providers

Documentation

Index

• type ConfigColumnSecurityProvider
  • func NewConfigColumnSecurityProvider(rules map[string][]sectypes.ColumnSecurity) *ConfigColumnSecurityProvider
  • func (p *ConfigColumnSecurityProvider) GetColumnSecurity(ctx context.Context, userID int, schema, table string) ([]sectypes.ColumnSecurity, error)
• type ConfigKeyStore
  • func NewConfigKeyStore(keys []sectypes.UserKey) *ConfigKeyStore
  • func (s *ConfigKeyStore) CreateKey(_ context.Context, req sectypes.CreateKeyRequest) (*sectypes.CreateKeyResponse, error)
  • func (s *ConfigKeyStore) DeleteKey(_ context.Context, userID int, keyID int64) error
  • func (s *ConfigKeyStore) GetUserKeys(_ context.Context, userID int, keyType sectypes.KeyType) ([]sectypes.UserKey, error)
  • func (s *ConfigKeyStore) ValidateKey(_ context.Context, rawKey string, keyType sectypes.KeyType) (*sectypes.UserKey, error)
• type ConfigRowSecurityProvider
  • func NewConfigRowSecurityProvider(templates map[string]string, blocked map[string]bool) *ConfigRowSecurityProvider
  • func (p *ConfigRowSecurityProvider) GetRowSecurity(ctx context.Context, userRef any, schema, table string) (sectypes.RowSecurity, error)
• type HeaderAuthenticator
  • func NewHeaderAuthenticator() *HeaderAuthenticator
  • func (a *HeaderAuthenticator) Authenticate(r *http.Request) (*sectypes.UserContext, error)
  • func (a *HeaderAuthenticator) Login(ctx context.Context, req sectypes.LoginRequest) (*sectypes.LoginResponse, error)
  • func (a *HeaderAuthenticator) LoginWithCookie(ctx context.Context, req sectypes.LoginRequest, w http.ResponseWriter) (*sectypes.LoginResponse, error)
  • func (a *HeaderAuthenticator) Logout(ctx context.Context, req sectypes.LogoutRequest) error
  • func (a *HeaderAuthenticator) LogoutWithCookie(ctx context.Context, req sectypes.LogoutRequest, w http.ResponseWriter) error
• type KeyStoreAuthenticator
  • func NewKeyStoreAuthenticator(ks security.KeyStore, keyType sectypes.KeyType) *KeyStoreAuthenticator
  • func (a *KeyStoreAuthenticator) Authenticate(r *http.Request) (*sectypes.UserContext, error)
  • func (a *KeyStoreAuthenticator) Login(_ context.Context, _ sectypes.LoginRequest) (*sectypes.LoginResponse, error)
  • func (a *KeyStoreAuthenticator) LoginWithCookie(_ context.Context, _ sectypes.LoginRequest, _ http.ResponseWriter) (*sectypes.LoginResponse, error)
  • func (a *KeyStoreAuthenticator) Logout(_ context.Context, _ sectypes.LogoutRequest) error
  • func (a *KeyStoreAuthenticator) LogoutWithCookie(_ context.Context, _ sectypes.LogoutRequest, _ http.ResponseWriter) error
  • func (a *KeyStoreAuthenticator) SetAuthenticateCallback(fn func(r *http.Request) (*sectypes.UserContext, error))

Types

type ConfigColumnSecurityProvider

type ConfigColumnSecurityProvider struct {
	// contains filtered or unexported fields
}

ConfigColumnSecurityProvider provides static column security configuration

func NewConfigColumnSecurityProvider

func NewConfigColumnSecurityProvider(rules map[string][]sectypes.ColumnSecurity) *ConfigColumnSecurityProvider

func (*ConfigColumnSecurityProvider) GetColumnSecurity

func (p *ConfigColumnSecurityProvider) GetColumnSecurity(ctx context.Context, userID int, schema, table string) ([]sectypes.ColumnSecurity, error)

type ConfigKeyStore

type ConfigKeyStore struct {
	// contains filtered or unexported fields
}

ConfigKeyStore is an in-memory keystore backed by a static slice of UserKey values. It is designed for config-file driven setups (e.g. service accounts defined in YAML) with a small, bounded number of keys. For large or dynamic key sets use DatabaseKeyStore.

Pre-existing entries must have KeyHash set to the SHA-256 hex of the intended raw key. Keys created at runtime via CreateKey are held in memory only and lost on restart.

func NewConfigKeyStore

func NewConfigKeyStore(keys []sectypes.UserKey) *ConfigKeyStore

NewConfigKeyStore creates a ConfigKeyStore seeded with the provided keys. Pass nil or an empty slice to start with no pre-loaded keys. Zero-value entries (CreatedAt is zero) are treated as active and assigned the current time.

func (*ConfigKeyStore) CreateKey

func (s *ConfigKeyStore) CreateKey(_ context.Context, req sectypes.CreateKeyRequest) (*sectypes.CreateKeyResponse, error)

CreateKey generates a new raw key, stores its SHA-256 hash, and returns the raw key once.

func (*ConfigKeyStore) DeleteKey

func (s *ConfigKeyStore) DeleteKey(_ context.Context, userID int, keyID int64) error

DeleteKey soft-deletes a key by setting IsActive to false after ownership verification.

func (*ConfigKeyStore) GetUserKeys

func (s *ConfigKeyStore) GetUserKeys(_ context.Context, userID int, keyType sectypes.KeyType) ([]sectypes.UserKey, error)

GetUserKeys returns all active, non-expired keys for the given user. Pass an empty KeyType to return all types.

func (*ConfigKeyStore) ValidateKey

func (s *ConfigKeyStore) ValidateKey(_ context.Context, rawKey string, keyType sectypes.KeyType) (*sectypes.UserKey, error)

ValidateKey hashes the raw key and finds a matching, active, non-expired entry. Uses constant-time comparison to prevent timing side-channels. Pass an empty KeyType to accept any type.

type ConfigRowSecurityProvider

type ConfigRowSecurityProvider struct {
	// contains filtered or unexported fields
}

ConfigRowSecurityProvider provides static row security configuration

func NewConfigRowSecurityProvider

func NewConfigRowSecurityProvider(templates map[string]string, blocked map[string]bool) *ConfigRowSecurityProvider

func (*ConfigRowSecurityProvider) GetRowSecurity

func (p *ConfigRowSecurityProvider) GetRowSecurity(ctx context.Context, userRef any, schema, table string) (sectypes.RowSecurity, error)

type HeaderAuthenticator

type HeaderAuthenticator struct{}

HeaderAuthenticator provides simple header-based authentication Expects: X-User-ID, X-User-Name, X-User-Level, X-Session-ID, X-Remote-ID, X-User-Roles, X-User-Email

func NewHeaderAuthenticator

func NewHeaderAuthenticator() *HeaderAuthenticator

func (*HeaderAuthenticator) Authenticate

func (a *HeaderAuthenticator) Authenticate(r *http.Request) (*sectypes.UserContext, error)

func (*HeaderAuthenticator) Login

func (a *HeaderAuthenticator) Login(ctx context.Context, req sectypes.LoginRequest) (*sectypes.LoginResponse, error)

func (*HeaderAuthenticator) LoginWithCookie

func (a *HeaderAuthenticator) LoginWithCookie(ctx context.Context, req sectypes.LoginRequest, w http.ResponseWriter) (*sectypes.LoginResponse, error)

func (*HeaderAuthenticator) Logout

func (a *HeaderAuthenticator) Logout(ctx context.Context, req sectypes.LogoutRequest) error

func (*HeaderAuthenticator) LogoutWithCookie

func (a *HeaderAuthenticator) LogoutWithCookie(ctx context.Context, req sectypes.LogoutRequest, w http.ResponseWriter) error

type KeyStoreAuthenticator

type KeyStoreAuthenticator struct {
	// contains filtered or unexported fields
}

KeyStoreAuthenticator implements the Authenticator interface using a KeyStore. It is suitable for long-lived application credentials (API keys, JWT secrets, etc.) rather than interactive sessions. Login and Logout are not supported — key lifecycle is managed directly through the KeyStore.

Key extraction order:

1. Authorization: Bearer <key>
2. Authorization: ApiKey <key>
3. X-API-Key header

func NewKeyStoreAuthenticator

func NewKeyStoreAuthenticator(ks security.KeyStore, keyType sectypes.KeyType) *KeyStoreAuthenticator

NewKeyStoreAuthenticator creates a KeyStoreAuthenticator. Pass an empty keyType to accept keys of any type.

func (*KeyStoreAuthenticator) Authenticate

func (a *KeyStoreAuthenticator) Authenticate(r *http.Request) (*sectypes.UserContext, error)

Authenticate extracts an API key from the request and validates it against the KeyStore. Returns a UserContext built from the matching UserKey on success.

func (*KeyStoreAuthenticator) Login

func (a *KeyStoreAuthenticator) Login(_ context.Context, _ sectypes.LoginRequest) (*sectypes.LoginResponse, error)

Login is not supported for keystore authentication.

func (*KeyStoreAuthenticator) LoginWithCookie

func (a *KeyStoreAuthenticator) LoginWithCookie(_ context.Context, _ sectypes.LoginRequest, _ http.ResponseWriter) (*sectypes.LoginResponse, error)

LoginWithCookie is not supported for keystore authentication.

func (*KeyStoreAuthenticator) Logout

func (a *KeyStoreAuthenticator) Logout(_ context.Context, _ sectypes.LogoutRequest) error

Logout is not supported for keystore authentication.

func (*KeyStoreAuthenticator) LogoutWithCookie

func (a *KeyStoreAuthenticator) LogoutWithCookie(_ context.Context, _ sectypes.LogoutRequest, _ http.ResponseWriter) error

LogoutWithCookie is not supported for keystore authentication.

func (*KeyStoreAuthenticator) SetAuthenticateCallback

func (a *KeyStoreAuthenticator) SetAuthenticateCallback(fn func(r *http.Request) (*sectypes.UserContext, error))

SetAuthenticateCallback registers a fallback called when key authentication fails.