34 lines
1.3 KiB
Go
34 lines
1.3 KiB
Go
|
// Package auth exposes the two identity sources dummy-sink uses to call
|
||
|
|
// the signing-service:
|
||
|
|
//
|
||
|
|
// 1. Pocket-ID client_credentials access token (Authorization: Bearer …)
|
||
|
|
// 2. Projected ServiceAccount token (X-Workload-Token …) read from a
|
||
|
|
// kubelet-managed Volume (`projected: { serviceAccountToken: … }`).
|
||
|
|
//
|
||
|
|
// Both are modelled behind the same TokenSource interface so the
|
||
|
|
// orchestration code never cares about the identity's origin. The split
|
||
|
|
// mirrors services/testagent-transform/internal/auth and services/
|
||
|
|
// approval-service/internal/signer; both of those services already use
|
||
|
|
// the double-identity flow against signing-service.
|
||
|
|
package auth
|
||
|
|
|
||
|
|
import "context"
|
||
|
|
|
||
|
|
// TokenSource returns a bearer-style token. Implementations may cache
|
||
|
|
// internally; the caller is expected to retry on error.
|
||
|
|
type TokenSource interface {
|
||
|
|
Token(ctx context.Context) (string, error)
|
||
|
|
}
|
||
|
|
|
||
|
|
// StaticToken is a constant TokenSource. Primarily used in tests.
|
||
|
|
type StaticToken string
|
||
|
|
|
||
|
|
// Token returns s.
|
||
|
|
func (s StaticToken) Token(_ context.Context) (string, error) { return string(s), nil }
|
||
|
|
|
||
|
|
// TokenFunc adapts a plain function to TokenSource.
|
||
|
|
type TokenFunc func(ctx context.Context) (string, error)
|
||
|
|
|
||
|
|
// Token calls f.
|
||
|
|
func (f TokenFunc) Token(ctx context.Context) (string, error) { return f(ctx) }
|