Help us shape the future of Go! Take the 2026 Go Developer Survey

passkey

package module
v0.0.0-...-935ddaf Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 25, 2026 License: MIT Imports: 15 Imported by: 0

README

go-passkey

Experimental, incomplete and unreleased. Selected native existing-account enrollment, identified/discoverable signin and session APIs exist. Passkey-first signup, complete management and platform qualification remain work.

go-passkey implements the Golib boundary for identity-facing passkey enrolment, discoverable credentials, passwordless signup and sign-in, synced and backup state, credential naming, listing, deletion, and passkey-first policy. The plan keeps those concepts separate from WebAuthn verification, browser interfaces, non-discoverable security-key policy, and session persistence.

Current API

SigninResult.Challenge is the explicit, private TOTP challenge alternative to Session and CSRF. It carries the original child identity and expiry; its proof is available only to the fresh committed native winner. Replays never renew that proof or reveal session credentials. These transport records grant no assertion, factor or session authority: selecting and executing the native MFA composition remains the PostgreSQL owner's responsibility. Existing known-empty-factor signin and signup APIs keep their behavior.

  • ConditionalAssertionOptions explicitly projects an existing anonymous discoverable assertion as {mediation:"conditional",publicKey:...}. It retains the protocol owner's original ceremony, UV requirements, expiry and reveal-once challenge custody; copies share the same reveal. It is not a new server authentication mode or proof that a browser used conditional UI. Native conditional option methods and ordinary DiscoverableSignin compose the real session path; browser UI and interoperability remain separate.
  • SignupRequest, SignupCompletion, SignupResult and KeyedSignupOptionsRequest carry adapter-neutral intent and secret custody for an explicitly enabled no-email/no-password passkey-first profile. They cannot select a user, RP, tenant, actor or proof, and do not implement signup. Keep the original session-owned flow, cookie and remember policy, trusted ingress and each phase's original command on retries. Keyed options require an empty incoming command ID and reuse KeyedRegistrationOptionsResult; only its fresh committed winner may reveal options. Completion borrows raw response bytes: the native owner must bound and copy them before parsing or retaining them. Actual resident-required, UV-required, none-attestation verification under the exact selected algorithm profile must precede coherent account/credential/MFA/session creation. No authentication or CSRF secret may be returned before acknowledged commit or from an aborted, unknown or historical result. Implicit JSON/text export is denied and ordinary formatting is redacted; explicit fields are still sensitive and are not an audit or wire projection.
  • DeleteRequest/DeleteResult carry keyed self-user removal intent and original durability metadata only. Use the safe List reference and metadata version, leave primary command/record IDs empty and preserve exact input/custody on retries. Native execution must require genuine identity.passkey.delete proof and current usable recovery authority, then remove protocol/reference authority and emit required lifecycle effects atomically. The records grant no authority, return no credentials and do not claim authenticator-local erasure; matching retries recover metadata without repeating effects.
  • UpdateRequest/UpdateResult carry keyed self-user label-management intent and original durability metadata without importing a database. Use the safe List reference and its management metadata version, not RP credential bytes or authority versions. This keyed native profile requires empty incoming primary command/record IDs: the existing request-key owner allocates the one original command before genuine identity.passkey.update action-proof preparation. That original ID is returned for fresh execution, replay and recovery. Matching retries carry identical custody/input and return metadata only; no proof, mutation or required effect is repeated. Native implementation remains a separate adapter boundary; these records grant no execution authority.
  • Enrollment, identified/discoverable signin, keyed-options and inventory request/result records live in the root module for adapter-neutral transport ports. The PostgreSQL names are exact aliases, so no conversion is needed. Their established diagnostic labels and serialization errors are unchanged; reflection reports github.com/faustbrian/go-passkey as their defining package. RegistrationRequest.Primary is the password owner's neutral password.ActionPrimaryRequest. These data records select no database, configuration, runtime store or transport.
  • CeremonyRateSource carries only an original ceremony ID, immutable original policy lifetime and one user, identifier or anonymous-flow rate dimension. It is sensitive metadata, not an authentication result or validity lease. Consumed historical metadata cannot authorize another native mutation or reveal. Implicit JSON/text serialization and ordinary diagnostics redact it. SignupCeremonyRateRequest borrows the original signup browser request and committed ceremony ID; native reads return only the original anonymous-flow dimension, never the prospective identity or an authenticated user.
  • UserHandlePolicy.Generate creates a random opaque 32-byte handle for first enrollment. Persist and reuse the first committed identity/RP mapping; never regenerate an existing handle on ordinary reads or retries.
  • NewUserHandle imports exact stored bytes without normalization or aliasing. Protocol/storage projection is explicit; implicit JSON/text export and diagnostic disclosure are prohibited.
  • NewDeviceLabel preserves bounded UTF-8 display text. A label is not device identity, authenticator provenance or authorization. Escape its explicitly projected text for the output medium.
  • The PostgreSQL module owns RP-wide mappings and current passkey session authority through the existing kernel and MFA owners. Its experimental APIs compose fresh-proof enrollment, explicit identified or identifier-free resident login and safe inventory with actual protocol, risk and session owners. Public-consumer qualification and complete independent workflow review remain unfinished.

These are implementation prerequisites, not a complete authentication product. The modules remain non-releasable. Documentation map.

Planned responsibility

The root package owns the storage-neutral boundary for passkey policy, registration and authentication flows, credential profiles, stable user-handle policy, backup state, device labels, account-recovery policy, and coordination through caller-supplied resources. Complete workflows, public adoption, interoperability and final qualification remain unfinished.

Non-goals

The root boundary does not own:

  • WebAuthn wire parsing, cryptographic verification, or ceremony storage;
  • non-discoverable security-key policy or browser user interfaces;
  • identity, risk, authentication, identifier, audit, or session policy; or
  • database clients, migrations, transactions, caches, or background workers.

The native adapter must compose actual WebAuthn, identity, risk and session owners atomically; it cannot supply a private verifier or transaction engine.

Lifecycle and ownership

Implementation is in progress. No tagged release or complete authentication journey is claimed.

The implementation requires caller-owned configuration and runtime resources, copied mutable inputs, context-bounded external operations, and no package-owned background work. No release follows from these component contracts.

Planning and verification

The repository goal and modules.json record the planning scope and schema-v2 engineering inventory. Non-releasable state excludes this module from installable and released consumer catalogs. The local make cohesion target validates that boundary with the exact checksum-pinned go-library-tools release declared in .golib.yaml.

Passing structural checks does not prove authentication behavior. Focused native tests cover bounded values, real mapping constraints and owner checks; full protocol/workflow composition and consumer journeys remain required.

Security reports must use the private process, and the planned trust boundary and unresolved release-blocking risks are recorded in the security policy.

Use Go 1.27.2 and the checksum-pinned public Tools binary in .golib.yaml; the module minimum remains Go 1.27.0. make check, make ci and make fast-check validate configuration, repository structure, cohesion, offline specification decisions, local documentation links and whole-tree/history secrets. CI uses the same structural commands plus validated PR-base or push-before changed-content secret checks on every change. Ordinary Required has a five-minute job limit; changed secrets have a forty-second fatal timeout. Scheduled/manual runs retain whole-tree secrets and online authority refresh. make check-full explicitly preserves the previous full/online contract. These commands do not run application tests or establish runtime/release proof. See contributing for public tooling installation and scope.

See the versioned Golib ecosystem index and package-family guidance for the shared design language.

License

MIT. See LICENSE.

Documentation

Overview

Package passkey owns identity-facing resident-passkey workflows. WebAuthn verification and cryptographic credential state stay with go-webauthn; session persistence and token custody stay with go-identity/session.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrInvalidInput rejects an absent or unsupported bounded value. It never
	// includes supplied bytes, credential identifiers or identity metadata.
	ErrInvalidInput = errors.New("passkey: invalid input")
	// ErrPrivateValue prohibits accidental serialization of correlation data.
	// Explicit projection is available to the owned protocol/storage adapter.
	ErrPrivateValue = errors.New("passkey: private value")
	// ErrUnavailable redacts a failed platform or owned dependency operation.
	// It is never evidence that a durable operation rolled back.
	ErrUnavailable = errors.New("passkey: unavailable")
)

Functions

This section is empty.

Types

type CeremonyRateSource 

type CeremonyRateSource struct {
	CeremonyID      string
	Lifetime        time.Duration
	Kind            RateSourceKind
	UserID          identity.UserID
	Identifier      string
	AnonymousFlowID identity.PreAuthTransactionID
}

CeremonyRateSource is sensitive original rate metadata, never a validity lease, authentication result or permission to consume a ceremony. Exactly one dimension matches Kind; the other two are empty. CeremonyID is the original committed protocol ceremony, not a new completion attempt. Lifetime is its immutable original policy duration, never remaining time or a renewed expiry. Native completion must independently revalidate and atomically consume current authority. Historical consumed metadata may remain readable while original custody and time remain valid; it cannot issue another secret.

func (CeremonyRateSource) Format 

func (CeremonyRateSource) Format(s fmt.State, _ rune)

func (CeremonyRateSource) MarshalJSON 

func (CeremonyRateSource) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit export of correlated original rate metadata.

func (CeremonyRateSource) MarshalText 

func (CeremonyRateSource) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of correlated original rate metadata.

type ConditionalAssertionOptions 

type ConditionalAssertionOptions struct {
	// contains filtered or unexported fields
}

ConditionalAssertionOptions selects conditional browser presentation of an existing anonymous discoverable assertion. It shares the protocol owner's original challenge custody: copies and the native options together permit only one reveal, including after delivery failure. Zero cannot emit options. This is not authentication or evidence of the browser's actual mediation.

func NewConditionalAssertionOptions 

func NewConditionalAssertionOptions(native webauthn.AssertionOptions) (ConditionalAssertionOptions, error)

NewConditionalAssertionOptions explicitly selects conditional presentation without IO, a new ceremony, extended expiry or a new assertion protocol. Only anonymous, account-independent discoverable protocol options qualify; identity/risk authorization remains the native workflow owner's responsibility.

func (ConditionalAssertionOptions) Ceremony 

func (o ConditionalAssertionOptions) Ceremony() (webauthn.CeremonyRecord, bool)

Ceremony returns unchanged original protocol metadata, not fresh authority or evidence that a browser used conditional mediation. Zero returns false.

func (ConditionalAssertionOptions) Format 

func (ConditionalAssertionOptions) Format(s fmt.State, _ rune)

func (ConditionalAssertionOptions) MarshalJSON 

func (ConditionalAssertionOptions) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit reveal-once browser projection.

func (ConditionalAssertionOptions) MarshalText 

func (ConditionalAssertionOptions) MarshalText() ([]byte, error)

MarshalText prohibits implicit challenge/correlation export.

func (ConditionalAssertionOptions) TransferJSON 

func (o ConditionalAssertionOptions) TransferJSON(ctx context.Context, deliver func(context.Context, []byte) error) error

TransferJSON reveals {mediation:"conditional",publicKey:...} exactly once through native option custody. The original publicKey JSON is preserved. Borrowed bytes are cleared after delivery; the callback owns any explicit copy. The browser must check support and deserialize publicKey before get(). Completion remains ordinary discoverable assertion verification and retains the original server expiry even while browser conditional UI remains open.

type CredentialMetadata 

type CredentialMetadata struct {
	ReferenceID                 string
	Version                     uint64
	State, Label                string
	AAGUID                      [16]byte
	BackupEligible, BackupState bool
	CreatedAt                   time.Time
	LastUsedAt                  *time.Time
}

CredentialMetadata is the explicit safe self-user projection. ReferenceID is the identity-owned management reference, not the raw RP credential ID. AAGUID and backup flags come only from the protocol owner's stored verified record; labels are untrusted display text, never authenticator provenance. Public keys, counters, handles, challenges and authentication custody are omitted.

type DeleteRequest 

type DeleteRequest struct {
	Primary         password.ActionPrimaryRequest
	ReferenceID     identity.CredentialID
	ExpectedVersion uint64
	IdempotencyKey  identity.IdempotencyKey
	Network         string
}

DeleteRequest selects keyed self-user credential removal, not compromise or authenticator-local erasure. Primary carries original password/session/action and selected CSRF custody; the native owner must verify a genuine signed identity.passkey.delete proof and a currently usable independent recovery path. A data carrier grants no authentication, freshness or recovery authority.

ReferenceID is the safe management reference returned by List, never raw RP credential bytes. ExpectedVersion is its observed positive management-metadata version, not the independently fenced credential or protocol authority version. Network is trusted bounded ingress for the existing risk owner, not authority.

Primary.CommandID and RecordID must be empty. The kernel's existing exact-key admission supplies one server-random original command before proof preparation. Supplied command/record overrides deny. Matching retries preserve the exact key, input and original custody and recover metadata without another proof consumption, removal, lifecycle effect or reauthentication secret projection.

func (DeleteRequest) Format 

func (DeleteRequest) Format(s fmt.State, _ rune)

Format excludes original custody and request correlation from diagnostics.

func (DeleteRequest) MarshalJSON 

func (DeleteRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit, credential-free transport projection.

func (DeleteRequest) MarshalText 

func (DeleteRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit original-custody export.

type DeleteResult 

type DeleteResult struct {
	CommandID identity.CommandID
	Outcome   identity.CommitOutcome
	Replayed  bool
	Receipt   identity.CommandResult
}

DeleteResult carries only original command durability metadata, never proof, session or protocol bytes. Receipt is historical command observation, not current authorization or authenticator-local erasure. Replayed means no removal or required effect was rerun. Unknown is not rollback: retain the original key and CommandID rather than allocating a replacement. Zero is not success. Consumers must explicitly project suitable transport fields.

func (DeleteResult) Format 

func (DeleteResult) Format(s fmt.State, _ rune)

Format excludes command correlation and historical receipt metadata.

func (DeleteResult) MarshalJSON 

func (DeleteResult) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate safe metadata projection, not record export.

func (DeleteResult) MarshalText 

func (DeleteResult) MarshalText() ([]byte, error)

MarshalText prohibits implicit durability/correlation export.

type DeviceLabel 

type DeviceLabel struct {
	// contains filtered or unexported fields
}

DeviceLabel is bounded caller-supplied display metadata, never authenticator provenance, a device identifier or an authorization selector. Zero denotes no label and is not a valid explicitly supplied label. Copies are immutable.

func NewDeviceLabel 

func NewDeviceLabel(value string) (DeviceLabel, error)

NewDeviceLabel preserves exact UTF-8 bytes, including surrounding whitespace; it never normalizes supplied metadata. The selected display profile is at most 128 bytes, contains a non-whitespace rune and no control characters. Consumers must escape Value for their output medium; this is not HTML sanitization.

func (DeviceLabel) Format 

func (DeviceLabel) Format(s fmt.State, _ rune)

Format keeps caller-supplied labels out of ordinary diagnostics.

func (DeviceLabel) Value 

func (l DeviceLabel) Value() string

Value explicitly projects original display text. It must not be logged with identity/credential correlation. Zero returns an empty string.

type DiscoverableCeremonyRateRequest 

type DiscoverableCeremonyRateRequest struct {
	DiscoverableSigninRequest
	CeremonyID string
}

DiscoverableCeremonyRateRequest selects the original identifier-free mode. Only original browser/flow custody can produce its anonymous-flow dimension; no credential handle, assertion, user or fabricated identifier is accepted.

func (DiscoverableCeremonyRateRequest) Format 

func (DiscoverableCeremonyRateRequest) Format(s fmt.State, _ rune)

func (DiscoverableCeremonyRateRequest) MarshalJSON 

func (DiscoverableCeremonyRateRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit export of original browser custody.

func (DiscoverableCeremonyRateRequest) MarshalText 

func (DiscoverableCeremonyRateRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of original browser custody.

type DiscoverableSigninCompletion 

type DiscoverableSigninCompletion struct {
	DiscoverableSigninRequest
	CeremonyID string
	Response   []byte
}

DiscoverableSigninCompletion adds the original committed anonymous resident ceremony and bounded raw assertion. Only the root verifier's opaque signed transition can select a user; caller-supplied handles are never authority.

func (DiscoverableSigninCompletion) Format 

func (DiscoverableSigninCompletion) Format(s fmt.State, _ rune)

func (DiscoverableSigninCompletion) MarshalJSON 

func (DiscoverableSigninCompletion) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit browser-response export.

func (DiscoverableSigninCompletion) MarshalText 

func (DiscoverableSigninCompletion) MarshalText() ([]byte, error)

MarshalText prohibits implicit browser-response export.

type DiscoverableSigninRequest 

type DiscoverableSigninRequest struct {
	CommandID                              identity.CommandID
	FlowID                                 identity.PreAuthTransactionID
	Cookie                                 session.Token
	Origin, Network, Device, CorrelationID string
}

DiscoverableSigninRequest retains the original anonymous browser/remember flow and trusted ingress dimensions. There is deliberately no identifier, user, actor, RP or tenant selection. IDs and ingress are server-selected; Origin must exactly match trusted configuration. Secrets cannot be serialized.

func (DiscoverableSigninRequest) Format 

func (DiscoverableSigninRequest) Format(s fmt.State, _ rune)

func (DiscoverableSigninRequest) MarshalJSON 

func (DiscoverableSigninRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit browser-flow export.

func (DiscoverableSigninRequest) MarshalText 

func (DiscoverableSigninRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit browser-flow export.

type InventoryPage 

type InventoryPage struct {
	Credentials []CredentialMetadata
	Next        string
}

InventoryPage owns one bounded page and its exclusive keyset cursor. Next is empty at the observed end; it grants no authority and is not a durable snapshot across subsequent calls. Concurrent changes may appear on later pages.

type InventoryRequest 

type InventoryRequest struct {
	Credential session.Credential
	Caller     authorization.DecisionContext
	AttemptID  identity.CommandID
	After      string
	Limit      int
}

InventoryRequest supplies trusted ingress attribution and a genuine selected session credential. The target is always that session's user. Limit is1..100; After is the last returned reference ID, never a protocol credential/handle. AttemptID is a distinct server-issued rate identity per logical read, not client-selected replay or authorization. Cookie parsing belongs to transport.

func (InventoryRequest) Format 

func (InventoryRequest) Format(s fmt.State, _ rune)

type KeyedAssertionOptionsResult 

type KeyedAssertionOptionsResult struct {
	CommandID identity.CommandID
	Receipt   identity.CommandResult
	Replayed  bool
	Options   webauthn.AssertionOptions
}

KeyedAssertionOptionsResult has the same commit/replay semantics as keyed registration, without authenticating anybody. Only the fresh committed winner can TransferJSON once. Completion still needs its own one-use native command.

func (KeyedAssertionOptionsResult) Format 

func (KeyedAssertionOptionsResult) Format(s fmt.State, _ rune)

func (KeyedAssertionOptionsResult) MarshalJSON 

func (KeyedAssertionOptionsResult) MarshalJSON() ([]byte, error)

func (KeyedAssertionOptionsResult) MarshalText 

func (KeyedAssertionOptionsResult) MarshalText() ([]byte, error)

type KeyedConditionalOptionsResult 

type KeyedConditionalOptionsResult struct {
	CommandID identity.CommandID
	Receipt   identity.CommandResult
	Replayed  bool
	Options   ConditionalAssertionOptions
}

KeyedConditionalOptionsResult retains the existing discoverable command and receipt. Only the freshly acknowledged winner receives Options; replay, pending and unknown outcomes never reconstruct or reveal a challenge. Presentation is not an additional durable mode or request-key namespace.

func (KeyedConditionalOptionsResult) Format 

func (KeyedConditionalOptionsResult) Format(s fmt.State, _ rune)

func (KeyedConditionalOptionsResult) MarshalJSON 

func (KeyedConditionalOptionsResult) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit command or challenge export.

func (KeyedConditionalOptionsResult) MarshalText 

func (KeyedConditionalOptionsResult) MarshalText() ([]byte, error)

MarshalText prohibits implicit command or challenge export.

type KeyedDiscoverableOptionsRequest 

type KeyedDiscoverableOptionsRequest struct {
	DiscoverableSigninRequest
	IdempotencyKey identity.IdempotencyKey
	Caller         authorization.DecisionContext
}

KeyedDiscoverableOptionsRequest selects identifier-free options under the same original-key contract. It cannot reinterpret an identified request, and never supplies user, tenant, actor or RP authority from browser data.

func (KeyedDiscoverableOptionsRequest) Format 

func (KeyedDiscoverableOptionsRequest) Format(s fmt.State, _ rune)

func (KeyedDiscoverableOptionsRequest) MarshalJSON 

func (KeyedDiscoverableOptionsRequest) MarshalJSON() ([]byte, error)

func (KeyedDiscoverableOptionsRequest) MarshalText 

func (KeyedDiscoverableOptionsRequest) MarshalText() ([]byte, error)

type KeyedRegistrationOptionsRequest 

type KeyedRegistrationOptionsRequest struct {
	RegistrationRequest
	IdempotencyKey identity.IdempotencyKey
}

KeyedRegistrationOptionsRequest carries the exact original key and native authenticated enrollment input. Primary.CommandID and RecordID must be empty: the existing request-key owner allocates the original random command. Caller is trusted authenticated attribution, not browser-selected subject authority. Session/CSRF possession and every structural proof field bind original intent; consumed or expired proofs may reconcile metadata but never create a ceremony.

func (KeyedRegistrationOptionsRequest) Format 

func (KeyedRegistrationOptionsRequest) Format(s fmt.State, _ rune)

func (KeyedRegistrationOptionsRequest) MarshalJSON 

func (KeyedRegistrationOptionsRequest) MarshalJSON() ([]byte, error)

func (KeyedRegistrationOptionsRequest) MarshalText 

func (KeyedRegistrationOptionsRequest) MarshalText() ([]byte, error)

type KeyedRegistrationOptionsResult 

type KeyedRegistrationOptionsResult struct {
	CommandID identity.CommandID
	Receipt   identity.CommandResult
	Replayed  bool
	Options   webauthn.RegistrationOptions
}

KeyedRegistrationOptionsResult retains the original command and safe native receipt. Options exists only for the fresh committed winner; all replays, pending and unknown outcomes are metadata-only. Replayed does not authorize another reveal. A zero Receipt means no command outcome was established.

func (KeyedRegistrationOptionsResult) Format 

func (KeyedRegistrationOptionsResult) Format(s fmt.State, _ rune)

func (KeyedRegistrationOptionsResult) MarshalJSON 

func (KeyedRegistrationOptionsResult) MarshalJSON() ([]byte, error)

func (KeyedRegistrationOptionsResult) MarshalText 

func (KeyedRegistrationOptionsResult) MarshalText() ([]byte, error)

type KeyedSigninOptionsRequest 

type KeyedSigninOptionsRequest struct {
	SigninRequest
	IdempotencyKey identity.IdempotencyKey
	Caller         authorization.DecisionContext
}

KeyedSigninOptionsRequest carries exact original browser possession and key. CommandID must be empty; correlation is selected from the original random command. Caller is trusted service attribution and must match the configured actor/tenant/action. The query resource is identity.anonymous-flow with FlowID, as required by the kernel metadata owner, distinct from execution's preauth resource. Identified mode retains the exact owner-canonical Identifier.

func (KeyedSigninOptionsRequest) Format 

func (KeyedSigninOptionsRequest) Format(s fmt.State, _ rune)

func (KeyedSigninOptionsRequest) MarshalJSON 

func (KeyedSigninOptionsRequest) MarshalJSON() ([]byte, error)

func (KeyedSigninOptionsRequest) MarshalText 

func (KeyedSigninOptionsRequest) MarshalText() ([]byte, error)

type KeyedSignupOptionsRequest 

type KeyedSignupOptionsRequest struct {
	SignupRequest
	IdempotencyKey identity.IdempotencyKey
	Caller         authorization.DecisionContext
}

KeyedSignupOptionsRequest retains exact original browser possession and the request key. CommandID must be empty: the existing request-key owner allocates the original random command and its correlation, and matching retries retain that original intent. Caller is trusted service attribution, not browser- selected user, tenant, actor or RP authority. Use KeyedRegistrationOptionsResult for the result: only a fresh committed winner may reveal options; replay, pending and unknown outcomes are metadata-only and cannot create a ceremony.

func (KeyedSignupOptionsRequest) Format 

func (KeyedSignupOptionsRequest) Format(s fmt.State, _ rune)

Format prevents request-key, caller and browser-flow disclosure.

func (KeyedSignupOptionsRequest) MarshalJSON 

func (KeyedSignupOptionsRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit keyed browser-flow export.

func (KeyedSignupOptionsRequest) MarshalText 

func (KeyedSignupOptionsRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit keyed browser-flow export.

type RateSourceKind 

type RateSourceKind uint8

RateSourceKind selects exactly one original ceremony rate dimension. It is not an authorization subject kind: an anonymous flow authenticates no user. Zero and unknown values are invalid; metadata grants no execution authority. 

const (
	// RateSourceUser names the genuine existing session's enrollment user.
	RateSourceUser RateSourceKind = iota + 1
	// RateSourceIdentifier names the exact original identified signin input,
	// including an originally suppressed or ineligible account lookup.
	RateSourceIdentifier
	// RateSourceAnonymousFlow names the original identifier-free browser flow.
	RateSourceAnonymousFlow
)

type RegistrationCeremonyRateRequest 

type RegistrationCeremonyRateRequest struct {
	RegistrationRequest
	CeremonyID string
}

RegistrationCeremonyRateRequest borrows genuine current session/action-proof custody for the registration-completion phase and the original ceremony ID. Reading metadata consumes neither proof nor ceremony and accepts no raw authenticator response, caller-selected user or replacement challenge.

func (RegistrationCeremonyRateRequest) Format 

func (RegistrationCeremonyRateRequest) Format(s fmt.State, _ rune)

func (RegistrationCeremonyRateRequest) MarshalJSON 

func (RegistrationCeremonyRateRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit export of original authentication custody.

func (RegistrationCeremonyRateRequest) MarshalText 

func (RegistrationCeremonyRateRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of original authentication custody.

type RegistrationCompletion 

type RegistrationCompletion struct {
	RegistrationRequest
	CeremonyID string
	Response   []byte
	Label      string
}

RegistrationCompletion adds the bounded raw browser response and original creation command/ceremony ID. The new kernel credential reference is the completion CommandID; callers cannot select or replace an existing reference. Raw response bytes are borrowed for the call and copied after bounds checks.

func (RegistrationCompletion) Format 

func (RegistrationCompletion) Format(s fmt.State, _ rune)

Format prevents raw response and authentication-custody disclosure.

type RegistrationRequest 

type RegistrationRequest struct {
	Primary                 password.ActionPrimaryRequest
	Origin, Network, Device string
}

RegistrationRequest carries original authenticated session and signed action proof through the password owner's custody contract. Trusted ingress supplies Caller and Network. User/actor are derived from the actual session, never supplied here. Primary.TargetSubjectID must be empty. Origin is allowlisted by the protocol owner. This selected profile requires a distinct exact action proof for each protected phase, consumed atomically with that phase.

func (RegistrationRequest) Format 

func (RegistrationRequest) Format(s fmt.State, _ rune)

Format prevents bearer/proof/ingress disclosure.

type SessionDeleteCompletion 

type SessionDeleteCompletion struct {
	// contains filtered or unexported fields
}

SessionDeleteCompletion carries a genuine assertion for the unchanged original session, target/version, origin/network and removal intent. It contains no caller-supplied proof or assertion of recovery eligibility. Only the WebAuthn owner can verify Response; only native owners can atomically consume it with credential removal, current authority, recovery and required effects.

func NewSessionDeleteCompletion 

func NewSessionDeleteCompletion(spec SessionDeleteCompletionSpec) SessionDeleteCompletion

NewSessionDeleteCompletion borrows original assertion bytes without parsing, copying, consuming or authenticating them. The caller owns their lifetime.

func (SessionDeleteCompletion) Bindings 

func (r SessionDeleteCompletion) Bindings() (SessionDeleteCompletionSpec, error)

Bindings explicitly projects borrowed original completion custody. Zero denies; the output must not be logged or treated as verified authentication.

func (SessionDeleteCompletion) Format 

func (SessionDeleteCompletion) Format(f fmt.State, _ rune)

Format excludes original assertion and removal custody.

func (SessionDeleteCompletion) MarshalJSON 

func (SessionDeleteCompletion) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit custody export.

func (SessionDeleteCompletion) MarshalText 

func (SessionDeleteCompletion) MarshalText() ([]byte, error)

MarshalText rejects implicit custody export.

type SessionDeleteCompletionSpec 

type SessionDeleteCompletionSpec struct {
	SessionDeleteRequest
	IdempotencyKey identity.IdempotencyKey
	CeremonyID     string
	Response       []byte
}

SessionDeleteCompletionSpec is an explicit unredacted projection. CeremonyID identifies original deletion options. IdempotencyKey must be distinct from that options key; preserve both keys and all original inputs after an unknown outcome. Response is bounded untrusted JSON borrowed unchanged for the call.

type SessionDeleteOptionsRequest 

type SessionDeleteOptionsRequest struct {
	SessionDeleteRequest
	IdempotencyKey identity.IdempotencyKey
}

SessionDeleteOptionsRequest selects one original action-bound UV ceremony. Its key belongs to canonical identity.passkey.delete. The native owner allocates the command; matching retries reveal original metadata only.

func (SessionDeleteOptionsRequest) Format 

func (SessionDeleteOptionsRequest) Format(f fmt.State, _ rune)

Format excludes original request and options-key custody.

func (SessionDeleteOptionsRequest) MarshalJSON 

func (SessionDeleteOptionsRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit custody export.

func (SessionDeleteOptionsRequest) MarshalText 

func (SessionDeleteOptionsRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit custody export.

type SessionDeleteRequest 

type SessionDeleteRequest struct {
	// contains filtered or unexported fields
}

SessionDeleteRequest retains current passkey-session custody and the exact intended credential removal. It is not authentication, freshness or recovery permission. Native owners must verify the actual session, cookie CSRF when selected, self-user policy and genuine action-bound UV, then prove a usable independent recovery path in the same transaction as removal.

Closure storage prevents diagnostics from traversing original custody even through enclosing unexported fields, where Go skips nested Formatter methods.

func NewSessionDeleteRequest 

func NewSessionDeleteRequest(spec SessionDeleteRequestSpec) SessionDeleteRequest

NewSessionDeleteRequest retains supplied scalar intent and borrowed custody without IO, validation or authentication. The native owner validates all fields.

func (SessionDeleteRequest) Bindings 

func (r SessionDeleteRequest) Bindings() (SessionDeleteRequestSpec, error)

Bindings deliberately projects the original request for native validation. Zero custody denies; successful projection grants no permission.

func (SessionDeleteRequest) Format 

func (SessionDeleteRequest) Format(f fmt.State, _ rune)

Format excludes original session, target and ingress custody.

func (SessionDeleteRequest) MarshalJSON 

func (SessionDeleteRequest) MarshalJSON() ([]byte, error)

MarshalJSON rejects implicit custody export.

func (SessionDeleteRequest) MarshalText 

func (SessionDeleteRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit custody export.

type SessionDeleteRequestSpec 

type SessionDeleteRequestSpec struct {
	Credential      session.Credential
	CSRFToken       session.CSRFToken
	Caller          authorization.DecisionContext
	ReferenceID     identity.CredentialID
	ExpectedVersion uint64
	Origin          string
	Network         string
}

SessionDeleteRequestSpec is explicit unredacted ingress/native projection; do not log or implicitly serialize it. ReferenceID is the safe inventory reference, not a protocol credential ID. ExpectedVersion is its positive metadata version, independent of kernel and protocol versions. Origin and Network are bounded trusted ingress, not browser-selected tenant/RP scope. Credential, CSRFToken and Caller are borrowed unchanged; callers must not mutate their custody during use. Native configuration chooses allowed transport.

type SessionDeleteResult 

type SessionDeleteResult struct {
	// contains filtered or unexported fields
}

SessionDeleteResult retains native durability metadata privately. It contains no fresh proof, credential or session. Removal can invalidate the original session; acknowledgement of this invocation is not permission to use it again. Preserve unknown outcomes and original command custody rather than allocating a replacement mutation. No result value by itself proves durable commitment.

func NewSessionDeleteResult 

func NewSessionDeleteResult(spec DeleteResult) SessionDeleteResult

NewSessionDeleteResult retains exact native metadata without interpreting the outcome or granting authority. Borrowed receipt metadata must remain immutable.

func (SessionDeleteResult) Bindings 

func (r SessionDeleteResult) Bindings() (DeleteResult, error)

Bindings explicitly projects existing DeleteResult metadata for permitted transport fields or recovery. Zero denies; correlation is not safe diagnostics.

func (SessionDeleteResult) Format 

func (SessionDeleteResult) Format(f fmt.State, _ rune)

Format excludes original command/receipt correlation.

func (SessionDeleteResult) MarshalJSON 

func (SessionDeleteResult) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate permitted metadata projection.

func (SessionDeleteResult) MarshalText 

func (SessionDeleteResult) MarshalText() ([]byte, error)

MarshalText rejects implicit correlation export.

type SessionEnrollmentAuthorization 

type SessionEnrollmentAuthorization struct {
	// contains filtered or unexported fields
}

SessionEnrollmentAuthorization consumes the genuine assertion and creates the subsequent registration ceremony in one protected transaction. Its key is distinct from the assertion-options key. CeremonyID identifies those original assertion options; Response is bounded untrusted WebAuthn JSON, not proof by shape. The original assertion's authority expiry remains the ceiling for registration, even if protocol ceremony validity ends later. Response is borrowed only during the invocation and must not be mutated.

func NewSessionEnrollmentAuthorization 

func NewSessionEnrollmentAuthorization(spec SessionEnrollmentAuthorizationSpec) SessionEnrollmentAuthorization

NewSessionEnrollmentAuthorization retains original B-phase custody without copying or parsing Response. The caller owns its bounded bytes and lifetime.

func (SessionEnrollmentAuthorization) Bindings 

func (r SessionEnrollmentAuthorization) Bindings() (SessionEnrollmentAuthorizationSpec, error)

Bindings explicitly projects borrowed assertion custody for native validation. Zero denies. The returned fields and response must not be logged or mutated.

func (SessionEnrollmentAuthorization) Format 

func (SessionEnrollmentAuthorization) Format(f fmt.State, _ rune)

Format excludes the original assertion and enrollment intent from diagnostics.

func (SessionEnrollmentAuthorization) MarshalJSON 

func (SessionEnrollmentAuthorization) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate projection, not assertion export.

func (SessionEnrollmentAuthorization) MarshalText 

func (SessionEnrollmentAuthorization) MarshalText() ([]byte, error)

MarshalText rejects implicit original assertion and key export.

type SessionEnrollmentAuthorizationSpec 

type SessionEnrollmentAuthorizationSpec struct {
	SessionEnrollmentRequest
	IdempotencyKey identity.IdempotencyKey
	CeremonyID     string
	Response       []byte
}

SessionEnrollmentAuthorizationSpec is explicit unredacted ingress/projection, not safe diagnostics. Response is borrowed and must remain unchanged during use; only the protocol owner can verify it. No authentication occurs here.

type SessionEnrollmentCompletion 

type SessionEnrollmentCompletion struct {
	// contains filtered or unexported fields
}

SessionEnrollmentCompletion finishes that original authorized registration. CommandID is the stable, canonical identity of this single-use completion, not permission to enroll; preserve it and the original ceremony/response for recovery. This non-keyed phase deliberately has no IdempotencyKey. The native owner must consume the genuine registration, persist the identity-facing credential/mapping and required lifecycle together, and enforce the original authorization ceiling and current session/owner/factor policy before commit. Response is bounded untrusted JSON borrowed for this invocation only.

func NewSessionEnrollmentCompletion 

func NewSessionEnrollmentCompletion(spec SessionEnrollmentCompletionSpec) SessionEnrollmentCompletion

NewSessionEnrollmentCompletion retains original completion custody without parsing or copying Response, creating authority or allocating another command.

func (SessionEnrollmentCompletion) Bindings 

func (r SessionEnrollmentCompletion) Bindings() (SessionEnrollmentCompletionSpec, error)

Bindings explicitly projects borrowed completion custody for native validation. Zero denies. The result must not be logged or treated as authenticated input.

func (SessionEnrollmentCompletion) Format 

func (SessionEnrollmentCompletion) Format(f fmt.State, _ rune)

Format excludes original command and attestation custody from diagnostics.

func (SessionEnrollmentCompletion) MarshalJSON 

func (SessionEnrollmentCompletion) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate projection, not attestation export.

func (SessionEnrollmentCompletion) MarshalText 

func (SessionEnrollmentCompletion) MarshalText() ([]byte, error)

MarshalText rejects implicit original command/attestation export.

type SessionEnrollmentCompletionSpec 

type SessionEnrollmentCompletionSpec struct {
	SessionEnrollmentRequest
	CommandID  identity.CommandID
	CeremonyID string
	Response   []byte
}

SessionEnrollmentCompletionSpec is explicit unredacted ingress/projection of the original non-keyed C phase, never safe diagnostics or verified permission. Response remains borrowed; callers own its bounds, lifetime and immutability.

type SessionEnrollmentOptionsRequest 

type SessionEnrollmentOptionsRequest struct {
	SessionEnrollmentRequest
	IdempotencyKey identity.IdempotencyKey
}

SessionEnrollmentOptionsRequest admits one original action-bound assertion ceremony. Matching key retries return original metadata, never a replacement challenge or renewed authority. The native owner allocates its command ID.

func (SessionEnrollmentOptionsRequest) Format 

func (SessionEnrollmentOptionsRequest) Format(f fmt.State, _ rune)

Format excludes original request-key and session custody from diagnostics.

func (SessionEnrollmentOptionsRequest) MarshalJSON 

func (SessionEnrollmentOptionsRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit credential-free projection.

func (SessionEnrollmentOptionsRequest) MarshalText 

func (SessionEnrollmentOptionsRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit original-session/key export.

type SessionEnrollmentRequest 

type SessionEnrollmentRequest struct {
	// contains filtered or unexported fields
}

SessionEnrollmentRequest retains current passkey-session custody and the exact intended additional resident credential's display label. It grants no authority by itself. The native owner must authenticate the selected transport, original cookie CSRF when applicable and self-user Caller, then require a genuine UV assertion specifically authorizing this enrollment. Origin and Network are bounded trusted ingress, never browser-selected RP or tenant overrides. Label follows DeviceLabel; it is not authenticator trust. All phases bind this unchanged intent and the complete original session, current identity/credential/factor policy and original freshness ceiling. Callers must not mutate custody during an invocation.

func NewSessionEnrollmentRequest 

func NewSessionEnrollmentRequest(spec SessionEnrollmentRequestSpec) SessionEnrollmentRequest

NewSessionEnrollmentRequest retains an exact snapshot of supplied fields, without IO or authorization. Closure storage prevents fmt from reaching PII through unexported enclosing fields, where Go skips nested Formatter methods.

func (SessionEnrollmentRequest) Bindings 

func (r SessionEnrollmentRequest) Bindings() (SessionEnrollmentRequestSpec, error)

Bindings explicitly projects the original borrowed session/intent for native validation. Zero custody denies; a successful projection grants no authority.

func (SessionEnrollmentRequest) Format 

func (SessionEnrollmentRequest) Format(f fmt.State, _ rune)

Format excludes original session and enrollment intent from diagnostics.

func (SessionEnrollmentRequest) MarshalJSON 

func (SessionEnrollmentRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit credential-free projection.

func (SessionEnrollmentRequest) MarshalText 

func (SessionEnrollmentRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit current-session and intent export.

type SessionEnrollmentRequestSpec 

type SessionEnrollmentRequestSpec struct {
	Credential session.Credential
	CSRFToken  session.CSRFToken
	Caller     authorization.DecisionContext
	Label      string
	Origin     string
	Network    string
}

SessionEnrollmentRequestSpec is the deliberate, unredacted ingress or native projection of session/intent custody. Do not log or serialize it. Constructing custody does not validate authentication, ingress or policy; the native owner validates every field. Caller and opaque session values are borrowed unchanged.

type SessionEnrollmentResult 

type SessionEnrollmentResult struct {
	// contains filtered or unexported fields
}

SessionEnrollmentResult contains native completion durability. Credential is safe metadata only for the fresh acknowledged winner. Matching recovery is metadata-only and must not issue credentials, options or a new session. Callers must preserve unknown outcomes rather than retry under a new command.

func NewSessionEnrollmentResult 

func NewSessionEnrollmentResult(spec SessionEnrollmentResultSpec) SessionEnrollmentResult

NewSessionEnrollmentResult retains exact native durability and borrowed immutable metadata without publishing it or changing the command outcome.

func (SessionEnrollmentResult) Bindings 

func (r SessionEnrollmentResult) Bindings() (SessionEnrollmentResultSpec, error)

Bindings explicitly projects original completion metadata. Zero denies; a successful projection is not evidence that any native transaction committed.

func (SessionEnrollmentResult) Format 

func (SessionEnrollmentResult) Format(f fmt.State, _ rune)

Format excludes command correlation and private display metadata.

func (SessionEnrollmentResult) MarshalJSON 

func (SessionEnrollmentResult) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit safe metadata projection.

func (SessionEnrollmentResult) MarshalText 

func (SessionEnrollmentResult) MarshalText() ([]byte, error)

MarshalText rejects implicit durability/correlation export.

type SessionEnrollmentResultSpec 

type SessionEnrollmentResultSpec struct {
	CommandID  identity.CommandID
	Outcome    identity.CommitOutcome
	Replayed   bool
	Receipt    identity.CommandResult
	Credential *CredentialMetadata
}

SessionEnrollmentResultSpec is an explicit native result projection. Select only permitted public metadata for transport; command correlation and display metadata are not safe implicit diagnostics. Credential is borrowed immutable metadata, never raw WebAuthn credential bytes or session bearer custody.

type SessionUpdateCompletion 

type SessionUpdateCompletion struct {
	SessionUpdateRequest
	IdempotencyKey identity.IdempotencyKey
	CeremonyID     string
	Response       []byte
}

SessionUpdateCompletion consumes a genuine assertion atomically with exactly the original label mutation. CeremonyID refers to options made for the same session and unchanged SessionUpdateRequest. Response is bounded untrusted authenticator JSON; only the WebAuthn owner can verify it. The original completion key resolves a separate mutation command; a matching retry returns durability metadata without re-verification, mutation or a new session.

func (SessionUpdateCompletion) Format 

func (SessionUpdateCompletion) Format(s fmt.State, _ rune)

Format excludes authenticator input, original ceremony and session custody.

func (SessionUpdateCompletion) MarshalJSON 

func (SessionUpdateCompletion) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate credential-free transport projection.

func (SessionUpdateCompletion) MarshalText 

func (SessionUpdateCompletion) MarshalText() ([]byte, error)

MarshalText rejects implicit authenticator, original-key and session export.

type SessionUpdateOptionsRequest 

type SessionUpdateOptionsRequest struct {
	SessionUpdateRequest
	IdempotencyKey identity.IdempotencyKey
}

SessionUpdateOptionsRequest admits one original action-bound assertion ceremony through the existing keyed-command owner. Matching retries return original command metadata, never a replacement challenge or fresh permission. The server, not the caller, allocates the original command and ceremony IDs.

func (SessionUpdateOptionsRequest) Format 

func (SessionUpdateOptionsRequest) Format(s fmt.State, _ rune)

Format excludes the original request and key from diagnostics.

func (SessionUpdateOptionsRequest) MarshalJSON 

func (SessionUpdateOptionsRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate credential-free transport projection.

func (SessionUpdateOptionsRequest) MarshalText 

func (SessionUpdateOptionsRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit original-key and session export.

type SessionUpdateRequest 

type SessionUpdateRequest struct {
	Credential      session.Credential
	CSRFToken       session.CSRFToken
	Caller          authorization.DecisionContext
	ReferenceID     identity.CredentialID
	ExpectedVersion uint64
	Name            string
	Origin          string
	Network         string
}

SessionUpdateRequest retains current passkey-session custody and the exact intended label mutation. It grants no authentication or freshness by itself. The native owner must authenticate Credential and selected cookie CSRF, authorize Caller, and require a genuine UV assertion bound to this session, target, metadata version, label, RP and origin in the protected transaction. No password proof or session timestamp substitutes for that assertion.

ReferenceID is the safe identity-facing reference returned by inventory, not a raw protocol credential ID. ExpectedVersion is its positive metadata version, independent of protocol counters and primary credential authority. Name follows DeviceLabel. Origin and Network are bounded trusted ingress; tenant/RP and allowed transport come from native configuration, not this input. Callers must not mutate input or borrowed opaque custody during an invocation.

func (SessionUpdateRequest) Format 

func (SessionUpdateRequest) Format(s fmt.State, _ rune)

Format excludes session/action and display-label custody from diagnostics.

func (SessionUpdateRequest) MarshalJSON 

func (SessionUpdateRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate credential-free transport projection.

func (SessionUpdateRequest) MarshalText 

func (SessionUpdateRequest) MarshalText() ([]byte, error)

MarshalText rejects implicit original-session custody export.

type SigninCeremonyRateRequest 

type SigninCeremonyRateRequest struct {
	SigninRequest
	CeremonyID string
}

SigninCeremonyRateRequest borrows original browser possession, exact original canonical identifier and committed ceremony ID. It authenticates the source, not account eligibility, a credential or the browser's raw assertion.

func (SigninCeremonyRateRequest) Format 

func (SigninCeremonyRateRequest) Format(s fmt.State, _ rune)

func (SigninCeremonyRateRequest) MarshalJSON 

func (SigninCeremonyRateRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit export of original browser custody.

func (SigninCeremonyRateRequest) MarshalText 

func (SigninCeremonyRateRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of original browser custody.

type SigninCompletion 

type SigninCompletion struct {
	SigninRequest
	CeremonyID string
	Response   []byte
}

SigninCompletion adds the original committed assertion ceremony and bounded raw browser response. Expected protocol version is owner-derived, not client input. Replays and ambiguous outcomes never return new authentication.

func (SigninCompletion) Format 

func (SigninCompletion) Format(s fmt.State, _ rune)

func (SigninCompletion) MarshalJSON 

func (SigninCompletion) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit browser-response export.

func (SigninCompletion) MarshalText 

func (SigninCompletion) MarshalText() ([]byte, error)

MarshalText prohibits implicit browser-response export.

type SigninMFAChallenge 

type SigninMFAChallenge struct {
	ID        identity.CommandID
	Method    string
	ExpiresAt time.Time
	Proof     capability.Proof
}

SigninMFAChallenge is the original committed TOTP-only child of a genuinely verified UV passkey assertion, not a session, bearer or completed MFA proof. Proof has reveal-once custody and is absent on historical/ambiguous outcomes. ID and ExpiresAt identify the original child; retry never renews either.

func (SigninMFAChallenge) Format 

func (SigninMFAChallenge) Format(s fmt.State, _ rune)

func (SigninMFAChallenge) MarshalJSON 

func (SigninMFAChallenge) MarshalJSON() ([]byte, error)

MarshalJSON requires an explicit selected transport projection.

func (SigninMFAChallenge) MarshalText 

func (SigninMFAChallenge) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of challenge custody.

type SigninRequest 

type SigninRequest struct {
	CommandID                                          identity.CommandID
	FlowID                                             identity.PreAuthTransactionID
	Cookie                                             session.Token
	Identifier, Origin, Network, Device, CorrelationID string
}

SigninRequest carries original browser flow/cookie, exact owner-canonical verified email, and trusted ingress dimensions. IDs/correlation are selected by the server. Identifier is an exact lookup, not normalized by this adapter. Neither user nor actor can be selected by a caller. Cookie is never retained in a command. Origin must equal the trusted flow origin byte for byte.

func (SigninRequest) Format 

func (SigninRequest) Format(s fmt.State, _ rune)

func (SigninRequest) MarshalJSON 

func (SigninRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit browser-flow export.

func (SigninRequest) MarshalText 

func (SigninRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit browser-flow export.

type SigninResult 

type SigninResult struct {
	Session   session.IssueResult
	CSRF      session.CSRFToken
	Receipt   identity.CommandResult
	Replayed  bool
	Challenge *SigninMFAChallenge
	// CounterRisk is the root verifier's warning for a backup-eligible
	// non-increasing counter. It is available only with committed signin;
	// it neither declares compromise nor invalidates the synced passkey.
	CounterRisk bool
}

SigninResult contains a session only after genuine root verification and the sole durable command commit under the known-empty-factor profile. Explicit MFA composition instead returns Challenge and Receipt, with Session and CSRF empty until an independent enrolled factor completes. Replayed challenge results never disclose a replacement proof or renew original freshness.

func (SigninResult) Format 

func (SigninResult) Format(s fmt.State, _ rune)

func (SigninResult) MarshalJSON 

func (SigninResult) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit authentication export.

func (SigninResult) MarshalText 

func (SigninResult) MarshalText() ([]byte, error)

MarshalText prohibits implicit authentication export.

type SignupCeremonyRateRequest 

type SignupCeremonyRateRequest struct {
	SignupRequest
	CeremonyID string
}

SignupCeremonyRateRequest borrows original signup browser/flow custody and the committed create ceremony. Its anonymous rate dimension authenticates no user and never projects the prospective identity, handle or response. Native Signup must still revalidate and consume current authority atomically.

func (SignupCeremonyRateRequest) Format 

func (SignupCeremonyRateRequest) Format(s fmt.State, _ rune)

func (SignupCeremonyRateRequest) MarshalJSON 

func (SignupCeremonyRateRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit export of original signup browser custody.

func (SignupCeremonyRateRequest) MarshalText 

func (SignupCeremonyRateRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit export of original signup browser custody.

type SignupCompletion 

type SignupCompletion struct {
	SignupRequest
	CeremonyID string
	Response   []byte
	Label      string
}

SignupCompletion adds the original committed registration ceremony and raw response to the completion phase's original command. Response is borrowed for the call, not owned or validated here; the native owner must bound and copy it before parsing or retaining it. Label is untrusted display metadata. The native owner must verify the actual resident-required, UV-required, none-attestation protocol result against the exact selected algorithm profile before creating an account, credential, MFA authority, authentication or session in the same durable work. Retries retain exact original input and must not issue new authentication from historical results.

func (SignupCompletion) Format 

func (SignupCompletion) Format(s fmt.State, _ rune)

Format prevents raw attestation and original-flow disclosure.

func (SignupCompletion) MarshalJSON 

func (SignupCompletion) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit registration-response export.

func (SignupCompletion) MarshalText 

func (SignupCompletion) MarshalText() ([]byte, error)

MarshalText prohibits implicit registration-response export.

type SignupRequest 

type SignupRequest struct {
	CommandID                              identity.CommandID
	FlowID                                 identity.PreAuthTransactionID
	Cookie                                 session.Token
	Origin, Network, Device, CorrelationID string
}

SignupRequest carries the original anonymous browser flow and cookie for an explicitly enabled passkey-first profile without email or password. It does not select a user, tenant, RP, actor or proof. CommandID, CorrelationID and ingress dimensions come from trusted server code; Origin must exactly match the trusted flow origin. Each protected phase uses its own original command, retained on retries. The session owner retains the original flow's remember policy; no continuation may upgrade it. Zero values grant no authority. This data carrier performs no validation, verification or durable mutation.

func (SignupRequest) Format 

func (SignupRequest) Format(s fmt.State, _ rune)

Format prevents browser-flow and trusted-ingress disclosure.

func (SignupRequest) MarshalJSON 

func (SignupRequest) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit browser-flow export.

func (SignupRequest) MarshalText 

func (SignupRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit browser-flow export.

type SignupResult 

type SignupResult struct {
	Session session.IssueResult
	CSRF    session.CSRFToken
}

SignupResult carries session-owner issuance and CSRF custody, not evidence of verification or commitment by itself. The native owner must return secrets only for the fresh winner after acknowledged coherent commit; aborted, unknown and historical outcomes reveal nothing. Value copies retain the session owner's shared reveal-once permissions and do not permit another delivery.

func (SignupResult) Format 

func (SignupResult) Format(s fmt.State, _ rune)

Format prevents authentication and CSRF custody disclosure.

func (SignupResult) MarshalJSON 

func (SignupResult) MarshalJSON() ([]byte, error)

MarshalJSON prohibits implicit authentication export.

func (SignupResult) MarshalText 

func (SignupResult) MarshalText() ([]byte, error)

MarshalText prohibits implicit authentication export.

type UpdateRequest 

type UpdateRequest struct {
	Primary         password.ActionPrimaryRequest
	ReferenceID     identity.CredentialID
	ExpectedVersion uint64
	Name            string
	IdempotencyKey  identity.IdempotencyKey
	Network         string
}

UpdateRequest selects a keyed self-user display-label rename, not credential replacement or removal. Primary carries original password/session/action and selected CSRF custody; a data carrier alone grants no authentication. Native ownership must require a genuine signed identity.passkey.update proof.

ReferenceID is the safe identity-owned management reference returned by List, never raw RP credential bytes. ExpectedVersion is the observed positive management-metadata version; Name preserves 1..128 UTF-8 bytes under DeviceLabel policy. Renaming must not change protocol state or credential authority. Network is trusted bounded ingress for the existing risk owner, not authority.

This native keyed profile deliberately differs from the historical catalog's caller-allocated command shape: Primary.CommandID and RecordID must be empty. Existing request-key admission supplies one server-random original command before native proof preparation; it is returned for every observed outcome. Supplied command/record overrides deny rather than being replaced. A matching retry retains the same key and canonical input, including original custody; it recovers metadata only and never consumes another proof or repeats effects.

func (UpdateRequest) Format 

func (UpdateRequest) Format(s fmt.State, _ rune)

Format excludes original custody, retry correlation and caller display text.

func (UpdateRequest) MarshalJSON 

func (UpdateRequest) MarshalJSON() ([]byte, error)

MarshalJSON requires explicit, credential-free transport projection.

func (UpdateRequest) MarshalText 

func (UpdateRequest) MarshalText() ([]byte, error)

MarshalText prohibits implicit original-custody export.

type UpdateResult 

type UpdateResult struct {
	CommandID  identity.CommandID
	Outcome    identity.CommitOutcome
	Replayed   bool
	Receipt    identity.CommandResult
	Credential *CredentialMetadata
}

UpdateResult carries original command durability and, only for fresh acknowledged commitment, updated safe metadata. Receipt is the existing command owner's exact observation, not current authorization. Replayed means historical metadata: Credential must be nil and no mutation is rerun. Unknown is not rollback; recover this CommandID rather than allocating a replacement. Zero is not success. The result contains no proof, session or protocol bytes; consumers must still explicitly project the fields appropriate to transport.

func (UpdateResult) Format 

func (UpdateResult) Format(s fmt.State, _ rune)

Format excludes command correlation and display metadata from diagnostics.

func (UpdateResult) MarshalJSON 

func (UpdateResult) MarshalJSON() ([]byte, error)

MarshalJSON requires deliberate safe metadata projection, not record export.

func (UpdateResult) MarshalText 

func (UpdateResult) MarshalText() ([]byte, error)

MarshalText prohibits implicit durability/correlation export.

type UserHandle 

type UserHandle struct {
	// contains filtered or unexported fields
}

UserHandle is an opaque identity-to-RP handle, not a public user ID, credential or authorization grant. Zero is invalid. A repository must persist exactly one handle per identity/RP and enforce uniqueness across the whole RP namespace, including other tenants. Copies cannot change its bytes. Never log it. A closure also hides bytes when fmt traverses an unexported enclosing field, where Go deliberately does not invoke the nested value's Formatter method.

func NewUserHandle 

func NewUserHandle(value []byte) (UserHandle, error)

NewUserHandle copies an existing exact 32-byte handle losslessly. This is the selected go-webauthn resident-registration profile, not a general WebAuthn parser or a license to replace an identity's existing handle. Explicit all-zero bytes remain distinct from an absent Go value. No IO or authentication occurs.

func (UserHandle) Bytes 

func (h UserHandle) Bytes() ([]byte, error)

Bytes returns an independently owned copy for protocol/storage composition. It performs no lookup and grants no cross-tenant resolution or authentication.

func (UserHandle) Format 

func (UserHandle) Format(s fmt.State, _ rune)

Format prevents diagnostic correlation of an opaque user handle.

func (UserHandle) MarshalJSON 

func (UserHandle) MarshalJSON() ([]byte, error)

MarshalJSON requires an explicit protocol projection rather than implicit ID export.

func (UserHandle) MarshalText 

func (UserHandle) MarshalText() ([]byte, error)

MarshalText prohibits implicit correlation through text and map keys.

type UserHandlePolicy 

type UserHandlePolicy struct{}

UserHandlePolicy generates opaque random handles for first enrollment only. Its zero value is usable, stateless and concurrency-safe. It has no identity- derived fallback, configurable entropy downgrade, resources or goroutines. The native owner persists the first committed handle and reuses it; calling Generate again must never rotate an already committed identity/RP mapping.

func (UserHandlePolicy) Generate 

func (UserHandlePolicy) Generate(ctx context.Context) (UserHandle, error)

Generate produces the selected 32-byte profile outside the protected SQL transaction. The caller must retain original generated intent on retries and atomically bind it to the first mapping. Cancellation before or after entropy generation returns no handle. It does not create an identity or reserve storage.

Source Files

View all Source files

Directories

Path Synopsis
postgres module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.