raw

package
v0.0.0-...-0d745bf Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 5, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package raw provides a thin HTTP client and identity abstractions for speaking the BitBoxSync v1 protocol without local sync state management.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type APIError 

type APIError struct {
	// StatusCode is the HTTP status code returned by the server.
	StatusCode int
	// Message is the parsed JSON error string, when one was returned.
	Message string
}

APIError represents a non-2xx JSON error response from the server.

func (*APIError) Error 

func (e *APIError) Error() string

Error returns a human-readable description of an API error response.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client is a thin HTTP wrapper around the BitBoxSync API.

func New 

func New(baseURL string, httpClient *http.Client) (*Client, error)

New constructs a raw BitBoxSync API client for baseURL.

func (*Client) ApproveNamespaceJoinRequest 

func (c *Client) ApproveNamespaceJoinRequest(ctx context.Context, accessToken, namespaceID, keyID, joinRequestHash string, req protocol.ApproveNamespaceJoinRequestRequest) (*protocol.ApproveNamespaceJoinRequestResponse, error)

ApproveNamespaceJoinRequest approves one pending join request.

func (*Client) BaseURL 

func (c *Client) BaseURL() string

BaseURL returns the configured API base URL.

func (*Client) Challenge 

func (c *Client) Challenge(ctx context.Context, purpose string) (*protocol.ChallengeResponse, error)

Challenge requests a fresh authentication challenge for the given purpose.

func (*Client) CreateNamespaceInvite 

func (c *Client) CreateNamespaceInvite(ctx context.Context, accessToken, namespaceID string, req protocol.CreateNamespaceInviteRequest) (*protocol.CreateNamespaceInviteResponse, error)

CreateNamespaceInvite creates a short-lived invite for a shared namespace.

func (*Client) CreateSharedNamespace 

func (c *Client) CreateSharedNamespace(ctx context.Context, accessToken string, req protocol.CreateSharedNamespaceRequest) (*protocol.CreateSharedNamespaceResponse, error)

CreateSharedNamespace creates a shared namespace owned by the authenticated identity.

func (*Client) EnsureDefaultNamespace 

func (c *Client) EnsureDefaultNamespace(ctx context.Context, accessToken string, req protocol.EnsureDefaultNamespaceRequest) (*protocol.EnsureDefaultNamespaceResponse, error)

EnsureDefaultNamespace creates or returns the authenticated identity's default namespace.

func (*Client) GetDefaultNamespace 

func (c *Client) GetDefaultNamespace(ctx context.Context, accessToken string) (*protocol.DefaultNamespaceResponse, error)

GetDefaultNamespace returns the default namespace for the authenticated identity.

func (*Client) GetItem 

func (c *Client) GetItem(ctx context.Context, accessToken, namespaceID, itemID string) (*protocol.GetItemResponse, error)

GetItem fetches one encrypted item by namespace and item ID.

func (*Client) GetMembers 

func (c *Client) GetMembers(ctx context.Context, accessToken, namespaceID string) (*protocol.GetNamespaceMembersResponse, error)

GetMembers lists the members of a namespace.

func (*Client) GetNamespaceItems 

func (c *Client) GetNamespaceItems(ctx context.Context, accessToken, namespaceID string) (*protocol.GetNamespaceItemsResponse, error)

GetNamespaceItems returns the authoritative item/version snapshot for a namespace.

func (*Client) GetWrappedDEK 

func (c *Client) GetWrappedDEK(ctx context.Context, accessToken, namespaceID, keyID string) (*protocol.GetWrappedDEKResponse, error)

GetWrappedDEK fetches the wrapped namespace DEK for one member.

func (*Client) ListNamespaceInvites 

func (c *Client) ListNamespaceInvites(ctx context.Context, accessToken, namespaceID string) (*protocol.ListNamespaceInvitesResponse, error)

ListNamespaceInvites lists active and recently revoked namespace invites.

func (*Client) ListNamespaceJoinRequests 

func (c *Client) ListNamespaceJoinRequests(ctx context.Context, accessToken, namespaceID string) (*protocol.ListNamespaceJoinRequestsResponse, error)

ListNamespaceJoinRequests lists pending join requests for a namespace.

func (*Client) ListNamespaces 

func (c *Client) ListNamespaces(ctx context.Context, accessToken string) (*protocol.ListNamespacesResponse, error)

ListNamespaces lists all namespaces visible to the authenticated identity.

func (*Client) Login 

func (c *Client) Login(ctx context.Context, req protocol.LoginRequest) (*protocol.LoginResponse, error)

Login exchanges a signed login request for a bearer token.

func (*Client) PutItem 

func (c *Client) PutItem(ctx context.Context, accessToken, namespaceID, itemID string, req protocol.PutItemRequest, ifMatch *uint64) (*protocol.PutItemResponse, error)

PutItem creates or updates one encrypted item, optionally guarded by an If-Match version precondition.

func (*Client) Refresh 

func (c *Client) Refresh(ctx context.Context, accessToken string, req protocol.RefreshRequest) (*protocol.RefreshResponse, error)

Refresh exchanges a signed refresh request for a fresh bearer token.

func (*Client) RejectNamespaceJoinRequest 

func (c *Client) RejectNamespaceJoinRequest(ctx context.Context, accessToken, namespaceID, keyID, joinRequestHash string) (*protocol.RejectNamespaceJoinRequestResponse, error)

RejectNamespaceJoinRequest rejects one pending join request.

func (*Client) RevokeAllTokens 

func (c *Client) RevokeAllTokens(ctx context.Context, accessToken string, req protocol.RevokeAllTokensRequest) error

RevokeAllTokens revokes all bearer tokens for the authenticated identity.

func (*Client) RevokeNamespaceInvite 

func (c *Client) RevokeNamespaceInvite(ctx context.Context, accessToken, namespaceID, inviteID string) (*protocol.RevokeNamespaceInviteResponse, error)

RevokeNamespaceInvite revokes one namespace invite.

func (*Client) SensitiveActionChallenge 

func (c *Client) SensitiveActionChallenge(ctx context.Context, action, actionFieldsHash string) (*protocol.ChallengeResponse, error)

SensitiveActionChallenge requests a challenge bound to one sensitive action and canonical action-fields hash.

func (*Client) SubmitNamespaceJoinRequest 

func (c *Client) SubmitNamespaceJoinRequest(ctx context.Context, accessToken, namespaceID, inviteID string, req protocol.SubmitNamespaceJoinRequestRequest) (*protocol.SubmitNamespaceJoinRequestResponse, error)

SubmitNamespaceJoinRequest submits a signed join request through an invite.

func (*Client) WatchNamespaces 

func (c *Client) WatchNamespaces(ctx context.Context, accessToken string, req protocol.WatchNamespacesRequest) (*protocol.WatchNamespacesResponse, error)

WatchNamespaces waits until one of the authenticated identity's visible namespaces differs from req.KnownHeads, or until the server-side wait times out. The returned namespaces are advisory invalidation hints; clients must still reconcile through the normal namespace and item endpoints.

type DummyKeystore 

type DummyKeystore struct {
	// contains filtered or unexported fields
}

DummyKeystore is a deterministic software-only keystore-style Identity implementation used for demos and tests.

func NewDummyKeystore 

func NewDummyKeystore(label string) (*DummyKeystore, error)

NewDummyKeystore constructs a software-backed keystore Identity from a deterministic human-readable label.

func (*DummyKeystore) Attest 

func (d *DummyKeystore) Attest(_ context.Context, challenge []byte) ([]byte, error)

Attest returns the demo attestation payload for the dummy keystore.

func (*DummyKeystore) AuthPublicKey 

func (d *DummyKeystore) AuthPublicKey() ed25519.PublicKey

AuthPublicKey returns the authentication public key.

func (*DummyKeystore) Kind 

func (d *DummyKeystore) Kind() string

Kind returns the auth-key kind of the dummy keystore identity.

func (*DummyKeystore) SignCreateNamespaceInviteIntent 

func (d *DummyKeystore) SignCreateNamespaceInviteIntent(_ context.Context, challenge, namespaceID, inviteID, inviteServerSecretHash []byte, expiresAt int64, maxAccepted int) ([]byte, error)

SignCreateNamespaceInviteIntent signs the namespace-invite sensitive action for the dummy keystore.

func (*DummyKeystore) SignLoginIntent 

func (d *DummyKeystore) SignLoginIntent(_ context.Context, challenge []byte) ([]byte, error)

SignLoginIntent signs the canonical login intent for the dummy keystore.

func (*DummyKeystore) SignNamespaceJoinRequestIntent 

func (d *DummyKeystore) SignNamespaceJoinRequestIntent(_ context.Context, namespaceID, inviteID []byte, serverOrigin string, expiresAt int64) ([]byte, error)

SignNamespaceJoinRequestIntent signs a namespace join request for the dummy keystore.

func (*DummyKeystore) SignRefreshIntent 

func (d *DummyKeystore) SignRefreshIntent(_ context.Context, challenge []byte) ([]byte, error)

SignRefreshIntent signs the canonical refresh intent for the dummy keystore.

func (*DummyKeystore) SignRevokeAllTokensIntent 

func (d *DummyKeystore) SignRevokeAllTokensIntent(_ context.Context, challenge []byte) ([]byte, error)

SignRevokeAllTokensIntent signs the canonical revoke-all-tokens intent for the dummy keystore.

func (*DummyKeystore) UnwrapNamespaceDEK 

func (d *DummyKeystore) UnwrapNamespaceDEK(_ context.Context, namespaceID []byte, wrappedDEK []byte) ([]byte, error)

UnwrapNamespaceDEK unwraps a namespace DEK that was wrapped for this keystore identity.

func (*DummyKeystore) WrapPublicKey 

func (d *DummyKeystore) WrapPublicKey() *ecdh.PublicKey

WrapPublicKey returns the public key used for namespace DEK wrapping.

type Identity 

type Identity interface {
	// Kind returns the auth-key kind represented by this identity, such as
	// "keystore".
	Kind() string
	// AuthPublicKey returns the Ed25519 public key corresponding to the typed
	// signing methods below.
	// Implementations should return a defensive copy when the key representation
	// is mutable.
	AuthPublicKey() ed25519.PublicKey
	// WrapPublicKey returns the X25519 public key used to wrap namespace DEKs
	// for this identity. Implementations must return the key corresponding to
	// the private key used by UnwrapNamespaceDEK.
	WrapPublicKey() *ecdh.PublicKey
	// SignLoginIntent signs the canonical login intent for challenge.
	// Hardware implementations must display that BitBoxSync login is being
	// approved.
	SignLoginIntent(ctx context.Context, challenge []byte) ([]byte, error)
	// SignRefreshIntent signs the canonical refresh intent for challenge.
	// Hardware implementations must display that BitBoxSync session refresh is
	// being approved.
	SignRefreshIntent(ctx context.Context, challenge []byte) ([]byte, error)
	// SignRevokeAllTokensIntent signs the canonical sensitive-action intent for
	// revoking all bearer tokens owned by this identity. Hardware
	// implementations must display that all BitBoxSync sessions are being
	// revoked.
	SignRevokeAllTokensIntent(ctx context.Context, challenge []byte) ([]byte, error)
	// SignCreateNamespaceInviteIntent signs the canonical sensitive-action
	// intent for namespace invite creation. Hardware implementations must
	// display the namespace fingerprint, invite fingerprint, expiry, and accepted
	// member limit being approved.
	SignCreateNamespaceInviteIntent(ctx context.Context, challenge, namespaceID, inviteID, inviteServerSecretHash []byte, expiresAt int64, maxAccepted int) ([]byte, error)
	// SignNamespaceJoinRequestIntent signs the canonical join-request payload
	// for a scanned namespace invite. Hardware implementations must display the
	// server origin, namespace fingerprint, invite fingerprint, and expiry being
	// requested, and sign only the hash of that displayed canonical origin.
	SignNamespaceJoinRequestIntent(ctx context.Context, namespaceID, inviteID []byte, serverOrigin string, expiresAt int64) ([]byte, error)
	// Attest returns the identity's attestation proof for the supplied challenge.
	// Implementations that cannot attest should return an error.
	Attest(ctx context.Context, challenge []byte) ([]byte, error)
	// UnwrapNamespaceDEK unwraps a namespace DEK that was previously wrapped for
	// this identity. Implementations must reject wrapped payloads whose embedded
	// namespace binding does not match namespaceID.
	UnwrapNamespaceDEK(ctx context.Context, namespaceID []byte, wrappedDEK []byte) ([]byte, error)
}

Identity abstracts the key operations that must be provided by a client, regardless of whether the underlying keys live in hardware or app-local secure storage. Public key accessors are used by the library for engine state and token serialization. Signing methods are action-specific so hardware implementations can build the canonical protocol payload internally and display a user-verifiable BitBoxSync action before approval.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.