auth.go RawHistoryFolder

1// Package domain contains pure business types without external dependencies.
2package domain
3
4import "time"
5
6// AuthType represents the type of authentication configured for the registry.
7type AuthType string
8
9const (
10	// AuthTypePassword uses bcrypt-hashed password authentication.
11	AuthTypePassword AuthType = "password"
12	// AuthTypeToken uses JWT token-based authentication.
13	AuthTypeToken AuthType = "token"
14)
15
16// Token represents a generated authentication token stored in the secrets backend.
17type Token struct {
18	ID        string
19	Subject   string
20	Scopes    []string
21	IssuedAt  time.Time
22	ExpiresAt time.Time // Zero value means never expires
23	Revoked   bool
24}
25
26// TokenClaims represents the JWT claims for a token.
27type TokenClaims struct {
28	ID        string   `json:"jti"`
29	Subject   string   `json:"sub"`
30	Scopes    []string `json:"scopes"`
31	IssuedAt  int64    `json:"iat"`
32	ExpiresAt int64    `json:"exp,omitempty"` // 0 means never expires
33	Issuer    string   `json:"iss"`
34}
35
36// IsExpired checks if the token has expired.
37func (t *Token) IsExpired() bool {
38	if t.ExpiresAt.IsZero() {
39		return false // Never expires
40	}
41	return time.Now().After(t.ExpiresAt)
42}
43
44// SecretsBackend represents the type of secrets storage backend.
45type SecretsBackend string
46
47const (
48	// SecretsBackendPass uses the pass password manager.
49	SecretsBackendPass SecretsBackend = "pass"
50	// SecretsBackendSops uses SOPS for encrypted secrets.
51	SecretsBackendSops SecretsBackend = "sops"
52	// SecretsBackendUnsafe stores secrets in plain text (development only).
53	SecretsBackendUnsafe SecretsBackend = "unsafe"
54)