authorizer

type Authorizer interface {
	// Allow1 is called when a network connection is opened.
	//
	// If it returns true, processing will continue, otherwise the
	// connection will be immediately closed.
	Allow1(net.Addr) bool

	// Allow2 is called after basic analysis of the contact has been
	// performed.
	//
	// If it returns true, processing will continue, otherwise
	// processing will end and the client will receive an http 503
	// or equivalent error code.
	Allow2(net.Addr, ContactInfo) bool

	// Allow3 is called after the datastore has been read to find
	// basic information on the client.
	//
	// If it returns true, processing will continue, otherwise
	// processing will end and the client will receive an http 503
	// or equivalent error code.
	Allow3(net.Addr, ContactInfo, ClientInfo) bool

	// Allow4 is called immediately before actually saving and
	// processing the messages provided by the client.
	//
	// When accept=true, all messages will have their
	// validation_info field set to the returned string, and then
	// they will be saved and processed. When accept=false,
	// processing will end, nothing will be saved, and the client
	// will receive an http 503 or equivalent error code.
	Allow4(net.Addr, ContactInfo, ClientInfo, []SignatureInfo) (accept bool, vi *fspb.ValidationInfo)
}

type ClientInfo struct {
	New    bool          // Whether the client is new. True if the client is not yet in our datastore.
	Labels []*fspb.Label // The labels currently set for this client.
}

type ContactInfo struct {
	ID           common.ClientID
	ContactSize  int      // The size of the contact, in bytes.
	ClientLabels []string // The client labels included in the contact.
}

type PermissiveAuthorizer struct{}

type SignatureInfo struct {
	// The certificate chain provided with the signature.
	Certificate []*x509.Certificate

	// The signature algorithm used.
	Algorithm x509.SignatureAlgorithm

	// True if the signature provided with the message could be verified against
	// the first certificate in the chain.
	//
	// NOTE: The FS system only performs, and this bit only represents the result
	// of a simple signature check against Certificate[0].  The Authorizer
	// implementation is responsible for verifying every other aspect of chain. In
	// particular, an Authorizer will typically want to verify that provided
	// certificates really do chain together, that none of the certificates in it
	// have been revoked, and that the final certificate in the chain is signed by
	// a trusted authority.
	Valid bool
}