authcheck

Documentation

Overview

Package authcheck asserts that an app's authentication configuration is coherent, and proves the parts that can be proved.

Every other surface here checks one system against a config. This one checks several variables against each other, because that is where authentication actually fails: not a missing value, but two values that disagree.

The failures it was written from, all of which were invisible until someone tried to sign in:

• an auth URL that lost its path, so every session lookup 404'd — and a 404 on get-session reads exactly like "no session"
• a CORS allowlist that matches an origin exactly, so a preview deployment loaded with an empty page and no error
• an unset provider variable, silently inferred as a different provider
• a sign-in page offering three ways in that the backend did not have

It changes nothing. Authentication is the one surface where a wrong automatic fix locks out everybody, including whoever ran the tool.

Index

• func Plan(ctx context.Context, a config.Auth, env map[string]string, fetch Fetcher) (plan.Plan, error)
• type Fetcher
• type HTTP
  • func (h HTTP) Get(ctx context.Context, url string) (int, []byte, error)

Functions

func Plan

func Plan(ctx context.Context, a config.Auth, env map[string]string, fetch Fetcher) (plan.Plan, error)

Plan returns what does not cohere. Every action is MANUAL: this surface reports and never changes anything.

Types

type Fetcher

type Fetcher interface {
	Get(ctx context.Context, url string) (status int, body []byte, err error)
}

Fetcher reads a URL. Injected so tests need no network.

type HTTP

type HTTP struct{ Client *http.Client }

HTTP is the real one.

func (HTTP) Get

func (h HTTP) Get(ctx context.Context, url string) (int, []byte, error)