acls

Documentation

Overview

Package acls is the main library used by cloud services to authenticate clients and check that they have access to named resources.

Index

• Constants
• Variables
• type AuthService
  • func NewAuthService(ctx context.Context, params *cloudconfig.Params) (*AuthService, error)
  • func (s *AuthService) ExtendToken(ctx context.Context, req *pb.ExtendTokenRequest) (*pb.ExtendTokenResponse, error)
• type DeviceAccessToken
  • func (dat *DeviceAccessToken) Expiration() time.Time
  • func (dat *DeviceAccessToken) Proto() *pb.DeviceAccessToken
  • func (dat *DeviceAccessToken) UserID() string
• type DeviceTokenVerifier
  • func NewDeviceTokenVerifier(params *cloudconfig.Params) *DeviceTokenVerifier
  • func (dtv *DeviceTokenVerifier) Verify(token TokenString) (*DeviceAccessToken, error)
• type Identity
  • func FixmeMainHardcodedIdentity() *Identity
  • func (i *Identity) ID() string
  • func (i *Identity) String() string
• type Service
  • func NewService(params *cloudconfig.Params) *Service
  • func (s *Service) IdentityFromContext(ctx context.Context) (*Identity, error)
• type TokenString

Constants

const DeviceAccessTokenMetadataKey = "heatpump-device-access-token"

DeviceAccessTokenMetadataKey is the gRPC metadata key used to provide a device access token identity secret to the server.

Variables

var (

	// ClientCACertPool is the certificate pool that should be used by gRPC
	// services as the tls.Config.ClientCAs attribute for authenticating
	// clients.
	//
	// The certificate embedded in this package was generated using the
	// generate_client_cert_signer.sh script.
	ClientCACertPool = must.Compute(func() (*x509.CertPool, error) {
		pool := x509.NewCertPool()
		if !pool.AppendCertsFromPEM(clientSignerCertAuthorityCertData) {
			return nil, fmt.Errorf("invalid client certificate")
		}
		return pool, nil
	})
)

Types

type AuthService

type AuthService struct {
	pb.UnimplementedAuthServiceServer
	// contains filtered or unexported fields
}

func NewAuthService

func NewAuthService(ctx context.Context, params *cloudconfig.Params) (*AuthService, error)

func (*AuthService) ExtendToken

func (s *AuthService) ExtendToken(ctx context.Context, req *pb.ExtendTokenRequest) (*pb.ExtendTokenResponse, error)

type DeviceAccessToken

type DeviceAccessToken struct {
	// contains filtered or unexported fields
}

DeviceAccessToken wraps the proto by the same name.

func (*DeviceAccessToken) Expiration

func (dat *DeviceAccessToken) Expiration() time.Time

func (*DeviceAccessToken) Proto

func (dat *DeviceAccessToken) Proto() *pb.DeviceAccessToken

func (*DeviceAccessToken) UserID

func (dat *DeviceAccessToken) UserID() string

type DeviceTokenVerifier

type DeviceTokenVerifier struct {
	// contains filtered or unexported fields
}

DeviceTokenVerifier verifies device access tokens sent by an IoT device.

func NewDeviceTokenVerifier

func NewDeviceTokenVerifier(params *cloudconfig.Params) *DeviceTokenVerifier

func (*DeviceTokenVerifier) Verify

func (dtv *DeviceTokenVerifier) Verify(token TokenString) (*DeviceAccessToken, error)

type Identity

type Identity struct {
	// contains filtered or unexported fields
}

Identity is information about a user or robot account.

func FixmeMainHardcodedIdentity

func FixmeMainHardcodedIdentity() *Identity

func (*Identity) ID

func (i *Identity) ID() string

ID returns a id of the user.

func (*Identity) String

func (i *Identity) String() string

String returns a debug representation of the identity.

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service is the service responsible for getting identity information about a client like an IoT device.

func NewService

func NewService(params *cloudconfig.Params) *Service

NewService loads a new identity service.

func (*Service) IdentityFromContext

func (s *Service) IdentityFromContext(ctx context.Context) (*Identity, error)

IdentityFromContext returns an Identity instance

type TokenString

type TokenString string

TokenString is a base32-encoded DeviceAccessToken proto. This is delievered to the client as an opaque string and so should not contain private data. It is sent in the metadata fields of gRPC requests to authenticate a client.