userpat

Documentation

Index

• type AuditRecordRepository
• type Config
  • func (c Config) DeniedPermissionsSet() map[string]struct{}
  • func (c Config) MaxExpiry() time.Duration
• type CreateRequest
• type OrganizationService
• type PolicyService
• type Repository
• type RoleService
• type Service
  • func NewService(logger log.Logger, repo Repository, config Config, ...) *Service
  • func (s *Service) Create(ctx context.Context, req CreateRequest) (patmodels.PAT, string, error)
  • func (s *Service) GetByID(ctx context.Context, id string) (patmodels.PAT, error)
  • func (s *Service) ValidateExpiry(expiresAt time.Time) error
• type Validator
  • func NewValidator(logger log.Logger, repo Repository, config Config) *Validator
  • func (v *Validator) Validate(ctx context.Context, value string) (models.PAT, error)

Types

type AuditRecordRepository

type AuditRecordRepository interface {
	Create(ctx context.Context, auditRecord models.AuditRecord) (models.AuditRecord, error)
}

type Config

type Config struct {
	Enabled           bool     `yaml:"enabled" mapstructure:"enabled" default:"false"`
	Prefix            string   `yaml:"prefix" mapstructure:"prefix" default:"fpt"`
	MaxPerUserPerOrg  int64    `yaml:"max_per_user_per_org" mapstructure:"max_per_user_per_org" default:"50"`
	MaxLifetime       string   `yaml:"max_lifetime" mapstructure:"max_lifetime" default:"8760h"`
	DefaultLifetime   string   `yaml:"default_lifetime" mapstructure:"default_lifetime" default:"2160h"`
	DeniedPermissions []string `yaml:"denied_permissions" mapstructure:"denied_permissions"`
}

func (Config) DeniedPermissionsSet

func (c Config) DeniedPermissionsSet() map[string]struct{}

DeniedPermissionsSet returns denied permissions as a set for efficient lookups.

func (Config) MaxExpiry

func (c Config) MaxExpiry() time.Duration

type CreateRequest

type CreateRequest struct {
	UserID     string
	OrgID      string
	Title      string
	RoleIDs    []string
	ProjectIDs []string
	ExpiresAt  time.Time
	Metadata   map[string]any
}

type OrganizationService

type OrganizationService interface {
	GetRaw(ctx context.Context, id string) (organization.Organization, error)
}

type PolicyService

type PolicyService interface {
	Create(ctx context.Context, pol policy.Policy) (policy.Policy, error)
}

type Repository

type Repository interface {
	Create(ctx context.Context, pat models.PAT) (models.PAT, error)
	CountActive(ctx context.Context, userID, orgID string) (int64, error)
	GetByID(ctx context.Context, id string) (models.PAT, error)
	GetBySecretHash(ctx context.Context, secretHash string) (models.PAT, error)
	UpdateLastUsedAt(ctx context.Context, id string, at time.Time) error
}

type RoleService

type RoleService interface {
	Get(ctx context.Context, id string) (role.Role, error)
	List(ctx context.Context, f role.Filter) ([]role.Role, error)
}

type Service

type Service struct {
	// contains filtered or unexported fields
}

func NewService

func NewService(logger log.Logger, repo Repository, config Config, orgService OrganizationService,
	roleService RoleService, policyService PolicyService, auditRecordRepository AuditRecordRepository) *Service

func (*Service) Create

func (s *Service) Create(ctx context.Context, req CreateRequest) (patmodels.PAT, string, error)

Create generates a new PAT and returns it with the plaintext value. The plaintext value is only available at creation time.

func (*Service) GetByID

func (s *Service) GetByID(ctx context.Context, id string) (patmodels.PAT, error)

func (*Service) ValidateExpiry

func (s *Service) ValidateExpiry(expiresAt time.Time) error

ValidateExpiry checks that the given expiry time is in the future and within the configured maximum PAT lifetime.

type Validator

type Validator struct {
	// contains filtered or unexported fields
}

Validator validates PAT values during authentication.

func NewValidator

func NewValidator(logger log.Logger, repo Repository, config Config) *Validator

func (*Validator) Validate

func (v *Validator) Validate(ctx context.Context, value string) (models.PAT, error)

Validate checks a PAT value and returns the corresponding PAT. Returns ErrInvalidPAT if the value doesn't match the configured prefix (allowing the auth chain to fall through to the next authenticator). Returns ErrMalformedPAT, ErrExpired, ErrNotFound, or ErrDisabled for terminal auth failures.