Safe Haskell	None
Language	GHC2021

Ecluse.Core.Credential

Contents

Secrets
A client's presented credential
Tokens
Provider handle
In-memory double

Description

The outbound-credential handle: the bearer token Écluse uses to write approved packages to the mirror target. It serves Écluse's own store access only, never a read on a user's behalf: a private-upstream read forwards the client's own credential (see docs/architecture/registry-model.md, "Credential flow and authority").

The handle stays apart from the protocol handle Ecluse.Core.Registry because every managed registry speaks one protocol and differs only in how it hands out a token. Refresh, cache and expiry policy over a per-cloud mint live in Ecluse.Core.Credential.Refresh.

Synopsis

data Secret
mkSecret :: Text -> Secret
unSecret :: Secret -> Text
data ClientCredential = ClientCredential {
- credUsername :: Maybe Text
- credSecret :: Secret
}
bareCredential :: Secret -> ClientCredential
data AuthToken = AuthToken {
- authSecret :: Secret
- authExpiresAt :: Maybe UTCTime
}
newtype CredentialProvider = CredentialProvider {
- currentToken :: IO AuthToken
}
mintSecret :: CredentialProvider -> IO Secret
staticProvider :: AuthToken -> CredentialProvider

Secrets

data Secret Source #

A short-lived secret (an access token). Build one with mkSecret and recover the text only at the point of use with unSecret.

Instances

Instances details

FromJSON Secret Source #	Decoding reads the secret from configuration, for example the environment AST.
Instance details Defined in Ecluse.Core.Credential Methods parseJSON :: Value -> Parser Secret # parseJSONList :: Value -> Parser [Secret] # omittedField :: Maybe Secret #
ToJSON Secret Source #	The JSON encoding redacts the secret, so it never leaks into a JSON log.
Instance details Defined in Ecluse.Core.Credential Methods toJSON :: Secret -> Value # toEncoding :: Secret -> Encoding # toJSONList :: [Secret] -> Value # toEncodingList :: [Secret] -> Encoding # omitField :: Secret -> Bool #
Show Secret Source #	Render a fixed placeholder, never the secret text. It defines `showsPrec` because relude re-exports a polymorphic `show` that is not the class method.
Instance details Defined in Ecluse.Core.Credential Methods showsPrec :: Int -> Secret -> ShowS # show :: Secret -> String # showList :: [Secret] -> ShowS #
Eq Secret Source #	Constant-time equality over the UTF-8 encoding. The `ECLUSE_SERVER__AUTH_TOKEN` edge gate compares through it, a short-circuit would leak the prefix length. The token length still leaks.
Instance details Defined in Ecluse.Core.Credential Methods (==) :: Secret -> Secret -> Bool # (/=) :: Secret -> Secret -> Bool #

mkSecret :: Text -> Secret Source #

Wrap raw token text as a Secret.

unSecret :: Secret -> Text Source #

Recover the raw token text. Call this only at the point of use, when setting the auth header, and never log or otherwise render the result.

A client's presented credential

data ClientCredential Source #

A credential as a client presents it. The username is not part of the secret: a gate compares credSecret alone, and a passthrough leg renders the pair verbatim.

Constructors

ClientCredential
Fields credUsername :: Maybe Text The username the client presented, when its scheme carries one. credSecret :: Secret The secret half, the only half any gate compares.

Instances

Instances details

Show ClientCredential Source #
Instance details Defined in Ecluse.Core.Credential Methods showsPrec :: Int -> ClientCredential -> ShowS # show :: ClientCredential -> String # showList :: [ClientCredential] -> ShowS #
Eq ClientCredential Source #
Instance details Defined in Ecluse.Core.Credential Methods (==) :: ClientCredential -> ClientCredential -> Bool # (/=) :: ClientCredential -> ClientCredential -> Bool #

bareCredential :: Secret -> ClientCredential Source #

A credential carrying no username, the form a bearer scheme recovers and a configured token takes.

Tokens

data AuthToken Source #

A bearer token for a registry endpoint. Cloud lifetimes run from CodeArtifact's ~12h to ADC's ~1h, so a refresh schedules off authExpiresAt rather than a fixed interval.

Constructors

AuthToken
Fields authSecret :: Secret The bearer secret itself (redacted in `Show`). authExpiresAt :: Maybe UTCTime When the token expires. `Nothing` for a static token, which does not expire.

Instances

Instances details

Show AuthToken Source #
Instance details Defined in Ecluse.Core.Credential Methods showsPrec :: Int -> AuthToken -> ShowS # show :: AuthToken -> String # showList :: [AuthToken] -> ShowS #
Eq AuthToken Source #
Instance details Defined in Ecluse.Core.Credential Methods (==) :: AuthToken -> AuthToken -> Bool # (/=) :: AuthToken -> AuthToken -> Bool #

Provider handle

newtype CredentialProvider Source #

The credential handle: it yields the token currently valid for the mirror target and refreshes it before expiry internally, so no caller blocks on a mint on the hot path.

Constructors

CredentialProvider
Fields currentToken :: IO AuthToken `IO`, not `App`, so an adapter closing over its own backend state stays off the core.

mintSecret :: CredentialProvider -> IO Secret Source #

The secret a provider's current token carries, for a caller that presents it and reads no expiry. It refreshes behind the provider, so a long-lived caller mints per use.

In-memory double

staticProvider :: AuthToken -> CredentialProvider Source #

A CredentialProvider that always returns the same token, the static leaf. It never refreshes, so it fits a registry reached with a long-lived credential.