cred_registry

package
v0.0.0-...-dfb39b5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// DefaultTokenLifetime is the default JWT assertion lifetime
	DefaultTokenLifetime = time.Hour
)
View Source 
const (
	// OAuth2TokenRefreshBuffer is the time before expiry when token refresh should occur
	OAuth2TokenRefreshBuffer = 5 * time.Minute
)
View Source 
const (
	// RefreshCheckInterval is how often the refresher checks for expiring tokens
	RefreshCheckInterval = 1 * time.Minute
)

Variables

This section is empty.

Functions

func Default 

func Default() *registry

Default returns the default registry instance

func New 

func New(store dalConnectionStore, logger *zap.Logger) (*registry, error)

func SetDefault 

func SetDefault(reg *registry)

SetDefault sets the default registry instance

Types

type APIKeyCredential 

type APIKeyCredential struct {
	Key string
	// default: X-API-Key
	HeaderName string
	// optional prefix
	Prefix string
	// contains filtered or unexported fields
}

APIKeyCredential holds a static API key.

func NewAPIKeyCredential 

func NewAPIKeyCredential(connID uint64, key, headerName, prefix string) *APIKeyCredential

func (*APIKeyCredential) AuthType 

func (c *APIKeyCredential) AuthType() string

func (*APIKeyCredential) ConnectionID 

func (c *APIKeyCredential) ConnectionID() uint64

func (*APIKeyCredential) GetAccessToken 

func (c *APIKeyCredential) GetAccessToken() string

func (*APIKeyCredential) MarshalState 

func (c *APIKeyCredential) MarshalState() map[string]any

func (*APIKeyCredential) NeedsRefresh 

func (c *APIKeyCredential) NeedsRefresh() bool

func (*APIKeyCredential) Refresh 

func (c *APIKeyCredential) Refresh(_ context.Context, _ *http.Client) error

type BearerCredential 

type BearerCredential struct {
	Token string
	// contains filtered or unexported fields
}

BearerCredential holds a static bearer token.

func NewBearerCredential 

func NewBearerCredential(connID uint64, token string) *BearerCredential

func (*BearerCredential) AuthType 

func (c *BearerCredential) AuthType() string

func (*BearerCredential) ConnectionID 

func (c *BearerCredential) ConnectionID() uint64

func (*BearerCredential) GetAccessToken 

func (c *BearerCredential) GetAccessToken() string

func (*BearerCredential) MarshalState 

func (c *BearerCredential) MarshalState() map[string]any

func (*BearerCredential) NeedsRefresh 

func (c *BearerCredential) NeedsRefresh() bool

func (*BearerCredential) Refresh 

func (c *BearerCredential) Refresh(_ context.Context, _ *http.Client) error

type Credential 

type Credential interface {
	ConnectionID() uint64
	AuthType() string
	GetAccessToken() string
	NeedsRefresh() bool
	Refresh(ctx context.Context, client *http.Client) error
	MarshalState() map[string]any
}

Credential defines the interface for all credential types. Each auth method implements its own refresh and state management.

func NewCredential 

func NewCredential(cfg CredentialConfig) (Credential, error)

NewCredential constructs the appropriate Credential implementation based on the auth type specified in the config.

type CredentialConfig 

type CredentialConfig struct {
	ConnectionID uint64
	AuthType     string
	Token        string
	APIKey       string
	ClientID     string
	ClientSecret string
	TokenURL     string

	// JWT bearer fields
	Issuer        string
	Subject       string
	Audience      string
	Scopes        []string
	PrivateKey    string
	TokenLifetime time.Duration

	// Google service account fields
	ServiceAccountEmail string
}

CredentialConfig holds the parameters needed to construct a Credential.

type GoogleServiceAccountCredential 

type GoogleServiceAccountCredential struct {
	*JWTBearerCredential
}

GoogleServiceAccountCredential wraps JWTBearerCredential with Google-specific defaults (token URL, audience, default scopes).

func NewGoogleServiceAccountCredential 

func NewGoogleServiceAccountCredential(connID uint64, serviceAccountEmail, privateKey, subject string, scopes []string, tokenLifetime time.Duration) *GoogleServiceAccountCredential

func (*GoogleServiceAccountCredential) AuthType 

func (c *GoogleServiceAccountCredential) AuthType() string

func (*GoogleServiceAccountCredential) ConnectionID 

func (c *GoogleServiceAccountCredential) ConnectionID() uint64

func (*GoogleServiceAccountCredential) GetAccessToken 

func (c *GoogleServiceAccountCredential) GetAccessToken() string

func (*GoogleServiceAccountCredential) MarshalState 

func (c *GoogleServiceAccountCredential) MarshalState() map[string]any

func (*GoogleServiceAccountCredential) NeedsRefresh 

func (c *GoogleServiceAccountCredential) NeedsRefresh() bool

func (*GoogleServiceAccountCredential) Refresh 

func (c *GoogleServiceAccountCredential) Refresh(ctx context.Context, client *http.Client) error

type JWTBearerCredential 

type JWTBearerCredential struct {

	// Static config
	Issuer        string        // JWT "iss" claim (e.g. service account email)
	Subject       string        // JWT "sub" claim (optional, for domain-wide delegation)
	Audience      string        // JWT "aud" claim (token endpoint URL)
	Scopes        []string      // space-joined into JWT "scope" claim
	PrivateKey    string        // PEM-encoded RSA private key
	TokenURL      string        // token endpoint
	TokenLifetime time.Duration // JWT assertion lifetime (default: 1h)

	// Mutable runtime state
	AccessToken string
	ExpiresAt   time.Time
	// contains filtered or unexported fields
}

JWTBearerCredential handles the JWT bearer assertion grant (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer).

Works with any provider that accepts a signed JWT assertion (e.g. Google service accounts, Azure AD, custom IdPs).

func NewJWTBearerCredential 

func NewJWTBearerCredential(connID uint64, issuer, subject, audience, tokenURL, privateKey string, scopes []string, tokenLifetime time.Duration) *JWTBearerCredential

func (*JWTBearerCredential) AuthType 

func (c *JWTBearerCredential) AuthType() string

func (*JWTBearerCredential) ConnectionID 

func (c *JWTBearerCredential) ConnectionID() uint64

func (*JWTBearerCredential) GetAccessToken 

func (c *JWTBearerCredential) GetAccessToken() string

func (*JWTBearerCredential) MarshalState 

func (c *JWTBearerCredential) MarshalState() map[string]any

func (*JWTBearerCredential) NeedsRefresh 

func (c *JWTBearerCredential) NeedsRefresh() bool

func (*JWTBearerCredential) Refresh 

func (c *JWTBearerCredential) Refresh(ctx context.Context, client *http.Client) error

type OAuth2ClientCredsCredential 

type OAuth2ClientCredsCredential struct {
	ClientID     string
	ClientSecret string
	TokenURL     string

	// Mutable runtime state
	AccessToken string
	ExpiresAt   time.Time
	// contains filtered or unexported fields
}

OAuth2ClientCredsCredential handles OAuth2 client credentials grant.

func NewOAuth2ClientCredsCredential 

func NewOAuth2ClientCredsCredential(connID uint64, clientID, clientSecret, tokenURL string) *OAuth2ClientCredsCredential

func (*OAuth2ClientCredsCredential) AuthType 

func (c *OAuth2ClientCredsCredential) AuthType() string

func (*OAuth2ClientCredsCredential) ConnectionID 

func (c *OAuth2ClientCredsCredential) ConnectionID() uint64

func (*OAuth2ClientCredsCredential) GetAccessToken 

func (c *OAuth2ClientCredsCredential) GetAccessToken() string

func (*OAuth2ClientCredsCredential) MarshalState 

func (c *OAuth2ClientCredsCredential) MarshalState() map[string]any

func (*OAuth2ClientCredsCredential) NeedsRefresh 

func (c *OAuth2ClientCredsCredential) NeedsRefresh() bool

func (*OAuth2ClientCredsCredential) Refresh 

func (c *OAuth2ClientCredsCredential) Refresh(ctx context.Context, client *http.Client) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.