if Subject is allowed to perform Verb on Object.

type RequestSubject

type RequestSubject struct {
	Groups []string
}

type Role

type Role struct {
	hz.ObjectMeta `json:"metadata,omitempty"`

	Spec RoleSpec `json:"spec,omitempty" cue:""`
}

func (Role) ObjectGroup

func (Role) ObjectGroup() string

func (Role) ObjectKind

func (Role) ObjectKind() string

func (Role) ObjectVersion

func (Role) ObjectVersion() string

type RoleBinding

type RoleBinding struct {
	hz.ObjectMeta `json:"metadata,omitempty"`

	Spec RoleBindingSpec `json:"spec,omitempty" cue:""`
}

func (RoleBinding) ObjectGroup

func (RoleBinding) ObjectGroup() string

func (RoleBinding) ObjectKind

func (RoleBinding) ObjectKind() string

func (RoleBinding) ObjectVersion

func (RoleBinding) ObjectVersion() string

type RoleBindingSpec

type RoleBindingSpec struct {
	// RoleRef is the reference to the Role which the RoleBinding will bind.
	RoleRef RoleRef `json:"roleRef" cue:""`
	// Subjects is the list of subjects that should have this Role.
	Subjects []Subject `json:"subjects" cue:""`
}

type RoleRef

type RoleRef struct {
	// Group is the api group of the Role being referenced.
	Group string `json:"group" cue:""`
	// Kind is the type of the Role being referenced.
	Kind string `json:"kind" cue:""`
	// Name is the name of the Role to which this RoleBinding refers.
	Name string `json:"name" cue:""`
}

func RoleRefFromRole

func RoleRefFromRole(role Role) RoleRef

type RoleSpec

type RoleSpec struct {
	Allow []Rule `json:"allow,omitempty"`
	Deny  []Rule `json:"deny,omitempty"`
}

type Rule

type Rule struct {
	// Name of a resource that this rule targets.
	Name *string `json:"name,omitempty"`
	// Kind of a resource that this rule targets.
	Kind *string `json:"kind,omitempty" cue:""`
	// Group of a resource that this rule targets.
	Group *string `json:"group,omitempty" cue:""`
	// Verbs that this rule enforces.
	Verbs []Verb `json:"verbs,omitempty" cue:""`
}

type Sessions

type Sessions struct {
	Conn *nats.Conn
	// contains filtered or unexported fields
}

func (*Sessions) Delete

func (s *Sessions) Delete(ctx context.Context, session string) error

func (*Sessions) Get

func (s *Sessions) Get(ctx context.Context, session string) (UserInfo, error)

func (*Sessions) New

func (s *Sessions) New(ctx context.Context, user UserInfo) (string, error)

func (*Sessions) Start

func (s *Sessions) Start(ctx context.Context) error

type Subject

type Subject struct {
	// Kind is the type of the subject.
	Kind string `json:"kind" cue:""`
	// Name is the name of the subject.
	Name string `json:"name" cue:""`
}

type UserInfo

type UserInfo struct {
	Sub     string   `json:"sub"`
	Iss     string   `json:"iss"`
	Name    string   `json:"name"`
	Email   string   `json:"email"`
	Groups  []string `json:"groups"`
	Picture string   `json:"picture"`
}

type Verb

type Verb string

const (
	// VerbRead allows/denies a subject to read objects.
	VerbRead Verb = "read"
	// VerbUpdate allows/denies a subject to update objects.
	VerbUpdate Verb = "update"
	// VerbCreate allows/denies a subject to create objects.
	VerbCreate Verb = "create"
	// VerbDelete allows/denies a subject to delete objects.
	VerbDelete Verb = "delete"
	// VerbRun allows/denies a subject to run actions for an actor.
	VerbRun Verb = "run"
	// VerbAll allows/denies a subject to perform all verbs.
	VerbAll Verb = "*"
)