auth

Documentation

Index

• Constants
• Variables
• func DeleteAccessToken(ctx context.Context, provider string, token string) error
• func GetDefaultProject(ctx context.Context) (uuid.UUID, error)
• func GetUserProjects(ctx context.Context) ([]uuid.UUID, error)
• func IsAuthorizedForProject(ctx context.Context, projectID uuid.UUID) bool
• func NewOAuthConfig(provider string, cli bool) (*oauth2.Config, error)
• func NewProviderHttpClient(provider string) *http.Client
• func RegisterOAuthFlags(v *viper.Viper, flags *pflag.FlagSet) error
• func ValidateProviderToken(_ context.Context, provider string, token string) error
• func WithPermissionsContext(ctx context.Context, claims UserPermissions) context.Context
• type JwkSetJwtValidator
  • func (j *JwkSetJwtValidator) ParseAndValidate(tokenString string) (openid.Token, error)
• type JwtValidator
  • func NewJwtValidator(ctx context.Context, jwksUrl string) (JwtValidator, error)
• type KeySetCache
  • func (k *KeySetCache) GetKeySet() (jwk.Set, error)
• type KeySetFetcher
• type RoleInfo
• type UserDetails
  • func GetUserDetails(ctx context.Context, cmd *cobra.Command, v *viper.Viper) (*UserDetails, error)
• type UserPermissions
  • func GetPermissionsFromContext(ctx context.Context) UserPermissions

Constants

const (
	// Google OAuth2 provider
	Google = "google"

	// Github OAuth2 provider
	Github = "github"
)

Variables

var OAuthSuccessHtml []byte

OAuthSuccessHtml is the html page sent to the client upon successful enrollment via CLI

Functions

func DeleteAccessToken

func DeleteAccessToken(ctx context.Context, provider string, token string) error

DeleteAccessToken deletes the access token for a given provider

func GetDefaultProject

func GetDefaultProject(ctx context.Context) (uuid.UUID, error)

GetDefaultProject returns the default group id for the user

func GetUserProjects

func GetUserProjects(ctx context.Context) ([]uuid.UUID, error)

GetUserProjects returns all the groups where an user belongs to

func IsAuthorizedForProject

func IsAuthorizedForProject(ctx context.Context, projectID uuid.UUID) bool

IsAuthorizedForProject returns true if the user is authorized for the given group

func NewOAuthConfig

func NewOAuthConfig(provider string, cli bool) (*oauth2.Config, error)

NewOAuthConfig creates a new OAuth2 config for the given provider and whether the client is a CLI or web client

func NewProviderHttpClient

func NewProviderHttpClient(provider string) *http.Client

NewProviderHttpClient creates a new http client for the given provider

func RegisterOAuthFlags

func RegisterOAuthFlags(v *viper.Viper, flags *pflag.FlagSet) error

RegisterOAuthFlags registers client ID and secret file flags for all known providers. This is pretty tied into the internal of the auth module, so it lives here, but it would be nice if we have a consistent registration pattern (database flags are registered in the config module).

func ValidateProviderToken

func ValidateProviderToken(_ context.Context, provider string, token string) error

ValidateProviderToken validates the given token for the given provider

func WithPermissionsContext

func WithPermissionsContext(ctx context.Context, claims UserPermissions) context.Context

WithPermissionsContext stores the specified UserClaim in the context.

Types

type JwkSetJwtValidator

type JwkSetJwtValidator struct {
	// contains filtered or unexported fields
}

JwkSetJwtValidator is a JWT validator that uses a JWK set URL to validate the tokens

func (*JwkSetJwtValidator) ParseAndValidate

func (j *JwkSetJwtValidator) ParseAndValidate(tokenString string) (openid.Token, error)

ParseAndValidate validates a token string and returns an openID token, or an error if the token is invalid

type JwtValidator

type JwtValidator interface {
	ParseAndValidate(tokenString string) (openid.Token, error)
}

JwtValidator provides the functions to validate a JWT

func NewJwtValidator

func NewJwtValidator(ctx context.Context, jwksUrl string) (JwtValidator, error)

NewJwtValidator creates a new JWT validator that uses a JWK set URL to validate the tokens

type KeySetCache

type KeySetCache struct {
	// contains filtered or unexported fields
}

KeySetCache is a KeySetFetcher that fetches the JWK set from a cache

func (*KeySetCache) GetKeySet

func (k *KeySetCache) GetKeySet() (jwk.Set, error)

GetKeySet returns the caches JWK set

type KeySetFetcher

type KeySetFetcher interface {
	GetKeySet() (jwk.Set, error)
}

KeySetFetcher provides the functions to fetch a JWK set

type RoleInfo

type RoleInfo struct {
	RoleID         int32      `json:"role_id"`
	IsAdmin        bool       `json:"is_admin"`
	ProjectID      *uuid.UUID `json:"project_id"`
	OrganizationID uuid.UUID  `json:"organization_id"`
}

RoleInfo contains the role information for a user

type UserDetails

type UserDetails struct {
	Name  string
	Email string
}

UserDetails is a helper struct for getting user details

func GetUserDetails

func GetUserDetails(ctx context.Context, cmd *cobra.Command, v *viper.Viper) (*UserDetails, error)

GetUserDetails is a helper for getting user details such as name and email from the jwt token

type UserPermissions

type UserPermissions struct {
	UserId         int32
	ProjectIds     []uuid.UUID
	Roles          []RoleInfo
	OrganizationId uuid.UUID
	IsStaff        bool
}

UserPermissions contains the permissions for a user

func GetPermissionsFromContext

func GetPermissionsFromContext(ctx context.Context) UserPermissions

GetPermissionsFromContext returns the claims from the context, or an empty default