auth

package
v0.0.7-alpha Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: AGPL-3.0 Imports: 23 Imported by: 0

Documentation

Overview

Package auth is a generated GoMock package.

Package auth is a generated GoMock package.

Index

Constants

View Source 
const (
	ApiTokenPrefix  = "sdm_"
	ApiTokenByteLen = 32
)
View Source 
const (
	AuthenticationTokenKey AuthenticationToken = "AuthToken"
	ContextUserKey         ContextUser         = "UserInContext"
)
View Source 
const (
	// 30 days.
	RefreshTokenExpiry = 30 * 24 * time.Hour
	// 1 hour.
	JwtTokenExpiry = 1 * time.Hour
)
View Source 
const (
	ResourceStacks              = "stacks"
	ResourceSecrets             = "secrets"
	ResourceRegistryCredentials = "registry-credentials"
	ResourceGitIntegrations     = "git-integrations"
	ResourceVolumes             = "volumes"
	ResourceAddonsPostgres      = "addons/postgres"
	ResourceClusters            = "clusters"
	ResourceImageRegistries     = "image-registries"
	ResourceOrgs                = "orgs"
	ResourceProjects            = "projects"
	ResourceObjectStores        = "object-stores"
	ResourceUsers               = "users"
	ResourceImageBuilds         = "image-builds"
	ResourceAddons              = "addons"
	ResourceDomains             = "domains"
	ResourceInvites             = "invites"
	ResourcePreviewConfigs      = "preview-configs"
	ResourcePreviewStacks       = "preview-stacks"
)
View Source 
const (
	ActionRead   = "read"
	ActionWrite  = "write"
	ActionDelete = "delete"
	ActionCreate = "create"
	ActionList   = "list"
	ActionLogs   = "logs"
	ActionExec   = "exec"

	ScopeFullAccess = "*:*"
)
View Source 
const DefaultAuthCookieName = "auth_token"

Variables

View Source 
var ResourceTypes = []ResourceType{
	{Name: ResourceStacks, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate, ActionLogs, ActionExec}},
	{Name: ResourceSecrets, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceRegistryCredentials, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceGitIntegrations, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceVolumes, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceClusters, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceImageRegistries, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceOrgs, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceAddonsPostgres, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate, ActionLogs, ActionExec}, Parent: ResourceAddons},
	{Name: ResourceObjectStores, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceUsers, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceImageBuilds, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceAddons, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate, ActionLogs, ActionExec}},
	{Name: ResourceDomains, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceProjects, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourceInvites, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourcePreviewConfigs, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
	{Name: ResourcePreviewStacks, Actions: []string{ActionRead, ActionWrite, ActionDelete, ActionList, ActionCreate}},
}

Functions

func CanAuthenticateWithAPIToken 

func CanAuthenticateWithAPIToken(r *http.Request) bool

func CanAuthenticateWithCookie 

func CanAuthenticateWithCookie(r *http.Request) bool

func ContactEmailFromCtx 

func ContactEmailFromCtx(ctx context.Context) string

ContactEmailFromCtx resolves the contact email for the caller: the authenticated user's email, or the identity's ContactEmail for system identities. Empty when neither is present.

func CreateRefreshToken 

func CreateRefreshToken(ctx context.Context, store stores.RefreshTokenStore, userID string) (string, error)

func DefaultPolicies 

func DefaultPolicies() [][]string

func GetCurrentUserFromCtx 

func GetCurrentUserFromCtx(ctx context.Context) (*models.User, error)

func IsJwtTokenInCtx 

func IsJwtTokenInCtx(ctx context.Context) bool

func LoadDefaultPolicies 

func LoadDefaultPolicies(addPolicy func(subject, domain, resource, action string) error) error

func NewAPITokenHandler 

func NewAPITokenHandler(next http.Handler, spec ApiTokenAuthnHandlerSpec) http.Handler

func NewGitHubOAuthHandler 

func NewGitHubOAuthHandler(spec GitHubOAuthHandlerSpec) *gitHubOAuthHandler

func NewJwtAuthnHandler 

func NewJwtAuthnHandler(next http.Handler, spec JWTAuthnHandlerSpec) http.Handler

func NewJwtCookieAuthnHandler 

func NewJwtCookieAuthnHandler(next http.Handler, spec JWTCookieAuthnHandlerSpec) http.Handler

func NewRefreshHandler 

func NewRefreshHandler(spec RefreshHandlerSpec) *refreshHandler

func ScopeCovers 

func ScopeCovers(grantedScope, requestedResource, requestedAction string) bool

ScopeCovers returns true if grantedScope permits the requested resource and action. Supports wildcard matching: "stacks:*" covers "stacks:read", and "addons:*" covers "addons/postgres:write".

func SetIdentityInContext 

func SetIdentityInContext(ctx context.Context, identity *Identity) context.Context

func SetUserInContext 

func SetUserInContext(ctx context.Context, user *models.User) context.Context

func ValidateScope 

func ValidateScope(scope string) bool

ValidateScope checks whether a scope string is valid against the resource type registry. Scopes use "resource:action" format. Wildcards are supported: "*:*" grants everything, "stacks:*" grants all actions on stacks, and "addons:*" covers child resources like "addons/postgres".

Types

type ApiTokenAuthnHandlerSpec 

type ApiTokenAuthnHandlerSpec struct {
	TokenLookup TokenLookup
	UserGetter  UserGetter
}

type AuthMethod 

type AuthMethod string
const (
	AuthMethodJWT      AuthMethod = "jwt"
	AuthMethodAPIToken AuthMethod = "api_token"
	AuthMethodOAuth    AuthMethod = "oauth"
)

type AuthenticationToken 

type AuthenticationToken string

type AuthnMiddleware 

type AuthnMiddleware interface {
	AuthenticateUser(next http.Handler) http.Handler
	GetAvailableAuthenticators() []authenticator
}

func NewAuthMiddleware 

func NewAuthMiddleware(userGetter UserGetter) AuthnMiddleware

type Claims 

type Claims struct {
	UserID string `json:"userId"`
	Role   string `json:"role"`
	jwt.StandardClaims
}

type ContextUser 

type ContextUser string

type GitHubOAuthHandlerSpec 

type GitHubOAuthHandlerSpec struct {
	ClientID          string
	ClientSecret      string
	RedirectURI       string
	OAuthUserService  oAuthUserService
	OAuthStateStore   stores.OAuthStateStore
	RefreshTokenStore stores.RefreshTokenStore
	JWTSecret         []byte
	JWTClaimsBuilder  JWTClaimsBuilder
	OrgInviteService  oAuthInviteService
	EncryptionService oAuthEncryptionService
	Logger            logger.Logger
}

type Identity 

type Identity struct {
	UserID      string
	OrgID       string
	Role        string
	AuthMethod  AuthMethod
	TokenID     string
	TokenScopes []string
	ResourceIDs []string
	IsSystem    bool
	// ContactEmail carries the operator contact for system identities,
	// which have no backing user.
	ContactEmail string
}

func GetIdentityFromCtx 

func GetIdentityFromCtx(ctx context.Context) *Identity

func (*Identity) IsOrgAdmin 

func (i *Identity) IsOrgAdmin() bool

type IdentityKey 

type IdentityKey string

type JWTAuthnHandlerSpec 

type JWTAuthnHandlerSpec struct {
	JWTSecret  []byte
	UserGetter UserGetter
}

type JWTClaimsBuilder 

type JWTClaimsBuilder interface {
	BuildClaims(user *models.User, expirationTime time.Time) jwt.Claims
}

type JWTClaimsBuilderImpl 

type JWTClaimsBuilderImpl struct{}

func NewJWTClaimsBuilder 

func NewJWTClaimsBuilder() *JWTClaimsBuilderImpl

NewJWTClaimsBuilder returns a new instance of JWTClaimsBuilder.

func (*JWTClaimsBuilderImpl) BuildClaims 

func (c *JWTClaimsBuilderImpl) BuildClaims(user *models.User, expirationTime time.Time) jwt.Claims

type JWTCookieAuthnHandlerSpec 

type JWTCookieAuthnHandlerSpec struct {
	JWTSecret  []byte
	UserGetter UserGetter
}

type JwtAuthPayload 

type JwtAuthPayload struct {
	UserID string `json:"userId"`
	Role   string `json:"role"`
}

func GetJwtAuthPayloadFromContext 

func GetJwtAuthPayloadFromContext(ctx context.Context) (*JwtAuthPayload, error)

type MockAuthnMiddleware 

type MockAuthnMiddleware struct {
	// contains filtered or unexported fields
}

MockAuthnMiddleware is a mock of AuthnMiddleware interface.

func NewMockAuthnMiddleware 

func NewMockAuthnMiddleware(ctrl *gomock.Controller) *MockAuthnMiddleware

NewMockAuthnMiddleware creates a new mock instance.

func (*MockAuthnMiddleware) AuthenticateUser 

func (m *MockAuthnMiddleware) AuthenticateUser(next http.Handler) http.Handler

AuthenticateUser mocks base method.

func (*MockAuthnMiddleware) EXPECT 

func (m *MockAuthnMiddleware) EXPECT() *MockAuthnMiddlewareMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockAuthnMiddleware) GetAvailableAuthenticators 

func (m *MockAuthnMiddleware) GetAvailableAuthenticators() []authenticator

GetAvailableAuthenticators mocks base method.

type MockAuthnMiddlewareMockRecorder 

type MockAuthnMiddlewareMockRecorder struct {
	// contains filtered or unexported fields
}

MockAuthnMiddlewareMockRecorder is the mock recorder for MockAuthnMiddleware.

func (*MockAuthnMiddlewareMockRecorder) AuthenticateUser 

func (mr *MockAuthnMiddlewareMockRecorder) AuthenticateUser(next any) *gomock.Call

AuthenticateUser indicates an expected call of AuthenticateUser.

func (*MockAuthnMiddlewareMockRecorder) GetAvailableAuthenticators 

func (mr *MockAuthnMiddlewareMockRecorder) GetAvailableAuthenticators() *gomock.Call

GetAvailableAuthenticators indicates an expected call of GetAvailableAuthenticators.

type MockTokenLookup 

type MockTokenLookup struct {
	// contains filtered or unexported fields
}

MockTokenLookup is a mock of TokenLookup interface.

func NewMockTokenLookup 

func NewMockTokenLookup(ctrl *gomock.Controller) *MockTokenLookup

NewMockTokenLookup creates a new mock instance.

func (*MockTokenLookup) EXPECT 

func (m *MockTokenLookup) EXPECT() *MockTokenLookupMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockTokenLookup) ValidateToken 

func (m *MockTokenLookup) ValidateToken(ctx context.Context, rawToken string) (*models.APIToken, *errors.ServiceError)

ValidateToken mocks base method.

type MockTokenLookupMockRecorder 

type MockTokenLookupMockRecorder struct {
	// contains filtered or unexported fields
}

MockTokenLookupMockRecorder is the mock recorder for MockTokenLookup.

func (*MockTokenLookupMockRecorder) ValidateToken 

func (mr *MockTokenLookupMockRecorder) ValidateToken(ctx, rawToken any) *gomock.Call

ValidateToken indicates an expected call of ValidateToken.

type MockUserGetter 

type MockUserGetter struct {
	// contains filtered or unexported fields
}

MockUserGetter is a mock of UserGetter interface.

func NewMockUserGetter 

func NewMockUserGetter(ctrl *gomock.Controller) *MockUserGetter

NewMockUserGetter creates a new mock instance.

func (*MockUserGetter) EXPECT 

func (m *MockUserGetter) EXPECT() *MockUserGetterMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockUserGetter) InternalGet 

func (m *MockUserGetter) InternalGet(ctx context.Context, ID string) (*models.User, *errors.ServiceError)

InternalGet mocks base method.

type MockUserGetterMockRecorder 

type MockUserGetterMockRecorder struct {
	// contains filtered or unexported fields
}

MockUserGetterMockRecorder is the mock recorder for MockUserGetter.

func (*MockUserGetterMockRecorder) InternalGet 

func (mr *MockUserGetterMockRecorder) InternalGet(ctx, ID any) *gomock.Call

InternalGet indicates an expected call of InternalGet.

type Mockauthenticator 

type Mockauthenticator struct {
	// contains filtered or unexported fields
}

Mockauthenticator is a mock of authenticator interface.

func NewMockauthenticator 

func NewMockauthenticator(ctrl *gomock.Controller) *Mockauthenticator

NewMockauthenticator creates a new mock instance.

func (*Mockauthenticator) AuthenticaticationHandler 

func (m *Mockauthenticator) AuthenticaticationHandler(w http.ResponseWriter, r *http.Request, next http.Handler)

AuthenticaticationHandler mocks base method.

func (*Mockauthenticator) EXPECT 

func (m *Mockauthenticator) EXPECT() *MockauthenticatorMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*Mockauthenticator) Select 

func (m *Mockauthenticator) Select(requestCtx context.Context) bool

Select mocks base method.

type MockauthenticatorMockRecorder 

type MockauthenticatorMockRecorder struct {
	// contains filtered or unexported fields
}

MockauthenticatorMockRecorder is the mock recorder for Mockauthenticator.

func (*MockauthenticatorMockRecorder) AuthenticaticationHandler 

func (mr *MockauthenticatorMockRecorder) AuthenticaticationHandler(w, r, next any) *gomock.Call

AuthenticaticationHandler indicates an expected call of AuthenticaticationHandler.

func (*MockauthenticatorMockRecorder) Select 

func (mr *MockauthenticatorMockRecorder) Select(requestCtx any) *gomock.Call

Select indicates an expected call of Select.

type PermissionService 

type PermissionService interface {
	Check(ctx context.Context, domain, resource, resourceID, action string) *errors.ServiceError
}

func NewPermissionService 

func NewPermissionService(spec PermissionServiceSpec) PermissionService

type PermissionServiceSpec 

type PermissionServiceSpec struct {
	PolicyManager resourceaccess.ResourceAccessPolicyManager
	ProjectStore  stores.ProjectStore
	Logger        logger.Logger
}

type RefreshHandlerSpec 

type RefreshHandlerSpec struct {
	RefreshTokenStore stores.RefreshTokenStore
	UserGetter        UserGetter
	JWTSecret         []byte
	JWTClaimsBuilder  JWTClaimsBuilder
}

type ResourceType 

type ResourceType struct {
	Name    string
	Parent  string // Optional parent resource for hierarchical permissions (e.g. "addons" is parent of "addons/postgres")
	Actions []string
}

type TokenLookup 

type TokenLookup interface {
	ValidateToken(ctx context.Context, rawToken string) (*models.APIToken, *errors.ServiceError)
}

TokenLookup validates a raw token and returns the stored token record.

type UserGetter 

type UserGetter interface {
	InternalGet(ctx context.Context, ID string) (*models.User, *errors.ServiceError)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.