delegation

type ImportDelegationConfigsRPC struct {
	RulesCache *RulesCache // usually GlobalRulesCache, but replaced in tests
}

type InspectDelegationTokenRPC struct {
	// Signer is mocked in tests.
	//
	// In prod it is the default server signer that uses server's service account.
	Signer signing.Signer
}

type MintDelegationTokenRPC struct {
	// Signer is mocked in tests.
	//
	// In prod it is the default server signer that uses server's service account.
	Signer signing.Signer

	// Rules returns delegation rules to use for the request.
	//
	// In prod it is GlobalRulesCache.Rules.
	Rules func(context.Context) (*Rules, error)

	// LogToken is mocked in tests.
	//
	// In prod it is produced by NewTokenLogger.
	LogToken TokenLogger
	// contains filtered or unexported fields
}

type MintedTokenInfo struct {
	Request   *minter.MintDelegationTokenRequest  // RPC input, as is
	Response  *minter.MintDelegationTokenResponse // RPC output, as is
	ConfigRev string                              // revision of the delegation.cfg used
	Rule      *admin.DelegationRule               // the particular rule used to authorize the request
	PeerIP    net.IP                              // caller IP address
	RequestID string                              // GAE request ID that handled the RPC
	AuthDBRev int64                               // revision of groups database (or 0 if unknown)
}

type Rules struct {
	// contains filtered or unexported fields
}

type RulesCache struct {
	// contains filtered or unexported fields
}

type RulesQuery struct {
	Requestor identity.Identity // who is requesting the token
	Delegator identity.Identity // what identity will be delegated/impersonated
	Audience  *identityset.Set  // the requested audience set (delegatees)
	Services  *identityset.Set  // the requested target services set
}

type TokenLogger func(context.Context, *MintedTokenInfo) error