Wardrik.Tokens (wardrik_protocol v0.1.0-rc.1)

Operations on the deployment's API tokens. People and programs use them to reach Wardrik over HTTP.

Wardrik.Tokens.create(scope, name: "ci", roles: ["reader"], resources: ["acme/agent/*"])
#=> {:ok, %Wardrik.TokenIssued{token: %Wardrik.Token{id: "3f9a61c0d4e2", ...}, secret: "wrk_3f9a61c0d4e2_9c1e..."}}

# The secret is returned once. Turn it back into a scope with:
{:ok, ci} = MyApp.AgentRuntime.authenticate("wrk_3f9a61c0d4e2_9c1e...")

Summary

Functions

create(scope, input \\ [])

Make an API token

list(scope, input \\ [])

List the API tokens

revoke(scope, token, input \\ [])

Revoke an API token

Functions

create(scope, input \\ [])

@spec create(Wardrik.Scope.t(), term()) :: term() | :ok | {:error, Wardrik.Error.t()}

Make an API token

The token acts for whoever makes it, and is kept as the SHA-256 of its secret. It works for 90 days, or expires_in seconds. It is no wider than its maker: each action its roles allow, on each resource it names, is one its maker may take there; it is held to its maker's policy where its maker is held to one; and it expires no later than its maker does.

POST /v1/tokens

list(scope, input \\ [])

@spec list(Wardrik.Scope.t(), term()) :: term() | :ok | {:error, Wardrik.Error.t()}

List the API tokens

Every token, oldest first, never a secret. With resources, only the tokens whose every resource the patterns cover, as acme/agent/* lists the tokens over acme's agents alone.

GET /v1/tokens

revoke(scope, token, input \\ [])

@spec revoke(Wardrik.Scope.t(), String.t() | struct(), term()) ::
  term() | :ok | {:error, Wardrik.Error.t()}

Revoke an API token

A revoked token is refused at once. An agent it defined keeps running, under the policy it was defined with.

DELETE /v1/tokens/{token}