cosec/me.ahoo.wow.cosec

Package-level declarations

Types

The CoSec actions and resources of Wow's commands and service routes, one name whether CoSec decides the HTTP request or an authorizer decides the command in the process:

CoSecCallerOptions

@ExperimentalWowApi

class CoSecCallerOptions @InternalWowApi constructor(val defaultTenant: String = Caller.DEFAULT_TENANT, val crossScopeRoles: Set<String> = emptySet(), val crossScopePolicies: Set<String> = emptySet(), val tenantRoles: Set<String> = emptySet(), val tenantPolicies: Set<String> = emptySet())

What CoSecCallerResolver takes from the host (wow.tenant.default and wow.cosec.*).

CoSecCallerResolver

@ExperimentalWowApi

class CoSecCallerResolver(options: CoSecCallerOptions = CoSecCallerOptions()) : CallerResolver

The caller of a request from the security context CoSec's pipeline built for it: CoSec authenticates the request and resolves its scope, deciding it itself or, behind a CoSec gateway (cosec.pipeline.mode=gateway), reading what the gateway verified from CoSec-Identity. This resolver turns that context into a Caller.

CoSecCommandAuthorizer

@ExperimentalWowApi

class CoSecCommandAuthorizer(checker: AuthorizationChecker, defaultTenant: String = Caller.DEFAULT_TENANT) : CommandAuthorizer

Authorizes a command with CoSec's documents, as its caller: the command is the action <context>:<command> on the resource <aggregate>/<id> (CoSecActions), the name CoSec's route map gives its HTTP route, so one policy guards both. CoSec's checker evaluates it for the principal and scope of the request the caller comes from (CoSecRequests); a command it does not permit is denied.

CoSecRequestFacts

@InternalWowApi

object CoSecRequestFacts

The CoSec request header a command keeps as a request fact, as 9.x wow-cosec appended it: the device the request came from. The edge copies it through its request-fact list (WowHttpOptions.requestFacts). The application, CoSec-App-Id, is not copied as the client sent it: the command records the app of the scope CoSec resolved for the request as the standard request fact app_id (CoSecCallerResolver).

CoSecRequestIds

@InternalWowApi

object CoSecRequestIds

CoSec's request id as a command's request id when the request has no Wow-Request-Id: a CoSec gateway sets CoSec-Request-Id on the requests it forwards, so a command it sends again under the same header is the same request, which the log answers as a duplicate. The header is read as the request carries it, never the request id CoSec generates for a request without the header.

CoSecServiceRouteAuthorizer

@ExperimentalWowApi

class CoSecServiceRouteAuthorizer(checker: AuthorizationChecker, defaultTenant: String = Caller.DEFAULT_TENANT) : ServiceRouteAuthorizer

Authorizes a call of a service route with CoSec's documents, as CoSecCommandAuthorizer authorizes a command: the call is the action <context>:<route> on the resource route/<route> (CoSecActions), the name CoSec's route map gives the route over HTTP. A request-less caller gets no objection.