egressauth

package
v0.7.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 22, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	CredentialSourceStorageKindEncryptedPG    = "encrypted_pg"
	CredentialSourceStorageKindHashiCorpVault = "hashicorp_vault"
	CredentialSourceStorageKindExternalRef    = "external_ref"
	CredentialSourceStorageKindPlaintextPG    = "plaintext_pg"

	CredentialSourceExternalProviderHashiCorpVault = "hashicorp_vault"
)

Variables

View Source 
var ErrCredentialSourceInUse = errors.New("credential source is in use")

Functions

func NormalizeAES256Key added in v0.5.2 

func NormalizeAES256Key(raw []byte) ([]byte, error)

NormalizeAES256Key accepts raw, base64, or hex-encoded 32-byte keys.

func RunMigrations 

func RunMigrations(ctx context.Context, pool *pgxpool.Pool, logger Logger) error

RunMigrations ensures the auth-store schema exists.

Types

type AESGCMCodec added in v0.5.2 

type AESGCMCodec struct {
	// contains filtered or unexported fields
}

AESGCMCodec stores encrypted credential source specs as a compact JSON envelope.

func NewAESGCMCodec added in v0.5.2 

func NewAESGCMCodec(activeKeyID string, keys map[string][]byte) (*AESGCMCodec, error)

func (*AESGCMCodec) Decrypt added in v0.5.2 

func (c *AESGCMCodec) Decrypt(_ context.Context, aad []byte, payload json.RawMessage) (CredentialSourceSecretSpec, error)

func (*AESGCMCodec) Encrypt added in v0.5.2 

func (c *AESGCMCodec) Encrypt(_ context.Context, aad []byte, spec CredentialSourceSecretSpec) (json.RawMessage, error)

type BindingRecord 

type BindingRecord struct {
	SandboxID string              `json:"sandboxId"`
	TeamID    string              `json:"teamId,omitempty"`
	Bindings  []CredentialBinding `json:"bindings,omitempty"`
	UpdatedAt time.Time           `json:"updatedAt,omitempty"`
}

BindingRecord stores the effective bindings for one sandbox owned by one team.

type BindingStore 

type BindingStore interface {
	GetBindings(ctx context.Context, teamID, sandboxID string) (*BindingRecord, error)
	UpsertBindings(ctx context.Context, record *BindingRecord) error
	DeleteBindings(ctx context.Context, teamID, sandboxID string) error
	GetSourceByRef(ctx context.Context, teamID, ref string) (*CredentialSource, error)
	GetSourceVersion(ctx context.Context, sourceID, version int64) (*CredentialSourceVersion, error)
}

BindingStore is the shared manager/broker contract for effective sandbox bindings and credential source metadata.

type CachePolicySpec 

type CachePolicySpec struct {
	TTL string `json:"ttl,omitempty"`
}

CachePolicySpec controls broker-side caching for one binding.

type CredentialBinding 

type CredentialBinding struct {
	Ref           string           `json:"ref"`
	SourceRef     string           `json:"sourceRef"`
	SourceID      int64            `json:"sourceId,omitempty"`
	SourceVersion int64            `json:"sourceVersion,omitempty"`
	Projection    ProjectionSpec   `json:"projection"`
	CachePolicy   *CachePolicySpec `json:"cachePolicy,omitempty"`
}

CredentialBinding stores one effective sandbox binding materialized by manager.

type CredentialProjectionType 

type CredentialProjectionType string

CredentialProjectionType identifies the runtime projection shape. 

const (
	CredentialProjectionTypeHTTPHeaders             CredentialProjectionType = "http_headers"
	CredentialProjectionTypePlaceholderSubstitution CredentialProjectionType = "placeholder_substitution"
	CredentialProjectionTypeTLSClientCertificate    CredentialProjectionType = "tls_client_certificate"
	CredentialProjectionTypeUsernamePassword        CredentialProjectionType = "username_password"
	CredentialProjectionTypeSSHProxy                CredentialProjectionType = "ssh_proxy"
)

type CredentialSource 

type CredentialSource struct {
	ID             int64     `json:"id"`
	TeamID         string    `json:"teamId"`
	Name           string    `json:"name"`
	ResolverKind   string    `json:"resolverKind"`
	CurrentVersion int64     `json:"currentVersion"`
	Status         string    `json:"status"`
	CreatedAt      time.Time `json:"createdAt,omitempty"`
	UpdatedAt      time.Time `json:"updatedAt,omitempty"`
}

CredentialSource identifies one region-scoped credential source.

type CredentialSourceExternalRefSpec added in v0.5.2 

type CredentialSourceExternalRefSpec struct {
	Provider   string            `json:"provider"`
	Connection string            `json:"connection,omitempty"`
	Mount      string            `json:"mount,omitempty"`
	Path       string            `json:"path"`
	Version    string            `json:"version,omitempty"`
	Fields     map[string]string `json:"fields,omitempty"`
}

CredentialSourceExternalRefSpec points at secret material held in a Vault-compatible backend.

type CredentialSourceMetadata 

type CredentialSourceMetadata struct {
	Name           string    `json:"name"`
	ResolverKind   string    `json:"resolverKind"`
	StorageKind    string    `json:"-"`
	CurrentVersion int64     `json:"currentVersion"`
	Status         string    `json:"status"`
	CreatedAt      time.Time `json:"createdAt,omitempty"`
	UpdatedAt      time.Time `json:"updatedAt,omitempty"`
}

CredentialSourceMetadata is the public metadata view of one source.

type CredentialSourceSecretSpec 

type CredentialSourceSecretSpec struct {
	StaticHeaders              *StaticHeadersSourceSpec              `json:"staticHeaders,omitempty"`
	StaticTLSClientCertificate *StaticTLSClientCertificateSourceSpec `json:"staticTLSClientCertificate,omitempty"`
	StaticUsernamePassword     *StaticUsernamePasswordSourceSpec     `json:"staticUsernamePassword,omitempty"`
	StaticSSHPrivateKey        *StaticSSHPrivateKeySourceSpec        `json:"staticSSHPrivateKey,omitempty"`
}

CredentialSourceSecretSpec is the typed source config resolved for runtime use.

type CredentialSourceVersion 

type CredentialSourceVersion struct {
	SourceID     int64                            `json:"sourceId"`
	TeamID       string                           `json:"teamId,omitempty"`
	Version      int64                            `json:"version"`
	ResolverKind string                           `json:"resolverKind"`
	StorageKind  string                           `json:"storageKind,omitempty"`
	Spec         CredentialSourceSecretSpec       `json:"spec"`
	ExternalRef  *CredentialSourceExternalRefSpec `json:"externalRef,omitempty"`
	CreatedAt    time.Time                        `json:"createdAt,omitempty"`
}

CredentialSourceVersion stores one versioned resolver config.

type CredentialSourceWriteRequest 

type CredentialSourceWriteRequest struct {
	Name         string                           `json:"name"`
	ResolverKind string                           `json:"resolverKind"`
	StorageKind  string                           `json:"storageKind,omitempty"`
	Spec         CredentialSourceSecretSpec       `json:"spec"`
	ExternalRef  *CredentialSourceExternalRefSpec `json:"externalRef,omitempty"`
}

CredentialSourceWriteRequest is the secret-bearing public write model.

type DB 

type DB interface {
	Exec(ctx context.Context, sql string, arguments ...any) (pgconn.CommandTag, error)
	Query(ctx context.Context, sql string, args ...any) (pgx.Rows, error)
	QueryRow(ctx context.Context, sql string, args ...any) pgx.Row
}

type HTTPHeadersDirective 

type HTTPHeadersDirective struct {
	Headers map[string]string `json:"headers,omitempty"`
}

HTTPHeadersDirective injects HTTP headers into a matching request.

type HTTPHeadersProjection 

type HTTPHeadersProjection struct {
	Headers []ProjectedHeader `json:"headers,omitempty"`
}

HTTPHeadersProjection injects HTTP headers derived from source data.

type Logger 

type Logger interface {
	Printf(format string, args ...any)
	Fatalf(format string, args ...any)
}

type PlaceholderReplacement added in v0.7.0 

type PlaceholderReplacement struct {
	Placeholder   string                            `json:"placeholder"`
	ValueTemplate string                            `json:"valueTemplate"`
	Locations     []PlaceholderSubstitutionLocation `json:"locations,omitempty"`
}

PlaceholderReplacement defines one placeholder replacement template.

type PlaceholderSubstitutionDirective added in v0.7.0 

type PlaceholderSubstitutionDirective struct {
	Replacements []PlaceholderSubstitutionReplacement `json:"replacements,omitempty"`
}

PlaceholderSubstitutionDirective replaces placeholders in outbound HTTP requests.

type PlaceholderSubstitutionLocation added in v0.7.0 

type PlaceholderSubstitutionLocation string

PlaceholderSubstitutionLocation identifies an HTTP request location. 

const (
	PlaceholderSubstitutionLocationHeader PlaceholderSubstitutionLocation = "header"
	PlaceholderSubstitutionLocationQuery  PlaceholderSubstitutionLocation = "query"
	PlaceholderSubstitutionLocationBody   PlaceholderSubstitutionLocation = "body"
)

type PlaceholderSubstitutionProjection added in v0.7.0 

type PlaceholderSubstitutionProjection struct {
	Replacements []PlaceholderReplacement `json:"replacements,omitempty"`
}

PlaceholderSubstitutionProjection replaces placeholders in outbound HTTP traffic.

type PlaceholderSubstitutionReplacement added in v0.7.0 

type PlaceholderSubstitutionReplacement struct {
	Placeholder string                            `json:"placeholder"`
	Value       string                            `json:"value"`
	Locations   []PlaceholderSubstitutionLocation `json:"locations,omitempty"`
}

PlaceholderSubstitutionReplacement is one resolved placeholder replacement.

type ProjectedHeader 

type ProjectedHeader struct {
	Name          string `json:"name"`
	ValueTemplate string `json:"valueTemplate"`
}

ProjectedHeader defines one projected header template.

type ProjectionSpec 

type ProjectionSpec struct {
	Type                    CredentialProjectionType           `json:"type"`
	HTTPHeaders             *HTTPHeadersProjection             `json:"httpHeaders,omitempty"`
	PlaceholderSubstitution *PlaceholderSubstitutionProjection `json:"placeholderSubstitution,omitempty"`
	TLSClientCertificate    *TLSClientCertificateProjection    `json:"tlsClientCertificate,omitempty"`
	UsernamePassword        *UsernamePasswordProjection        `json:"usernamePassword,omitempty"`
	SSHProxy                *SSHProxyProjection                `json:"sshProxy,omitempty"`
}

ProjectionSpec defines how resolved source data should be projected into runtime directives.

type Repository 

type Repository struct {
	// contains filtered or unexported fields
}

Repository persists effective credential bindings in PostgreSQL.

func NewRepository 

func NewRepository(pool *pgxpool.Pool, opts ...RepositoryOption) *Repository

func (*Repository) DeleteBindings 

func (r *Repository) DeleteBindings(ctx context.Context, teamID, sandboxID string) error

func (*Repository) DeleteSource 

func (r *Repository) DeleteSource(ctx context.Context, teamID, name string) error

func (*Repository) GetBindings 

func (r *Repository) GetBindings(ctx context.Context, teamID, sandboxID string) (*BindingRecord, error)

func (*Repository) GetSourceByRef 

func (r *Repository) GetSourceByRef(ctx context.Context, teamID, ref string) (*CredentialSource, error)

func (*Repository) GetSourceMetadata 

func (r *Repository) GetSourceMetadata(ctx context.Context, teamID, name string) (*CredentialSourceMetadata, error)

func (*Repository) GetSourceVersion 

func (r *Repository) GetSourceVersion(ctx context.Context, sourceID, version int64) (*CredentialSourceVersion, error)

func (*Repository) ListSourceMetadata 

func (r *Repository) ListSourceMetadata(ctx context.Context, teamID string) ([]CredentialSourceMetadata, error)

func (*Repository) Pool 

func (r *Repository) Pool() *pgxpool.Pool

func (*Repository) PutSource 

func (r *Repository) PutSource(ctx context.Context, teamID string, record *CredentialSourceWriteRequest) (*CredentialSourceMetadata, error)

func (*Repository) UpsertBindings 

func (r *Repository) UpsertBindings(ctx context.Context, record *BindingRecord) error

type RepositoryOption added in v0.5.2 

type RepositoryOption func(*Repository)

func WithDefaultStorageKind added in v0.5.2 

func WithDefaultStorageKind(kind string) RepositoryOption

func WithSecretCodec added in v0.5.2 

func WithSecretCodec(codec SecretCodec) RepositoryOption

func WithVaultResolver added in v0.5.2 

func WithVaultResolver(resolver *VaultResolver) RepositoryOption

type ResolveDirective 

type ResolveDirective struct {
	Kind                    ResolveDirectiveKind              `json:"kind"`
	HTTPHeaders             *HTTPHeadersDirective             `json:"httpHeaders,omitempty"`
	PlaceholderSubstitution *PlaceholderSubstitutionDirective `json:"placeholderSubstitution,omitempty"`
	TLSClientCertificate    *TLSClientCertificateDirective    `json:"tlsClientCertificate,omitempty"`
	UsernamePassword        *UsernamePasswordDirective        `json:"usernamePassword,omitempty"`
	SSHProxy                *SSHProxyDirective                `json:"sshProxy,omitempty"`
}

ResolveDirective is a typed outbound auth directive.

type ResolveDirectiveKind 

type ResolveDirectiveKind string
const (
	ResolveDirectiveKindHTTPHeaders             ResolveDirectiveKind = "http_headers"
	ResolveDirectiveKindPlaceholderSubstitution ResolveDirectiveKind = "placeholder_substitution"
	ResolveDirectiveKindGRPCMetadata            ResolveDirectiveKind = "grpc_metadata"
	ResolveDirectiveKindTLSClientCertificate    ResolveDirectiveKind = "tls_client_certificate"
	ResolveDirectiveKindUsernamePassword        ResolveDirectiveKind = "username_password"
	ResolveDirectiveKindSSHProxy                ResolveDirectiveKind = "ssh_proxy"
	ResolveDirectiveKindSSHAgentSign            ResolveDirectiveKind = "ssh_agent_sign"
	ResolveDirectiveKindCustom                  ResolveDirectiveKind = "custom"
)

type ResolveRequest 

type ResolveRequest struct {
	SandboxID       string `json:"sandboxId"`
	TeamID          string `json:"teamId,omitempty"`
	AuthRef         string `json:"authRef"`
	RuleName        string `json:"ruleName,omitempty"`
	Destination     string `json:"destination,omitempty"`
	DestinationPort int    `json:"destinationPort,omitempty"`
	Transport       string `json:"transport,omitempty"`
	Protocol        string `json:"protocol,omitempty"`
}

ResolveRequest describes an auth material lookup for a matched egress auth rule.

type ResolveResponse 

type ResolveResponse struct {
	AuthRef    string             `json:"authRef"`
	Directives []ResolveDirective `json:"directives,omitempty"`
	ExpiresAt  *time.Time         `json:"expiresAt,omitempty"`

	// Headers is an in-memory compatibility view derived from `directives`.
	// It is intentionally excluded from the wire format so the broker protocol
	// can move to typed directives before netd adapters are rewritten.
	Headers map[string]string `json:"-"`
}

ResolveResponse describes the resolved outbound auth material.

func CloneResolveResponse 

func CloneResolveResponse(in *ResolveResponse) *ResolveResponse

CloneResolveResponse deep-copies one resolved response.

func NewHTTPHeadersResolveResponse 

func NewHTTPHeadersResolveResponse(authRef string, headers map[string]string, expiresAt *time.Time) *ResolveResponse

NewHTTPHeadersResolveResponse constructs the first typed directive response supported by the Phase 4 wire model.

func NewPlaceholderSubstitutionResolveResponse added in v0.7.0 

func NewPlaceholderSubstitutionResolveResponse(authRef string, directive *PlaceholderSubstitutionDirective, expiresAt *time.Time) *ResolveResponse

NewPlaceholderSubstitutionResolveResponse constructs a typed placeholder substitution response.

func NewSSHProxyResolveResponse added in v0.4.0 

func NewSSHProxyResolveResponse(authRef string, directive *SSHProxyDirective, expiresAt *time.Time) *ResolveResponse

NewSSHProxyResolveResponse constructs a typed transparent SSH proxy response.

func NewTLSClientCertificateResolveResponse 

func NewTLSClientCertificateResolveResponse(authRef string, directive *TLSClientCertificateDirective, expiresAt *time.Time) *ResolveResponse

NewTLSClientCertificateResolveResponse constructs a typed TLS client certificate response.

func NewUsernamePasswordResolveResponse 

func NewUsernamePasswordResolveResponse(authRef string, directive *UsernamePasswordDirective, expiresAt *time.Time) *ResolveResponse

NewUsernamePasswordResolveResponse constructs a typed username/password response.

func (*ResolveResponse) EnsureCompatibilityFields 

func (r *ResolveResponse) EnsureCompatibilityFields()

EnsureCompatibilityFields keeps in-memory compatibility fields consistent.

func (ResolveResponse) MarshalJSON 

func (r ResolveResponse) MarshalJSON() ([]byte, error)

MarshalJSON emits only the typed directive wire model.

func (*ResolveResponse) UnmarshalJSON 

func (r *ResolveResponse) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts typed directives and upgrades any legacy `headers` payload into the new directive representation.

type SSHProxyDirective added in v0.4.0 

type SSHProxyDirective struct {
	SandboxPublicKeys []string `json:"sandboxPublicKeys,omitempty"`
	UpstreamUsername  string   `json:"upstreamUsername,omitempty"`
	PrivateKeyPEM     string   `json:"privateKeyPem,omitempty"`
	Passphrase        string   `json:"passphrase,omitempty"`
	KnownHosts        []string `json:"knownHosts,omitempty"`
}

SSHProxyDirective configures transparent SSH proxy authentication.

type SSHProxyProjection added in v0.4.0 

type SSHProxyProjection struct {
	SandboxPublicKeys []string `json:"sandboxPublicKeys,omitempty"`
	UpstreamUsername  string   `json:"upstreamUsername,omitempty"`
	KnownHosts        []string `json:"knownHosts,omitempty"`
}

SSHProxyProjection configures transparent SSH re-origination.

type SecretCodec added in v0.5.2 

type SecretCodec interface {
	Encrypt(ctx context.Context, aad []byte, spec CredentialSourceSecretSpec) (json.RawMessage, error)
	Decrypt(ctx context.Context, aad []byte, payload json.RawMessage) (CredentialSourceSecretSpec, error)
}

SecretCodec encrypts and decrypts credential source specs before they are persisted in PostgreSQL.

type SourceStore 

type SourceStore interface {
	ListSourceMetadata(ctx context.Context, teamID string) ([]CredentialSourceMetadata, error)
	GetSourceMetadata(ctx context.Context, teamID, name string) (*CredentialSourceMetadata, error)
	PutSource(ctx context.Context, teamID string, record *CredentialSourceWriteRequest) (*CredentialSourceMetadata, error)
	DeleteSource(ctx context.Context, teamID, name string) error
}

SourceStore owns control-plane CRUD for credential sources.

type StaticHeadersSourceSpec 

type StaticHeadersSourceSpec struct {
	Values map[string]string `json:"values,omitempty"`
}

StaticHeadersSourceSpec stores named values used by header projections.

type StaticSSHPrivateKeySourceSpec added in v0.4.0 

type StaticSSHPrivateKeySourceSpec struct {
	PrivateKeyPEM string `json:"privateKeyPem,omitempty"`
	Passphrase    string `json:"passphrase,omitempty"`
}

StaticSSHPrivateKeySourceSpec stores one PEM-encoded SSH private key.

type StaticTLSClientCertificateSourceSpec 

type StaticTLSClientCertificateSourceSpec struct {
	CertificatePEM string `json:"certificatePem,omitempty"`
	PrivateKeyPEM  string `json:"privateKeyPem,omitempty"`
	CAPEM          string `json:"caPem,omitempty"`
}

StaticTLSClientCertificateSourceSpec stores a PEM-encoded client certificate bundle.

type StaticUsernamePasswordSourceSpec 

type StaticUsernamePasswordSourceSpec struct {
	Username string `json:"username,omitempty"`
	Password string `json:"password,omitempty"`
}

StaticUsernamePasswordSourceSpec stores one username/password pair for early protocol auth.

type TLSClientCertificateDirective 

type TLSClientCertificateDirective struct {
	CertificatePEM string `json:"certificatePem,omitempty"`
	PrivateKeyPEM  string `json:"privateKeyPem,omitempty"`
	CAPEM          string `json:"caPem,omitempty"`
}

TLSClientCertificateDirective configures one upstream mTLS client certificate.

type TLSClientCertificateProjection 

type TLSClientCertificateProjection struct{}

TLSClientCertificateProjection projects one client certificate for TLS re-origination.

type UsernamePasswordDirective 

type UsernamePasswordDirective struct {
	Username string `json:"username,omitempty"`
	Password string `json:"password,omitempty"`
}

UsernamePasswordDirective injects one username/password pair into a bounded auth exchange.

type UsernamePasswordProjection 

type UsernamePasswordProjection struct{}

UsernamePasswordProjection projects one username/password pair into an early auth exchange.

type VaultConnectionConfig added in v0.5.2 

type VaultConnectionConfig struct {
	Name                string
	Provider            string
	Address             string
	TokenFile           string
	CACertFile          string
	Namespace           string
	DefaultMount        string
	KVVersion           int
	SkipTLSVerify       bool
	AllowedPathPrefixes []string
}

type VaultResolver added in v0.5.2 

type VaultResolver struct {
	// contains filtered or unexported fields
}

func NewVaultResolver added in v0.5.2 

func NewVaultResolver(configs []VaultConnectionConfig) (*VaultResolver, error)

func (*VaultResolver) Put added in v0.5.2 

func (r *VaultResolver) Put(ctx context.Context, teamID, resolverKind string, ref *CredentialSourceExternalRefSpec, spec CredentialSourceSecretSpec) error

func (*VaultResolver) Resolve added in v0.5.2 

func (r *VaultResolver) Resolve(ctx context.Context, teamID, resolverKind string, ref *CredentialSourceExternalRefSpec) (CredentialSourceSecretSpec, error)

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.