security

Documentation

Overview

Package security provides authenticated subject isolation helpers.

Index

• Constants
• func RequireSubject(ctx context.Context, owner string) error
• func SubjectFromContext(ctx context.Context) string
• type OwnedRecord
• type RequestStateClaims
• type RequestStateSigner
  • func NewRandomRequestStateSigner() (*RequestStateSigner, error)
  • func NewRequestStateSigner(key []byte) (*RequestStateSigner, error)
  • func (s *RequestStateSigner) Sign(claims RequestStateClaims) (string, error)
  • func (s *RequestStateSigner) Verify(token string) (RequestStateClaims, error)
• type Store
  • func (s *Store[T]) Get(ctx context.Context, id string) (T, bool, error)
  • func (s *Store[T]) Put(ctx context.Context, id string, value T)

Constants

const LocalSubject = "local-stdio"

LocalSubject is the shared subject for unauthenticated local transports.

Functions

func RequireSubject

func RequireSubject(ctx context.Context, owner string) error

RequireSubject verifies ownership without revealing cross-subject objects.

func SubjectFromContext

func SubjectFromContext(ctx context.Context) string

SubjectFromContext returns the authenticated subject or the local transport subject.

Types

type OwnedRecord

type OwnedRecord[T any] struct {
	ID        string
	Owner     string
	CreatedAt time.Time
	Value     T
}

OwnedRecord is a value associated with the subject that created it.

type RequestStateClaims

type RequestStateClaims struct {
	Version     int             `json:"version"`
	Subject     string          `json:"subject"`
	Operation   string          `json:"operation"`
	InputDigest string          `json:"inputDigest"`
	PlanDigest  string          `json:"planDigest"`
	ExpiresAt   int64           `json:"expiresAt"`
	Data        json.RawMessage `json:"data,omitempty"`
}

RequestStateClaims binds an MCP multi-round-trip retry to the operation that requested input.

type RequestStateSigner

type RequestStateSigner struct {
	// contains filtered or unexported fields
}

RequestStateSigner signs and verifies opaque MCP multi-round-trip request state.

func NewRandomRequestStateSigner

func NewRandomRequestStateSigner() (*RequestStateSigner, error)

NewRandomRequestStateSigner constructs a signer with a process-local random key.

func NewRequestStateSigner

func NewRequestStateSigner(key []byte) (*RequestStateSigner, error)

NewRequestStateSigner constructs a signer from key. The key must contain at least 32 bytes.

func (*RequestStateSigner) Sign

func (s *RequestStateSigner) Sign(claims RequestStateClaims) (string, error)

Sign returns integrity-protected opaque request state.

func (*RequestStateSigner) Verify

func (s *RequestStateSigner) Verify(token string) (RequestStateClaims, error)

Verify authenticates and decodes opaque request state.

type Store

type Store[T any] struct {
	// contains filtered or unexported fields
}

Store is an in-memory subject-isolated record store.

func (*Store[T]) Get

func (s *Store[T]) Get(ctx context.Context, id string) (T, bool, error)

Get returns a value only when it belongs to the current subject.

func (*Store[T]) Put

func (s *Store[T]) Put(ctx context.Context, id string, value T)

Put stores value under id for the current subject.