core

package
v0.1.11 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 25, 2026 License: MIT Imports: 35 Imported by: 0

Documentation

Overview

Package core implements the service layer: authentication, authorization, audit, and the business logic for parameters, secrets, namespaces, policies, and identities. Transport layers (gRPC, HTTP) are thin adapters over this package; storage and crypto are its dependencies.

Resources are addressed by domain.Ref (a namespace plus a relative key), never by a parsed path string. Every namespaced operation runs, in order: argument validation (internal/keyutil), the per-namespace auth-method gate (plan §7), authorization (internal/policy, with the implicit home-namespace grant folded in), the storage call, then audit and watch fan-out.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CertFingerprint 

func CertFingerprint(cert *x509.Certificate) string

CertFingerprint returns the lowercase SHA-256 fingerprint of the exact DER leaf certificate. It matches the representation persisted at enrollment.

func CertSerial 

func CertSerial(cert *x509.Certificate) string

CertSerial renders a client certificate's serial the same way internal/ca does (lowercase hex, no leading "0x"), so lookups by serial match the stored form. Transports use it to populate Principal.Serial for mTLS callers.

func JSONTypeToContentType added in v0.1.9 

func JSONTypeToContentType(property map[string]any) string

JSONTypeToContentType maps a JSON Schema property to the parameter content type its value must be stored as. Mirrored in frontend/lib/contract-derive.ts and pinned by the readiness-cases fixture.

Types

type CertBundle 

type CertBundle struct {
	CertPEM     string
	KeyPEM      string
	Serial      string
	Fingerprint string
	NotAfter    time.Time
}

CertBundle is a one-time client-certificate issuance: the leaf certificate and its freshly generated private key (returned exactly once, never stored), plus identifying metadata.

type CreateIdentityInput 

type CreateIdentityInput struct {
	Name        string
	Kind        string // domain.IdentityKindClient | domain.IdentityKindAdmin
	Namespace   *domain.NamespaceRef
	AuthMethods []domain.AuthMethod // empty defaults to {mtls}; admin kind always gets a token
	CertTTL     time.Duration       // 0 uses the CA default (90 days)
}

CreateIdentityInput describes a new identity and the credentials to mint.

type CreateIdentityResult 

type CreateIdentityResult struct {
	Identity domain.Identity
	// Token is non-empty when a bearer token was minted (auth method "token", or
	// any admin identity). Shown exactly once.
	Token string
	// Cert is non-nil when a client certificate was minted (auth method "mtls").
	// Shown exactly once.
	Cert *CertBundle
}

CreateIdentityResult carries the created identity and any one-time credentials (token and/or client-certificate bundle) per the auth methods.

type Hub 

type Hub interface {
	// Wake tells the hub new change-log entries may exist. It must be cheap,
	// non-blocking, and safe to call concurrently.
	Wake()
	// Subscribers returns the live subscriber registry.
	Subscribers() []domain.Subscriber
}

Hub is the watch fan-out. The implementation (internal/watch) tails the change log; core only pokes it after committed writes and queries the registry for the admin API.

type OverviewOptions added in v0.1.9 

type OverviewOptions struct {
	// Environments restricts the named overview to these environments (all
	// when empty). Every named environment must exist.
	Environments []string
	// InsecureListener reports the transport's TLS state so the overview can
	// carry the insecure_listener finding; the HTTP layer sets it.
	InsecureListener bool
}

OverviewOptions tunes GetApplicationOverview / GetFleetOverview.

type Principal 

type Principal struct {
	Identity domain.Identity
	// Method is how the caller proved its identity (token or mTLS). The
	// transport sets it; the per-namespace auth-method gate enforces it for
	// client-kind identities.
	Method domain.AuthMethod
	// Token is the identity bearer token the caller authenticated with, retained
	// only so long-lived token streams can re-authenticate periodically (see
	// ReauthorizeWatch). Empty for mTLS callers. Never logged or persisted.
	Token string
	// Serial is the serial of the client certificate an mTLS caller presented
	// (empty for token callers). It lets long-lived mTLS streams be re-validated
	// against the specific certificate, so revoking one serial tears the stream
	// down (see ReauthorizeWatch). Transports set it alongside Fingerprint via
	// CertSerial and CertFingerprint.
	Serial string
	// Fingerprint is the lowercase SHA-256 fingerprint of the exact client leaf
	// certificate an mTLS caller presented. Together with Serial it binds
	// long-lived reauthorization to the enrolled certificate rather than merely
	// to issuer-scoped serial and SAN claims. Empty for token callers.
	Fingerprint string
	// SecretToken is the optional per-secret access token supplied with the
	// request (x-kms-secret-token). Never logged, never persisted.
	SecretToken string
	RemoteAddr  string
	UserAgent   string
	RequestID   string
}

Principal is the authenticated caller plus request context. Transports build it via Service.Authenticate (bearer token) or Service.VerifyClientCert (mTLS) and pass it to every operation.

func (Principal) IsAdmin 

func (p Principal) IsAdmin() bool

IsAdmin reports whether the principal has the admin kind. Admin-kind identities are the management plane: they bypass the per-namespace auth-method gate and data-plane policy (a browser cannot practically do client-cert auth), but not audit or client-bound cryptography.

type PutSecretInput 

type PutSecretInput struct {
	Ref         domain.Ref
	Value       []byte
	ContentType string
	Metadata    string
	// ClientBound selects the double-wrapped mode. Must match the existing
	// secret's mode on updates.
	ClientBound bool
	// GenerateToken mints a fresh per-secret access token, returned exactly
	// once. Required when creating a client-bound secret; on an existing
	// client-bound secret it rotates the token (old token must be supplied
	// with the request).
	GenerateToken bool
	ExpiresAt     int64 // unix ms, 0 = never
}

PutSecretInput describes a secret write (creation or new version).

type PutSecretResult 

type PutSecretResult struct {
	Version  uint64
	Revision uint64
	// AccessToken is non-empty only when GenerateToken was set. It is never
	// persisted or retrievable again.
	AccessToken string
}

PutSecretResult reports the write outcome.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service wires storage, crypto, watch, the built-in CA, and audit together.

func New 

func New(store storage.Store, logger *zap.Logger, version string) *Service

New constructs a Service. The keyring is attached later via SetKeyring (after unseal); until then the service reports not-ready and refuses secret operations. The built-in CA is bootstrapped via BootstrapCA once the keyring is present.

func (*Service) AcknowledgeConfigurationRelease 

func (s *Service) AcknowledgeConfigurationRelease(ctx context.Context, pr Principal, ack domain.ReleaseAcknowledgement) error

func (*Service) ActivateConfigurationRelease 

func (s *Service) ActivateConfigurationRelease(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, version uint64, expectedCurrent *uint64) (domain.ActiveConfigurationRelease, bool, error)

func (*Service) ApplyApplicationDefaults added in v0.1.11 

func (s *Service) ApplyApplicationDefaults(ctx context.Context, pr Principal, in domain.DefaultsApplyInput) (domain.DefaultsApplyResult, error)

ApplyApplicationDefaults previews or atomically executes a parameter-only defaults artifact. Applications, namespaces, schemas, releases and secrets must already exist and are never mutated by this operation.

func (*Service) AuditReleaseStreamRejected added in v0.1.9 

func (s *Service) AuditReleaseStreamRejected(ctx context.Context, pr Principal, ns domain.NamespaceRef, name, reason string)

AuditReleaseStreamRejected records a live-stream request refused by the transport's concurrency caps so the deny is visible in the audit log.

func (*Service) Authenticate 

func (s *Service) Authenticate(ctx context.Context, token, remoteAddr, userAgent string) (domain.Identity, error)

Authenticate resolves a bearer token to an identity. Failures are generic: they never reveal whether the token was close, or whether an identity exists. An audit event is emitted for failures.

func (*Service) AuthorizeReleaseWatch 

func (s *Service) AuthorizeReleaseWatch(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string) error

func (*Service) AuthorizeReleaseWatchContext 

func (s *Service) AuthorizeReleaseWatchContext(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string) (context.Context, error)

AuthorizeReleaseWatchContext returns the namespace-incarnation-bound context that must be used for the initial release snapshot and connection lifecycle.

func (*Service) AuthorizeSubscribe 

func (s *Service) AuthorizeSubscribe(ctx context.Context, pr Principal, namespaces []domain.NamespaceRef) error

AuthorizeSubscribe checks that pr may register a watch over every requested namespace: the namespace auth-method gate plus namespace-level read authorization (the implicit home grant covers the caller's own namespace). Authorization is all-or-nothing per namespace and checked once here; the watch hub performs no per-event filtering, so an admitted subscriber receives every change in each authorized namespace.

func (*Service) AuthorizeSubscribeContext 

func (s *Service) AuthorizeSubscribeContext(ctx context.Context, pr Principal, namespaces []domain.NamespaceRef) (context.Context, error)

AuthorizeSubscribeContext is the context-preserving form used by transports. The returned context pins every subscribed namespace incarnation through the initial snapshot and subsequent heartbeat reauthorization.

func (*Service) BootstrapCA 

func (s *Service) BootstrapCA(ctx context.Context) error

BootstrapCA prepares the built-in CA after unseal. On first call for a fresh store it generates a CA, wraps its private key under the active KEK (same envelope discipline as a secret DEK), and persists it; on subsequent starts it loads and decrypts the stored CA. Idempotent across restarts.

func (*Service) CACertPEM 

func (s *Service) CACertPEM() ([]byte, error)

CACertPEM returns the PEM-encoded built-in CA certificate (public; served unauthenticated at GET /api/v1/ca). It errors if the CA is not bootstrapped.

func (*Service) CACertPool 

func (s *Service) CACertPool() (*x509.CertPool, error)

CACertPool returns a pool containing only the built-in CA, for the listeners' client-CA set (operators AddCert their own client CA to it). It errors if the CA is not bootstrapped.

func (*Service) CACertificate 

func (s *Service) CACertificate() (*x509.Certificate, error)

CACertificate returns the parsed built-in CA certificate for inclusion in a listener's client-CA pool. It errors if the CA is not bootstrapped.

func (*Service) CloneApplicationEnvironment added in v0.1.9 

func (s *Service) CloneApplicationEnvironment(ctx context.Context, pr Principal, in domain.CloneEnvironmentInput) (domain.CloneEnvironmentResult, error)

CloneApplicationEnvironment creates (or attaches) a target environment for an application and seeds it from a source environment: parameters are copied as new versions unless the target key already exists; secrets are never copied and are reported as needs_value. Each item fails independently (boundedApplicationError), so a partial clone is inspectable.

func (*Service) CreateApplication added in v0.1.5 

func (s *Service) CreateApplication(ctx context.Context, pr Principal, app domain.Application) (domain.Application, error)

func (*Service) CreateConfigurationRelease 

func (s *Service) CreateConfigurationRelease(ctx context.Context, pr Principal, in domain.CreateConfigurationReleaseInput) (domain.ConfigurationRelease, error)

func (*Service) CreateConfigurationSchema 

func (s *Service) CreateConfigurationSchema(ctx context.Context, pr Principal, id, schemaJSON, metadata string) (domain.ConfigurationSchema, error)

func (*Service) CreateIdentity 

func (s *Service) CreateIdentity(ctx context.Context, pr Principal, in CreateIdentityInput) (CreateIdentityResult, error)

CreateIdentity mints a new identity and its credentials. Admin only. A client identity may be minted with a bearer token, a client-certificate bundle, or both, per AuthMethods (empty defaults to mTLS-only, the strongest posture); admin identities always receive a token (the frontend logs in with it). Credentials are returned exactly once.

func (*Service) CreateNamespace 

func (s *Service) CreateNamespace(ctx context.Context, pr Principal, ref domain.NamespaceRef, description string, methods []domain.AuthMethod) (domain.Namespace, error)

CreateNamespace registers a namespace (env, app) with a description and the set of authentication methods that admit a client into it (default mTLS-only). Available to admins, or to identities granted admin:namespace:create on the namespace.

func (*Service) CreatePolicy 

func (s *Service) CreatePolicy(ctx context.Context, pr Principal, p domain.Policy) (domain.Policy, error)

CreatePolicy validates and stores a policy. Admin only.

func (*Service) CurrentRevision 

func (s *Service) CurrentRevision(ctx context.Context) (uint64, error)

CurrentRevision returns the latest change-log revision.

func (*Service) DeleteApplication added in v0.1.5 

func (s *Service) DeleteApplication(ctx context.Context, pr Principal, name string) error

func (*Service) DeleteNamespace 

func (s *Service) DeleteNamespace(ctx context.Context, pr Principal, ref domain.NamespaceRef) error

DeleteNamespace removes an empty namespace. Storage verifies emptiness (no parameters, secrets, or bound identities) and returns ErrFailedPrecondition otherwise. Available to admins, or to identities granted admin:namespace:delete on the namespace.

func (*Service) DeleteParameter 

func (s *Service) DeleteParameter(ctx context.Context, pr Principal, ref domain.Ref) (uint64, error)

DeleteParameter removes a parameter and all its versions.

func (*Service) DeletePolicy 

func (s *Service) DeletePolicy(ctx context.Context, pr Principal, name string) error

DeletePolicy removes a policy. Admin only.

func (*Service) DeleteSecret 

func (s *Service) DeleteSecret(ctx context.Context, pr Principal, ref domain.Ref) (uint64, error)

DeleteSecret removes a secret and all versions (ciphertext included).

func (*Service) DestroySecretVersion 

func (s *Service) DestroySecretVersion(ctx context.Context, pr Principal, ref domain.Ref, version uint64) (uint64, error)

DestroySecretVersion irreversibly destroys one version's ciphertext.

func (*Service) DisableSecret 

func (s *Service) DisableSecret(ctx context.Context, pr Principal, ref domain.Ref, version uint64, enable bool) (uint64, error)

DisableSecret disables (or re-enables) a version, or all versions when version is 0.

func (*Service) GetActiveConfigurationRelease 

func (s *Service) GetActiveConfigurationRelease(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string) (domain.ActiveConfigurationRelease, error)

func (*Service) GetApplication added in v0.1.5 

func (s *Service) GetApplication(ctx context.Context, pr Principal, name string) (domain.Application, error)

func (*Service) GetApplicationDashboard added in v0.1.5 

func (s *Service) GetApplicationDashboard(ctx context.Context, pr Principal, name string) (domain.ApplicationDashboard, error)

func (*Service) GetApplicationOverview added in v0.1.9 

func (s *Service) GetApplicationOverview(ctx context.Context, pr Principal, name string, opts OverviewOptions) (domain.ApplicationOverview, error)

GetApplicationOverview is the console's application read model (§3.2): per environment values, release, rollout and findings, plus the matrix rows.

func (*Service) GetConfigurationRelease 

func (s *Service) GetConfigurationRelease(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, version uint64) (domain.ConfigurationRelease, error)

func (*Service) GetConfigurationSchema 

func (s *Service) GetConfigurationSchema(ctx context.Context, pr Principal, id string, version uint64) (domain.ConfigurationSchema, error)

func (*Service) GetFleetOverview added in v0.1.9 

func (s *Service) GetFleetOverview(ctx context.Context, pr Principal, opts OverviewOptions) ([]domain.FleetApplication, error)

GetFleetOverview is the cheap fleet form: status per application and per environment without subscriber or pin re-validation detail.

func (*Service) GetParameter 

func (s *Service) GetParameter(ctx context.Context, pr Principal, ref domain.Ref, version uint64, label string) (domain.Parameter, error)

GetParameter resolves a parameter at a version (>0) or label ("" = current).

func (*Service) GetParameterInfo 

func (s *Service) GetParameterInfo(ctx context.Context, pr Principal, ref domain.Ref) (domain.ParameterInfo, error)

GetParameterInfo returns parameter metadata and version history.

func (*Service) GetReleaseRolloutSnapshot added in v0.1.9 

func (s *Service) GetReleaseRolloutSnapshot(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string) (domain.SubscriberStreamSnapshot, error)

GetReleaseRolloutSnapshot is one frame of the console's live rollout view: the folded rollout summary plus the raw subscriber rows for one release name. Admin-only, like ListReleaseSubscribers.

func (*Service) GetSecret 

func (s *Service) GetSecret(ctx context.Context, pr Principal, ref domain.Ref, version uint64, label string) (domain.SecretValue, error)

GetSecret decrypts and returns a secret value for an authorized machine caller. Per-secret access tokens, when set, are required — including for admins (the audited admin path is RevealSecret).

func (*Service) GetSecretInfo 

func (s *Service) GetSecretInfo(ctx context.Context, pr Principal, ref domain.Ref) (domain.Secret, error)

GetSecretInfo returns secret metadata and version history (no values).

func (*Service) IssueIdentityCertificate 

func (s *Service) IssueIdentityCertificate(ctx context.Context, pr Principal, name string, ttl time.Duration) (*CertBundle, error)

IssueIdentityCertificate mints an additional client certificate for an existing identity (renewal/rollover). Available to admins, or to identities granted admin:identity:cert (restricted to non-admin targets in the caller's own namespace; see guardCertTarget). The private key is returned exactly once.

func (*Service) ListApplications added in v0.1.5 

func (s *Service) ListApplications(ctx context.Context, pr Principal, page storage.ListPage) ([]domain.Application, string, error)

func (*Service) ListAuditEvents 

func (s *Service) ListAuditEvents(ctx context.Context, pr Principal, f domain.AuditFilter, page storage.ListPage) ([]domain.AuditEvent, string, error)

ListAuditEvents queries the audit log. Admin only (or the dedicated admin:audit:read operation, scoped to the filter's namespace).

func (*Service) ListConfigurationReleases 

func (s *Service) ListConfigurationReleases(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, page storage.ListPage) ([]domain.ConfigurationReleaseSummary, string, error)

func (*Service) ListConfigurationSchemas 

func (s *Service) ListConfigurationSchemas(ctx context.Context, pr Principal, id string, page storage.ListPage) ([]domain.ConfigurationSchema, string, error)

func (*Service) ListIdentities 

func (s *Service) ListIdentities(ctx context.Context, pr Principal, page storage.ListPage) ([]domain.Identity, string, error)

ListIdentities lists identities. Admin only.

func (*Service) ListKeyMetadata 

func (s *Service) ListKeyMetadata(ctx context.Context, pr Principal) ([]domain.KeyMetadata, error)

ListKeyMetadata returns KEK metadata (no key material). Admin only.

func (*Service) ListNamespaces 

func (s *Service) ListNamespaces(ctx context.Context, pr Principal, page storage.ListPage) ([]domain.Namespace, string, error)

ListNamespaces lists namespaces with their parameter/secret counts. Admins see all; other identities see only namespaces they can read or list into (via policy or the implicit home-namespace grant), so the namespace tree is not a recon surface for a narrowly-scoped client.

func (*Service) ListParameters 

func (s *Service) ListParameters(ctx context.Context, pr Principal, ns domain.NamespaceRef, keyPrefix string, page storage.ListPage) ([]domain.Parameter, string, error)

ListParameters lists current-labeled parameters in a namespace under a key prefix, filtered to what the principal may read.

func (*Service) ListPolicies 

func (s *Service) ListPolicies(ctx context.Context, pr Principal, page storage.ListPage) ([]domain.Policy, string, error)

ListPolicies lists policies. Admin only.

func (*Service) ListReleaseSubscribers 

func (s *Service) ListReleaseSubscribers(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, page storage.ListPage) ([]domain.ReleaseAcknowledgement, string, uint64, error)

func (*Service) ListSecrets 

func (s *Service) ListSecrets(ctx context.Context, pr Principal, ns domain.NamespaceRef, keyPrefix string, page storage.ListPage) ([]domain.Secret, string, error)

ListSecrets lists secret metadata in a namespace under a key prefix, filtered by policy.

func (*Service) ListSubscribers 

func (s *Service) ListSubscribers(ctx context.Context, pr Principal) ([]domain.Subscriber, uint64, error)

ListSubscribers returns the live watch registry. Admin only.

func (*Service) Logger 

func (s *Service) Logger() *zap.Logger

Logger returns the service logger.

func (*Service) PromoteSecretVersion 

func (s *Service) PromoteSecretVersion(ctx context.Context, pr Principal, ref domain.Ref, version uint64) (current, previous, revision uint64, err error)

PromoteSecretVersion points "current" at the given version.

func (*Service) PutApplicationParameter added in v0.1.5 

func (s *Service) PutApplicationParameter(ctx context.Context, pr Principal, app, key, value, contentType, metadata string, environments []string) ([]domain.ApplicationParameterWriteResult, error)

func (*Service) PutParameter 

func (s *Service) PutParameter(ctx context.Context, pr Principal, ref domain.Ref, value, contentType, metadata string) (version, revision uint64, err error)

PutParameter writes a new immutable version and moves the current label.

func (*Service) PutSecret 

func (s *Service) PutSecret(ctx context.Context, pr Principal, in PutSecretInput) (PutSecretResult, error)

PutSecret creates a secret or appends a new immutable version.

func (*Service) Ready 

func (s *Service) Ready(ctx context.Context) error

Ready reports whether the service can serve: store reachable and master key acquired + verified.

func (*Service) ReauthorizeReleaseWatch 

func (s *Service) ReauthorizeReleaseWatch(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string) error

func (*Service) ReauthorizeWatch 

func (s *Service) ReauthorizeWatch(ctx context.Context, pr Principal, namespaces ...domain.NamespaceRef) error

ReauthorizeWatch re-validates a live stream's credential and re-runs the full subscribe-time authorization for every subscribed namespace. The watch handler calls it on every heartbeat tick and closes the stream on error, so revocation takes effect within one heartbeat interval rather than waiting for a reconnect.

Credential re-check: for token streams it re-authenticates the bearer token itself, so rotating or revoking a token drops the stream (ErrUnauthenticated). For mTLS streams it re-checks that the identity is still enabled AND that the exact presenting certificate (serial plus fingerprint) is still enrolled and valid, so revoking a single cert drops the stream. Any transport that builds an mTLS Principal MUST populate Serial and Fingerprint; missing either fails reauthorization closed.

Authorization re-check: for each subscribed namespace it re-runs the same per-namespace method gate AND namespace-level policy check (home grant folded in) that AuthorizeSubscribe applies at subscribe time. So tightening a namespace's allowed methods, or revoking a client's explicit grant to a namespace, drops the stream on the next heartbeat (ErrPermissionDenied), while a home-namespace subscriber keeps its implicit grant across policy changes. This is namespace-level and cheap (one policy read plus a check per subscribed namespace per heartbeat), not the per-event predicate that was removed. Admins bypass method/policy restrictions, but still re-check that each context-bound namespace incarnation exists so a delete/recreate closes a stale stream. Callers that pass no namespaces get credential re-validation only.

func (*Service) ResetReleaseSubscriberConnections 

func (s *Service) ResetReleaseSubscriberConnections(ctx context.Context) error

ResetReleaseSubscriberConnections clears transport liveness left by an unclean prior server process. Lifecycle rows remain intact.

func (*Service) RevealSecret 

func (s *Service) RevealSecret(ctx context.Context, pr Principal, ref domain.Ref, version uint64, label string) (domain.SecretValue, error)

RevealSecret is the audited admin path used by the frontend/CLI. It bypasses the per-secret token gate (break-glass) but can never decrypt client-bound secrets — the server lacks the key material by design.

func (*Service) RevokeIdentity 

func (s *Service) RevokeIdentity(ctx context.Context, pr Principal, name string) error

RevokeIdentity disables an identity. Admin only. Disabling invalidates all of the identity's certificates (checked at mTLS auth time) and its token.

func (*Service) RevokeIdentityCertificate 

func (s *Service) RevokeIdentityCertificate(ctx context.Context, pr Principal, name, serial string) error

RevokeIdentityCertificate revokes a single certificate by serial. The serial must belong to the named identity. Available to admins, or to identities granted admin:identity:cert.

func (*Service) RollbackConfigurationRelease added in v0.1.9 

func (s *Service) RollbackConfigurationRelease(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, expectedCurrent *uint64) (domain.RollbackResult, error)

RollbackConfigurationRelease re-activates the previous release of a name, guarded by an optional expectation on the currently active version. It is authorized like activation and audited by activation's event classification (configuration_release.rollback).

func (*Service) RotateIdentityToken 

func (s *Service) RotateIdentityToken(ctx context.Context, pr Principal, name string) (string, error)

RotateIdentityToken replaces a token identity's bearer token. Admin only. The new token is returned exactly once. Cert-only identities (no existing token) are rejected: rotation replaces a token, it does not add one.

func (*Service) RotateKEK 

func (s *Service) RotateKEK(ctx context.Context, pr Principal, newKM domain.KeyMetadata, newMaterial []byte) (secretsRewrapped, caRewrapped int, err error)

RotateKEK rewraps every secret version and the built-in CA key under a fresh KEK derived from newMaterial (32 bytes). It is crash-safe: the metadata swap, the secret rewraps, and the CA rewrap commit in one storage transaction. Used by the rotate-kek CLI command. Admin only.

func (*Service) SetAuditEnabled 

func (s *Service) SetAuditEnabled(enabled bool)

SetAuditEnabled controls whether audit events are persisted. Auditing is on by default so non-server consumers retain the secure behavior unless they explicitly opt out through configuration.

func (*Service) SetHub 

func (s *Service) SetHub(h Hub)

SetHub attaches the watch hub.

func (*Service) SetKeyring 

func (s *Service) SetKeyring(k *crypto.Keyring)

SetKeyring attaches the verified keyring. The service becomes ready.

func (*Service) SetReleaseSubscriberConnected 

func (s *Service) SetReleaseSubscriberConnected(ctx context.Context, ns domain.NamespaceRef, name, clientName, instanceID, identity, connectionID string, connected bool) error

func (*Service) ShipApplicationChange added in v0.1.9 

func (s *Service) ShipApplicationChange(ctx context.Context, pr Principal, in domain.ShipInput) (domain.ShipResult, error)

ShipApplicationChange is the console's one-shot "write values, create a release, activate it" flow (§4). Preflight failures are returned as errors (4xx); every evaluated outcome is a ShipResult whose Status says what happened. Dry runs validate the candidate in memory and write nothing.

func (*Service) Store 

func (s *Service) Store() storage.Store

Store exposes the underlying store to trusted in-process consumers (watch hub snapshot/replay, CLI). Transport layers must not use it.

func (*Service) SubscribeReleaseSubscribers added in v0.1.9 

func (s *Service) SubscribeReleaseSubscribers(ns domain.NamespaceRef, name string) (<-chan struct{}, func())

SubscribeReleaseSubscribers wakes the returned channel whenever an acknowledgement, a connection change or an activation touches the release.

func (*Service) UpdateApplication added in v0.1.5 

func (s *Service) UpdateApplication(ctx context.Context, pr Principal, app domain.Application) (domain.Application, error)

func (*Service) UpdateNamespace 

func (s *Service) UpdateNamespace(ctx context.Context, pr Principal, ref domain.NamespaceRef, description string, methods []domain.AuthMethod) (domain.Namespace, error)

UpdateNamespace replaces a namespace's description and allowed auth-method set (full replace). Available to admins, or to identities granted admin:namespace:update on the namespace.

func (*Service) UpdatePolicy 

func (s *Service) UpdatePolicy(ctx context.Context, pr Principal, p domain.Policy) (domain.Policy, error)

UpdatePolicy replaces a policy by name. Admin only.

func (*Service) ValidateConfigurationRelease 

func (s *Service) ValidateConfigurationRelease(ctx context.Context, pr Principal, ns domain.NamespaceRef, name string, version uint64) ([]domain.ReleaseValidationError, error)

func (*Service) VerifyClientCert 

func (s *Service) VerifyClientCert(ctx context.Context, cert *x509.Certificate, remoteAddr, userAgent string) (domain.Identity, error)

VerifyClientCert maps a verified peer certificate to an identity for mTLS authentication. The TLS layer has already checked the chain against the configured client-CA pool; this method enforces the KMS-specific claims: exactly one kms://identity/<name> SAN, an exact fingerprint match to the enrolled non-revoked/non-expired certificate, and an enabled identity. Failures are generic and audited.

func (*Service) Version 

func (s *Service) Version() string

Version returns the build version string.

func (*Service) WhoAmI 

func (s *Service) WhoAmI(_ context.Context, pr Principal) (WhoAmIResult, error)

WhoAmI returns the caller's identity description. Callable by any authenticated identity with no policy check; it is the SDK's namespace-discovery mechanism.

type WhoAmIResult 

type WhoAmIResult struct {
	Name      string
	Kind      string
	Namespace *domain.NamespaceRef
	Method    domain.AuthMethod
}

WhoAmIResult is the identity self-description returned by WhoAmI. It is the SDK's namespace-discovery mechanism.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.