Versions in this module Expand all Collapse all v0 v0.1.1 Jul 17, 2026 Changes in this version + const ActionClarificationResponse + const ActionUpdatedRequest + const ContentDigestAlg + const DefaultSignatureLabel + const HeaderLocation + const HeaderPrefer + const HeaderRequirement + const HeaderRetryAfter + const HeaderSignature + const HeaderSignatureError + const HeaderSignatureInput + const HeaderSignatureKey + const MaxAgentTokenTTLSeconds + const PermissionDenied + const PermissionGranted + const RequirementAgentToken + const RequirementAuthToken + const RequirementClaims + const RequirementClarification + const RequirementInteraction + const SigErrExpiredSignature + const SigErrInvalidInput + const SigErrInvalidKey + const SigErrInvalidSignature + const SigErrKeyNotFound + const SigErrUnsupportedAlgorithm + const TypAgent + const TypAuth + const TypResource + const WellKnownAccess + const WellKnownAgent + const WellKnownPerson + const WellKnownResource + var ErrBadSigKey = errors.New("aauth: malformed Signature-Key header") + var ErrExpired = errors.New("aauth: token expired") + var ErrInvalidToken = errors.New("aauth: invalid token") + var ErrMissingClaim = errors.New("aauth: required claim missing") + var ErrMissingSigKey = errors.New("aauth: missing Signature-Key header") + var ErrSignatureInvalid = errors.New("aauth: signature invalid") + var ErrSubAgentDirect = errors.New("aauth: sub-agent must not request authorization directly") + var ErrUnknownAction = errors.New("aauth: missing or unrecognized action") + var ErrWrongTokenType = errors.New("aauth: wrong token type") + func AttachSignatureKey(req *http.Request, token string) + func ChainInteraction(w http.ResponseWriter, pendingURL, interactionURL, code string) + func ChallengeAuthToken(w http.ResponseWriter, resourceToken string) + func DoDeferred(ctx context.Context, hc *http.Client, req *http.Request, opts DeferredOptions) (*http.Response, error) + func FetchMetadata(ctx context.Context, hc *http.Client, base, doc string, dst any) error + func FollowDeferred(ctx context.Context, hc *http.Client, reqURL *url.URL, res *http.Response, ...) (*http.Response, error) + func IssueResourceToken(resourceURL, audience string, agent *AgentClaims, scope string, ...) (string, error) + func MintAgentToken(claims AgentClaims, priv ed25519.PrivateKey, kid string) (string, error) + func MintAuthToken(claims AuthClaims, priv ed25519.PrivateKey, kid string) (string, error) + func MintResourceToken(claims ResourceClaims, priv ed25519.PrivateKey, kid string) (string, error) + func ParseSignatureKey(req *http.Request) (string, error) + func SignRequest(req *http.Request, priv ed25519.PrivateKey, keyid string) error + func VerifyRequest(req *http.Request, pub ed25519.PublicKey) error + func WriteClarification(w http.ResponseWriter, pendingURL, question string, timeout int, ...) + func WriteMissionStatusError(w http.ResponseWriter, missionStatus string) + func WriteSignatureError(w http.ResponseWriter, status int, e SignatureError, detail string) + type ActClaim struct + Act *ActClaim + Agent string + func NextAct(upstreamAgent string, upstreamAct *ActClaim) *ActClaim + func (a *ActClaim) Delegators() []string + type Agent struct + ID AgentIdentifier + Issuer string + PS string + Priv ed25519.PrivateKey + Pub ed25519.PublicKey + TokenTTL time.Duration + func NewAgent(id AgentIdentifier, opts ...AgentOption) (*Agent, error) + func (a *Agent) JWK() JWK + func (a *Agent) JWKS() JWKS + func (a *Agent) MintSubAgentToken(discriminator string) (string, error) + func (a *Agent) MintToken() (string, error) + func (a *Agent) Thumbprint() string + type AgentClaims struct + Cnf Cnf + DWK string + PS string + ParentAgent string + func VerifyAgentToken(ctx context.Context, token string, opts VerifyAgentTokenOptions) (*AgentClaims, error) + func VerifyAndExtractAgent(ctx context.Context, req *http.Request, opts VerifyAgentTokenOptions) (*AgentClaims, error) + func (c *AgentClaims) IsSubAgent() bool + type AgentIdentifier struct + Discriminator string + Domain string + Name string + func ParseAgentIdentifier(s string) (AgentIdentifier, error) + func (a AgentIdentifier) IsSubAgent() bool + func (a AgentIdentifier) Parent() (AgentIdentifier, error) + func (a AgentIdentifier) String() string + func (a AgentIdentifier) SubAgent(discriminator string) (AgentIdentifier, error) + type AgentOption func(*Agent) + func WithIssuer(iss string) AgentOption + func WithKey(priv ed25519.PrivateKey) AgentOption + func WithPersonServer(ps string) AgentOption + func WithTokenTTL(d time.Duration) AgentOption + type AgentProviderMetadata struct + Issuer string + JWKSURI string + type AuditRequest struct + Action string + Description string + Mission MissionRef + Parameters map[string]any + Result map[string]any + type AuthClaims struct + Act *ActClaim + Agent string + Cnf Cnf + DWK string + Mission *MissionRef + Scope string + Tenant string + func VerifyAndExtractAuth(ctx context.Context, req *http.Request, resourceURL string, ...) (*AuthClaims, error) + func VerifyAuthToken(ctx context.Context, token, resourceURL string, resolver KeyResolver) (*AuthClaims, error) + type ChainRouter struct + Endpoint string + Governed bool + UpstreamToken string + func RouteDownstream(upstream *AuthClaims, rawUpstream string, isPS func(iss string) bool) (ChainRouter, error) + type Clarification struct + Options []string + Question string + Timeout int + type ClarificationPost struct + Action string + ClarificationResponse string + Justification string + ResourceToken string + func ParseClarificationPost(r *http.Request) (*ClarificationPost, error) + type ClarificationReply struct + Cancel bool + Justification string + ResourceToken string + Text string + type Cnf struct + JKT string + JWK *JWK + type DeferredOptions struct + DefaultPollInterval time.Duration + MaxPolls int + OnClarification func(Clarification) (ClarificationReply, error) + OnRequirement func(Requirement) + PreferWaitSeconds int + Sign func(*http.Request) error + type JWK struct + Alg string + Crv string + Kid string + Kty string + Use string + X string + func NewEd25519JWK(pub ed25519.PublicKey) JWK + func (j JWK) PublicKey() (ed25519.PublicKey, error) + func (j JWK) Thumbprint() string + type JWKS struct + Keys []JWK + type JWKSResolver struct + HTTPClient *http.Client + func (r JWKSResolver) ResolveKey(ctx context.Context, iss, dwk, kid string, _ *JWK) (ed25519.PublicKey, error) + type KeyResolver interface + ResolveKey func(ctx context.Context, iss, dwk, kid string, cnf *JWK) (ed25519.PublicKey, error) + type MissionRef struct + Approver string + S256 string + type MissionStatusError struct + Code string + MissionStatus string + func (e *MissionStatusError) Error() string + type PSClient struct + Agent *Agent + AuditEndpoint string + BaseURL string + HTTPClient *http.Client + OnClarification func(Clarification) (ClarificationReply, error) + OnRequirement func(Requirement) + PermissionEndpoint string + PreferWaitSeconds int + TokenEndpoint string + func NewPSClient(baseURL string, agent *Agent) *PSClient + func (c *PSClient) Audit(ctx context.Context, a AuditRequest) error + func (c *PSClient) ExchangeToken(ctx context.Context, treq TokenRequest) (*TokenResponse, error) + func (c *PSClient) RequestPermission(ctx context.Context, p PermissionRequest) (*PermissionResponse, error) + type PendingStatus struct + Clarification string + Options []string + Status string + Timeout int + type PermissionRequest struct + Action string + Description string + Mission *MissionRef + Parameters map[string]any + type PermissionResponse struct + Permission string + Reason string + func (r *PermissionResponse) Granted() bool + type PersonServerMetadata struct + AuditEndpoint string + InteractionEndpoint string + Issuer string + JWKSURI string + MissionEndpoint string + PermissionEndpoint string + TokenEndpoint string + type Requirement struct + Code string + Requirement string + ResourceToken string + URL string + func ParseRequirement(v string) (Requirement, error) + func (r Requirement) String() string + type ResourceClaims struct + Agent string + AgentJKT string + DWK string + Interaction *ResourceInteraction + Mission *MissionRef + Scope string + func VerifyResourceChallenge(token, resourceURL string, agent *Agent) (*ResourceClaims, error) + func VerifyResourceToken(ctx context.Context, token, audience string, agent *AgentClaims, ...) (*ResourceClaims, error) + type ResourceInteraction struct + Code string + URL string + type ResourceMetadata struct + AccessMode string + AdditionalSignatureComponents []string + AuthorizationEndpoint string + Issuer string + JWKSURI string + type SelfSignedResolver struct + func (SelfSignedResolver) ResolveKey(_ context.Context, _, _, _ string, cnf *JWK) (ed25519.PublicKey, error) + type SignatureError struct + Code string + Params map[string]string + func ParseSignatureError(v string) (*SignatureError, error) + func SignatureErrorFromResponse(res *http.Response) (*SignatureError, error) + func (e *SignatureError) Error() string + func (e SignatureError) String() string + type StaticResolver map[string]JWKS + func (r StaticResolver) ResolveKey(_ context.Context, iss, _, kid string, _ *JWK) (ed25519.PublicKey, error) + type TokenRequest struct + Capabilities []string + Device string + DomainHint string + Justification string + LoginHint string + Platform string + Prompt string + ResourceToken string + SubagentToken string + Tenant string + UpstreamToken string + type TokenResponse struct + AuthToken string + ExpiresIn int64 + type Transport struct + Agent *Agent + Base http.RoundTripper + ExpiryLeeway time.Duration + MaxBodyBytes int64 + OnRequirement func(Requirement) + PS *PSClient + func NewTransport(agent *Agent, ps *PSClient) *Transport + func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) + type VerifyAgentTokenOptions struct + RequireProviderClaims bool + Resolver KeyResolver
Go to main page