userpat

Documentation

Index

• type AuditRecordRepository
• type Config
  • func (c Config) DeniedPermissionsSet() map[string]struct{}
  • func (c Config) MaxExpiry() time.Duration
• type CreateRequest
• type OrganizationService
• type PolicyService
• type Repository
• type RoleService
• type Service
  • func NewService(logger log.Logger, repo Repository, config Config, ...) *Service
  • func (s *Service) Create(ctx context.Context, req CreateRequest) (patmodels.PAT, string, error)
  • func (s *Service) Delete(ctx context.Context, userID, id string) error
  • func (s *Service) Get(ctx context.Context, userID, id string) (patmodels.PAT, error)
  • func (s *Service) GetByID(ctx context.Context, id string) (patmodels.PAT, error)
  • func (s *Service) IsTitleAvailable(ctx context.Context, userID, orgID, title string) (bool, error)
  • func (s *Service) List(ctx context.Context, userID, orgID string, query *rql.Query) (patmodels.PATList, error)
  • func (s *Service) ListAllowedRoles(ctx context.Context, scopes []string) ([]role.Role, error)
  • func (s *Service) Regenerate(ctx context.Context, userID, id string, newExpiresAt time.Time) (patmodels.PAT, string, error)
  • func (s *Service) Update(ctx context.Context, toUpdate patmodels.PAT) (patmodels.PAT, error)
  • func (s *Service) ValidateExpiry(expiresAt time.Time) error
• type Validator
  • func NewValidator(logger log.Logger, repo Repository, config Config) *Validator
  • func (v *Validator) Validate(ctx context.Context, value string) (models.PAT, error)

Types

type AuditRecordRepository

type AuditRecordRepository interface {
	Create(ctx context.Context, auditRecord models.AuditRecord) (models.AuditRecord, error)
}

type Config

type Config struct {
	Enabled           bool     `yaml:"enabled" mapstructure:"enabled" default:"false"`
	Prefix            string   `yaml:"prefix" mapstructure:"prefix" default:"fpt"`
	MaxPerUserPerOrg  int64    `yaml:"max_per_user_per_org" mapstructure:"max_per_user_per_org" default:"50"`
	MaxLifetime       string   `yaml:"max_lifetime" mapstructure:"max_lifetime" default:"8760h"`
	DefaultLifetime   string   `yaml:"default_lifetime" mapstructure:"default_lifetime" default:"2160h"`
	DeniedPermissions []string `yaml:"denied_permissions" mapstructure:"denied_permissions"`
}

func (Config) DeniedPermissionsSet

func (c Config) DeniedPermissionsSet() map[string]struct{}

DeniedPermissionsSet returns denied permissions as a set for efficient lookups.

func (Config) MaxExpiry

func (c Config) MaxExpiry() time.Duration

type CreateRequest

type CreateRequest struct {
	UserID     string
	OrgID      string
	Title      string
	RoleIDs    []string
	ProjectIDs []string
	ExpiresAt  time.Time
	Metadata   map[string]any
}

type OrganizationService

type OrganizationService interface {
	GetRaw(ctx context.Context, id string) (organization.Organization, error)
}

type PolicyService

type PolicyService interface {
	Create(ctx context.Context, pol policy.Policy) (policy.Policy, error)
	List(ctx context.Context, flt policy.Filter) ([]policy.Policy, error)
	Delete(ctx context.Context, id string) error
}

type Repository

type Repository interface {
	Create(ctx context.Context, pat models.PAT) (models.PAT, error)
	CountActive(ctx context.Context, userID, orgID string) (int64, error)
	GetByID(ctx context.Context, id string) (models.PAT, error)
	List(ctx context.Context, userID, orgID string, query *rql.Query) (models.PATList, error)
	GetBySecretHash(ctx context.Context, secretHash string) (models.PAT, error)
	IsTitleAvailable(ctx context.Context, userID, orgID, title string) (bool, error)
	UpdateLastUsedAt(ctx context.Context, id string, at time.Time) error
	Update(ctx context.Context, pat models.PAT) (models.PAT, error)
	Regenerate(ctx context.Context, id, secretHash string, expiresAt time.Time) (models.PAT, error)
	Delete(ctx context.Context, id string) error
}

type RoleService

type RoleService interface {
	Get(ctx context.Context, id string) (role.Role, error)
	List(ctx context.Context, f role.Filter) ([]role.Role, error)
}

type Service

type Service struct {
	// contains filtered or unexported fields
}

func NewService

func NewService(logger log.Logger, repo Repository, config Config, orgService OrganizationService,
	roleService RoleService, policyService PolicyService, auditRecordRepository AuditRecordRepository) *Service

func (*Service) Create

func (s *Service) Create(ctx context.Context, req CreateRequest) (patmodels.PAT, string, error)

Create generates a new PAT and returns it with the plaintext value. The plaintext value is only available at creation time.

func (*Service) Delete

func (s *Service) Delete(ctx context.Context, userID, id string) error

Delete soft-deletes the PAT first, then removes its SpiceDB policies. Soft-delete before policy cleanup prevents concurrent Update from re-creating policies for a deleted PAT (TOCTOU mitigation).

func (*Service) Get

func (s *Service) Get(ctx context.Context, userID, id string) (patmodels.PAT, error)

Get retrieves a PAT by ID, verifying it belongs to the given user. Returns ErrDisabled if PATs are not enabled, ErrNotFound if the PAT does not exist or belongs to a different user.

func (*Service) GetByID

func (s *Service) GetByID(ctx context.Context, id string) (patmodels.PAT, error)

func (*Service) IsTitleAvailable

func (s *Service) IsTitleAvailable(ctx context.Context, userID, orgID, title string) (bool, error)

IsTitleAvailable checks if a PAT title is available for the given user and org.

func (*Service) List

func (s *Service) List(ctx context.Context, userID, orgID string, query *rql.Query) (patmodels.PATList, error)

List retrieves all PATs for a user in an org and enriches each with scope fields.

func (*Service) ListAllowedRoles

func (s *Service) ListAllowedRoles(ctx context.Context, scopes []string) ([]role.Role, error)

ListAllowedRoles returns predefined roles that are valid for PAT assignment. It lists platform roles filtered by scopes and removes any role containing a denied permission. If scopes is empty, defaults to org + project scopes. Accepts short aliases (e.g. "project", "org") which are normalized to full namespace form (e.g. "app/project", "app/organization").

func (*Service) Regenerate

func (s *Service) Regenerate(ctx context.Context, userID, id string, newExpiresAt time.Time) (patmodels.PAT, string, error)

Regenerate creates a new secret and updates the expiry for an existing PAT. Scope (roles + projects) and policies are preserved. Expired PATs can be regenerated; if reviving one, checks the active count limit.

func (*Service) Update

func (s *Service) Update(ctx context.Context, toUpdate patmodels.PAT) (patmodels.PAT, error)

Update replaces a PAT's title, metadata, and scope (roles + projects). Scope changes use revoke-all + recreate pattern with a TOCTOU guard against concurrent Delete.

func (*Service) ValidateExpiry

func (s *Service) ValidateExpiry(expiresAt time.Time) error

ValidateExpiry checks that the given expiry time is in the future and within the configured maximum PAT lifetime.

type Validator

type Validator struct {
	// contains filtered or unexported fields
}

Validator validates PAT values during authentication.

func NewValidator

func NewValidator(logger log.Logger, repo Repository, config Config) *Validator

func (*Validator) Validate

func (v *Validator) Validate(ctx context.Context, value string) (models.PAT, error)

Validate checks a PAT value and returns the corresponding PAT. Returns ErrInvalidPAT if the value doesn't match the configured prefix (allowing the auth chain to fall through to the next authenticator). Returns ErrMalformedPAT, ErrExpired, ErrNotFound, or ErrDisabled for terminal auth failures.