Skip to content

additional validation functions #192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
v0lkan merged 1 commit into from
Jan 19, 2026
+43 −3
Merged

additional validation functions #192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion hack/tag.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# \\\\\ Copyright 2024-present SPIKE contributors.
# \\\\\\\ SPDX-License-Identifier: Apache-2.0

VERSION="v0.19.6"
VERSION="v0.19.7"

git tag -s "$VERSION" -m "$VERSION"
git push origin --tags
3 changes: 1 addition & 2 deletions spiffe/spiffe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,8 @@ import (
"github.com/spiffe/go-spiffe/v2/spiffeid"
"github.com/spiffe/go-spiffe/v2/svid/x509svid"
"github.com/spiffe/go-spiffe/v2/workloadapi"
sdkErrors "github.com/spiffe/spike-sdk-go/errors"

"github.com/spiffe/spike-sdk-go/config/env"
sdkErrors "github.com/spiffe/spike-sdk-go/errors"
)

// EndpointSocket returns the UNIX domain socket address for the SPIFFE
Expand Down
41 changes: 41 additions & 0 deletions spiffeid/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ import (
"strings"

"github.com/spiffe/spike-sdk-go/config/env"
sdkErrors "github.com/spiffe/spike-sdk-go/errors"
"github.com/spiffe/spike-sdk-go/log"
)

// IsPilotOperator checks if a given SPIFFE ID matches the SPIKE Pilot
Expand Down Expand Up @@ -400,3 +402,42 @@ func PeerCanTalkToAnyone(_, _ string) bool {
func PeerCanTalkToKeeper(peerSPIFFEID string) bool {
return IsNexus(peerSPIFFEID) || IsBootstrap(peerSPIFFEID)
}

// IsPilotOperatorOrDie verifies if the provided SPIFFE ID belongs to a
// SPIKE Pilot instance. Logs a fatal error and exits if verification fails.
//
// SPIFFEID is the SPIFFE ID string to authenticate for pilot access.
func IsPilotOperatorOrDie(SPIFFEID string) {
const fName = "AuthenticateForPilot"
if !IsPilotOperator(SPIFFEID) {
failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
failErr.Msg = "you need a 'pilot' SPIFFE ID to use this command"
log.FatalErr(fName, failErr)
}
}

// IsPilotRecoverOrDie validates the SPIFFE ID for the recover role
// and exits the application if it does not match the recover SPIFFE ID.
//
// SPIFFEID is the SPIFFE ID string to authenticate for pilot recover access.
func IsPilotRecoverOrDie(SPIFFEID string) {
const fName = "AuthenticateForPilotRecover"
if !IsPilotRecover(SPIFFEID) {
failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
failErr.Msg = "you need a 'recover' SPIFFE ID to use this command"
log.FatalErr(fName, failErr)
}
}

// IsPilotRestoreOrDie verifies if the given SPIFFE ID is valid for
// restoration. Logs a fatal error and exits if the SPIFFE ID validation fails.
//
// SPIFFEID is the SPIFFE ID string to authenticate for restore access.
func IsPilotRestoreOrDie(SPIFFEID string) {
const fName = "AuthenticateForPilotRestore"
if !IsPilotRestore(SPIFFEID) {
failErr := *sdkErrors.ErrAccessUnauthorized.Clone()
failErr.Msg = "you need a 'restore' SPIFFE ID to use this command"
log.FatalErr(fName, failErr)
}
}