trust

Documentation

Overview

Package trust implements mymcp's mTLS authentication: a directory tree of PEM files (hand-manageable, no database) plus a TOFU pending queue. See DESIGN.md.

<root>/authorities/  trusted CA certs (one PEM per CA)
<root>/pinned/       exact leaf certs (self-authenticating)
<root>/pending/      unknown certs captured at handshake, awaiting approval

This layer answers "is this certificate authentic?" only. Authorization (what the CN may do) lives in package policy.

Index

• type Decision
• type Entry
• type Store
  • func Load(root string, seedCAPaths []string, logger *log.Logger) (*Store, error)
  • func (s *Store) ApproveAuthority(fpPrefix string) (Entry, error)
  • func (s *Store) Authorities() ([]Entry, error)
  • func (s *Store) Check(chain []*x509.Certificate) Decision
  • func (s *Store) Pending() ([]Entry, error)
  • func (s *Store) Pin(fpPrefix string) (Entry, error)
  • func (s *Store) Pins() ([]Entry, error)
  • func (s *Store) Verify(rawCerts [][]byte, _ [][]*x509.Certificate) error

Types

type Decision

type Decision struct {
	Trusted     bool
	CN          string
	Fingerprint string
}

Decision is the result of Check: whether a presented client chain is on the approved list, plus the leaf's identity — without rejecting the connection.

type Entry

type Entry struct {
	Fingerprint string
	CN          string
	Issuer      string
	NotAfter    time.Time
	IsCA        bool
	Path        string
}

Entry describes a certificate for listing.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store is a directory-backed mTLS trust store.

func Load

func Load(root string, seedCAPaths []string, logger *log.Logger) (*Store, error)

Load builds a Store rooted at root, creating subdirectories if absent. seedCAPaths are optional always-trusted CA PEM files (e.g. a corporate CA).

func (*Store) ApproveAuthority

func (s *Store) ApproveAuthority(fpPrefix string) (Entry, error)

ApproveAuthority trusts the CA(s) from a pending cert's chain.

func (*Store) Authorities

func (s *Store) Authorities() ([]Entry, error)

Authorities lists trusted CA certs.

func (*Store) Check

func (s *Store) Check(chain []*x509.Certificate) Decision

Check classifies a presented client chain (leaf first) as approved or not, recording a pending entry for out-of-band approval when it is not. Unlike Verify it never rejects the connection — use it when the TLS handshake is allowed to complete and the decision is made at the application layer (e.g. to serve a "pending approval" page to unapproved clients).

func (*Store) Pending

func (s *Store) Pending() ([]Entry, error)

Pending lists certs awaiting approval.

func (*Store) Pin

func (s *Store) Pin(fpPrefix string) (Entry, error)

Pin adds a pending leaf as an exact pin.

func (*Store) Pins

func (s *Store) Pins() ([]Entry, error)

Pins lists pinned leaf certs.

func (*Store) Verify

func (s *Store) Verify(rawCerts [][]byte, _ [][]*x509.Certificate) error

Verify is installed as tls.Config.VerifyPeerCertificate. It authenticates the presented chain (leaf first): accepted if the leaf is pinned or chains to a trusted authority; otherwise queued to pending/ and rejected.