auth

Documentation

Overview

Package auth generates and validates the per-install daemon secret. The secret lives at ~/.rmote/agent/secret (mode 0600). It authenticates the protected HTTP and WebSocket surfaces and derives short-lived local-preview tokens; health probes are public by design.

Index

• Variables
• func Compare(candidate string) (bool, error)
• func Ensure() (string, error)
• func Read() (string, error)

Variables

var ErrSecretMissing = errors.New("auth: secret not generated; call Ensure first")

ErrSecretMissing is returned by Read when no secret exists yet. Callers should call Ensure to generate one first.

Functions

func Compare

func Compare(candidate string) (bool, error)

Compare reports whether the provided candidate matches the persisted secret in constant time. Catches the "not installed" case as a definitive mismatch — never accidentally returns true on missing secret.

Constant-time note: subtle.ConstantTimeCompare short-circuits on length mismatch (returns 0 immediately), so candidate length is observable via timing. Acceptable here because (a) the secret length is a fixed 64 hex chars, and (b) the daemon is localhost-only and the auth boundary already gates a low-QPS metadata API. If we ever expose Compare to a wider audience, pad both sides to a fixed length first.

func Ensure

func Ensure() (string, error)

Ensure returns the existing secret, or generates + persists a new one. The first call after install is therefore privileged — subsequent callers read the same value. File mode 0600; dir mode 0700 (enforced by config).

func Read

func Read() (string, error)

Read loads the persisted secret. Returns ErrSecretMissing if the file does not exist — distinguishes "not installed" from "filesystem error".