credential

Documentation

Index

• Constants
• Variables
• func CredentialID(token string) (string, bool)
• func DecodePublicKey(value string) (ed25519.PublicKey, error)
• func DefaultJWTIdentity(claims *jwtauth.Claims) (auth.ExternalIdentity, error)
• func EncodePrivateKey(privateKey ed25519.PrivateKey) string
• func EncodePublicKey(publicKey ed25519.PublicKey) string
• func SignAPIKey(id string, privateKey ed25519.PrivateKey) (string, error)
• func SignAssertion(id string, privateKey ed25519.PrivateKey, requestedScopes []string, ...) (string, error)
• type APIKeyClaims
  • func VerifyAPIKey(token string, publicKey ed25519.PublicKey, now time.Time) (*APIKeyClaims, error)
• type APIKeyExchanger
  • func (e APIKeyExchanger) ExchangeCredential(ctx context.Context, credential string) (Result, error)
• type APIKeyLookup
• type APIKeyRecord
• type Chain
  • func (c Chain) ExchangeCredential(ctx context.Context, credential string) (Result, error)
• type Exchanger
• type ExchangerFunc
  • func (f ExchangerFunc) ExchangeCredential(ctx context.Context, credential string) (Result, error)
• type Keypair
  • func GenerateKeypair() (Keypair, error)
• type OIDCJWTExchanger
  • func (e OIDCJWTExchanger) ExchangeCredential(ctx context.Context, credential string) (Result, error)
• type Result

Constants

const CredentialIDPrefix = "apic_"

const DefaultAPIKeyIssuer = "api-key"

Variables

var (
	ErrUnsupported = errors.New("credential: unsupported credential")
	ErrInvalid     = errors.New("credential: invalid credential")
)

Functions

func CredentialID

func CredentialID(token string) (string, bool)

CredentialID returns the key ID from a signed API credential.

func DecodePublicKey

func DecodePublicKey(value string) (ed25519.PublicKey, error)

DecodePublicKey decodes a base64 Ed25519 public key.

func DefaultJWTIdentity

func DefaultJWTIdentity(claims *jwtauth.Claims) (auth.ExternalIdentity, error)

DefaultJWTIdentity maps verified JWT claims to an upstream identity.

func EncodePrivateKey

func EncodePrivateKey(privateKey ed25519.PrivateKey) string

EncodePrivateKey encodes an Ed25519 private key for display/storage.

func EncodePublicKey

func EncodePublicKey(publicKey ed25519.PublicKey) string

EncodePublicKey encodes an Ed25519 public key for storage.

func SignAPIKey

func SignAPIKey(id string, privateKey ed25519.PrivateKey) (string, error)

SignAPIKey signs a long-lived API key credential.

func SignAssertion

func SignAssertion(id string, privateKey ed25519.PrivateKey, requestedScopes []string, expiresAt time.Time) (string, error)

SignAssertion signs a short-lived API credential assertion.

Types

type APIKeyClaims

type APIKeyClaims struct {
	RequestedScopes []string `json:"requested_scopes,omitempty"`
	josejwt.Claims
}

APIKeyClaims are optional claims on an API key or signed API assertion.

func VerifyAPIKey

func VerifyAPIKey(token string, publicKey ed25519.PublicKey, now time.Time) (*APIKeyClaims, error)

VerifyAPIKey verifies an API key credential with publicKey.

type APIKeyExchanger

type APIKeyExchanger struct {
	Lookup APIKeyLookup
	Issuer string
	Now    func() time.Time
}

APIKeyExchanger verifies Ed25519 API key credentials.

func (APIKeyExchanger) ExchangeCredential

func (e APIKeyExchanger) ExchangeCredential(ctx context.Context, credential string) (Result, error)

ExchangeCredential implements Exchanger.

type APIKeyLookup

type APIKeyLookup func(context.Context, string) (APIKeyRecord, error)

APIKeyLookup loads an API key record by credential ID.

type APIKeyRecord

type APIKeyRecord struct {
	ID        string
	PublicKey ed25519.PublicKey
	Claims    map[string]any
}

APIKeyRecord is returned by APIKeyLookup.

type Chain

type Chain []Exchanger

Chain tries exchangers in order until one supports the credential.

func (Chain) ExchangeCredential

func (c Chain) ExchangeCredential(ctx context.Context, credential string) (Result, error)

ExchangeCredential implements Exchanger.

type Exchanger

type Exchanger interface {
	ExchangeCredential(context.Context, string) (Result, error)
}

Exchanger verifies a presented credential and returns its upstream identity.

type ExchangerFunc

type ExchangerFunc func(context.Context, string) (Result, error)

ExchangerFunc adapts a function into an Exchanger.

func (ExchangerFunc) ExchangeCredential

func (f ExchangerFunc) ExchangeCredential(ctx context.Context, credential string) (Result, error)

ExchangeCredential implements Exchanger.

type Keypair

type Keypair struct {
	ID         string
	PublicKey  ed25519.PublicKey
	PrivateKey ed25519.PrivateKey
}

Keypair is a generated Ed25519 API credential keypair.

func GenerateKeypair

func GenerateKeypair() (Keypair, error)

GenerateKeypair returns a new API credential keypair.

type OIDCJWTExchanger

type OIDCJWTExchanger struct {
	Verifier *jwtauth.Verifier
	Map      func(*jwtauth.Claims) (auth.ExternalIdentity, error)
}

OIDCJWTExchanger verifies an OIDC JWT credential.

func (OIDCJWTExchanger) ExchangeCredential

func (e OIDCJWTExchanger) ExchangeCredential(ctx context.Context, credential string) (Result, error)

ExchangeCredential implements Exchanger.

type Result

type Result struct {
	ExternalIdentity auth.ExternalIdentity
	RequestedScopes  []string
}

Result is the verified upstream identity from a credential exchange.