registry

Documentation

Overview

Package registry turns a root-verified ssp.registry.v1 envelope into the provider-neutral authorization model used by admission and projections.

Index

• Variables
• type DomainRoute
• type EdgeRecord
• type EpochVerdict
• type KeyRecord
  • func (k KeyRecord) Usable(at time.Time) bool
• type KeyUsage
• type PrincipalRecord
• type Registry
  • func (r Registry) AuthorKeyID() string
  • func (r Registry) AuthorizesCaseIssuer(domain, edgeID string) bool
  • func (r Registry) AuthorizesCaseIssuerGeneration(domain, edgeID string, generation int64) bool
  • func (r Registry) CheckBinding(revision int64, commitment string) error
  • func (r Registry) Commitment() string
  • func (r Registry) Domain(domain string) (DomainRoute, bool)
  • func (r Registry) Domains() []DomainRoute
  • func (r Registry) Edge(id string) (EdgeRecord, bool)
  • func (r Registry) Edges() []EdgeRecord
  • func (r Registry) EvaluateEpoch(domain string, envelopeRoutingEpoch int64) (EpochVerdict, error)
  • func (r Registry) Expired(at time.Time) bool
  • func (r Registry) ExpiresAt() time.Time
  • func (r Registry) Key(id string) (KeyRecord, bool)
  • func (r Registry) Keys() []KeyRecord
  • func (r Registry) MachineAcceptableEpoch(domain string, envelopeRoutingEpoch int64) bool
  • func (r Registry) PreviousCommitment() string
  • func (r Registry) Principal(id string) (PrincipalRecord, bool)
  • func (r Registry) Principals() []PrincipalRecord
  • func (r Registry) Revision() int64
  • func (r Registry) RoutingEpoch() int64
  • func (r Registry) SigningKeyFor(principalID string, usage KeyUsage, at time.Time) (KeyRecord, bool)
• type Trust
  • func NewTrust(authorKeyID string, publicKey ed25519.PublicKey) (Trust, error)
• type Verified
  • func (v Verified) Commitment() (string, error)
  • func (v Verified) Revision() (int64, error)
  • func (v Verified) Snapshot() (Registry, error)
• type Verifier
  • func NewVerifier(trust Trust, clock func() time.Time) (*Verifier, error)
  • func (v *Verifier) Verify(raw []byte) (Verified, error)

Variables

var ErrUnknownDomain = errors.New("registry: unknown domain")

ErrUnknownDomain reports that a domain is absent from the snapshot.

var ErrUnverified = errors.New("registry: candidate was not verified")

Types

type DomainRoute

type DomainRoute struct {
	Domain                 string
	DispatcherPrincipalID  string
	IssuerEdgeIDs          []string
	SpecialistPrincipalIDs []string
	Families               []string
	RoutingEpoch           int64
}

type EdgeRecord

type EdgeRecord struct {
	EdgeID      string
	Generation  int64
	PrincipalID string
}

type EpochVerdict

type EpochVerdict string

EpochVerdict is the result of fencing an envelope against a domain's current routing epoch.

const (
	// EpochCurrent means the envelope was authored under the routing epoch this
	// domain is currently on. Only these may be machine-accepted.
	EpochCurrent EpochVerdict = "current"
	// EpochHistorical means the envelope predates a dispatcher change. It stays
	// readable as history and must never be machine-accepted for a live case:
	// that is the whole point of bumping the epoch when a dispatcher rotates.
	EpochHistorical EpochVerdict = "historical"
	// EpochFuture means the envelope names a newer epoch than this edge knows
	// about, so our registry is stale. It fails closed rather than being
	// treated as current, because we cannot evaluate authority under an epoch we
	// have not seen.
	EpochFuture EpochVerdict = "future"
)

type KeyRecord

type KeyRecord struct {
	KeyID       string
	PublicKey   ed25519.PublicKey
	PrincipalID string
	Usage       KeyUsage
	NotBefore   time.Time
	ExpiresAt   time.Time
	RevokedAt   *time.Time
}

func (KeyRecord) Usable

func (k KeyRecord) Usable(at time.Time) bool

type KeyUsage

type KeyUsage string

const (
	UsageAdvice   KeyUsage = "advice"
	UsageEdge     KeyUsage = "edge"
	UsageRegistry KeyUsage = "registry"
)

type PrincipalRecord

type PrincipalRecord struct {
	PrincipalID string
	Roles       []string
	SSPKeyIDs   []string
	EdgeIDs     []string
}

type Registry

type Registry struct {
	// contains filtered or unexported fields
}

func (Registry) AuthorKeyID

func (r Registry) AuthorKeyID() string

func (Registry) AuthorizesCaseIssuer

func (r Registry) AuthorizesCaseIssuer(domain, edgeID string) bool

func (Registry) AuthorizesCaseIssuerGeneration

func (r Registry) AuthorizesCaseIssuerGeneration(domain, edgeID string, generation int64) bool

AuthorizesCaseIssuerGeneration requires both route membership and the currently registered enrollment generation. An edge ID alone cannot fence a stale installation.

func (Registry) CheckBinding

func (r Registry) CheckBinding(revision int64, commitment string) error

CheckBinding verifies that an envelope's registry commitment names exactly this snapshot.

The revision-match-hash-mismatch case is the one that matters: an envelope naming our revision with a different commitment was authored against a different snapshot at that revision, which is precisely the equivocation the store refuses to accept. It fails closed rather than being treated as a version skew.

func (Registry) Commitment

func (r Registry) Commitment() string

func (Registry) Domain

func (r Registry) Domain(domain string) (DomainRoute, bool)

func (Registry) Domains

func (r Registry) Domains() []DomainRoute

func (Registry) Edge

func (r Registry) Edge(id string) (EdgeRecord, bool)

func (Registry) Edges

func (r Registry) Edges() []EdgeRecord

func (Registry) EvaluateEpoch

func (r Registry) EvaluateEpoch(domain string, envelopeRoutingEpoch int64) (EpochVerdict, error)

EvaluateEpoch fences an envelope's routing epoch against a domain route.

func (Registry) Expired

func (r Registry) Expired(at time.Time) bool

Expired reports whether the snapshot's own validity window has passed.

An expired snapshot is not automatically useless: display of existing advice continues on last-known authority, while anything that causes an effect must fail closed. Callers make that distinction; this only reports the fact.

func (Registry) ExpiresAt

func (r Registry) ExpiresAt() time.Time

func (Registry) Key

func (r Registry) Key(id string) (KeyRecord, bool)

func (Registry) Keys

func (r Registry) Keys() []KeyRecord

func (Registry) MachineAcceptableEpoch

func (r Registry) MachineAcceptableEpoch(domain string, envelopeRoutingEpoch int64) bool

MachineAcceptableEpoch reports whether an envelope's routing epoch permits machine acceptance for a live case. Anything other than the current epoch is refused, including a future one.

func (Registry) PreviousCommitment

func (r Registry) PreviousCommitment() string

func (Registry) Principal

func (r Registry) Principal(id string) (PrincipalRecord, bool)

func (Registry) Principals

func (r Registry) Principals() []PrincipalRecord

func (Registry) Revision

func (r Registry) Revision() int64

func (Registry) RoutingEpoch

func (r Registry) RoutingEpoch() int64

func (Registry) SigningKeyFor

func (r Registry) SigningKeyFor(principalID string, usage KeyUsage, at time.Time) (KeyRecord, bool)

type Trust

type Trust struct {
	// contains filtered or unexported fields
}

Trust is the deployment-pinned root used only to authenticate registry artifacts. PostgreSQL, not this in-process verifier, owns accepted history.

func NewTrust

func NewTrust(authorKeyID string, publicKey ed25519.PublicKey) (Trust, error)

type Verified

type Verified struct {
	// contains filtered or unexported fields
}

Verified is immutable evidence produced by one root-verification operation. It carries no acceptance or delivery position; those are authority concerns.

func (Verified) Commitment

func (v Verified) Commitment() (string, error)

func (Verified) Revision

func (v Verified) Revision() (int64, error)

func (Verified) Snapshot

func (v Verified) Snapshot() (Registry, error)

Snapshot returns a defensive copy of the independently verified registry.

type Verifier

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier authenticates and decodes registry bytes against a pinned root. It deliberately has no apply, current, history, or broker-position API.

func NewVerifier

func NewVerifier(trust Trust, clock func() time.Time) (*Verifier, error)

func (*Verifier) Verify

func (v *Verifier) Verify(raw []byte) (Verified, error)