Versions in this module Expand all Collapse all v0 v0.11.1 Aug 24, 2026 Changes in this version + const AlphaCompatibilityVersion + const AlphaReferenceCommit + const COMMIT_VERSION + const ClientAttestationLifetime + const ClientAttestationTokenType + const ClockSkew + const CommitHashBytes + const CommitIKMBytes + const CommitMACBytes + const CommitVersion + const CredentialLifetime + const CredentialTokenType + const DPOPPProofType + const DPOPProofType + const DPOP_PROOF_TYP + const DelegationLifetime + const DelegationSigningKeyID + const DelegationTokenType + const FallbackSigningKeyID + const LTHASH_STATE_BYTES + const LtHashLanes + const LtHashStateBytes + const MAX_PROOF_AGE_SEC + const MaxCommitContextFieldBytes + const MaxCommitSignatureBytes + const MaxDpopProofAge + const SpaceHostAudienceSuffix + const SpaceSigningKeyID + const StateBytes + var ErrBatchReplayUnavailable = errors.New("atomic replay batch store unavailable") + var ErrNilReplayStore = errors.New("nil replay store") + var ErrReplay = errors.New("replay detected") + func CIDForCBOR(data []byte) (cid.Cid, error) + func CommitMAC(ikm, ctx, hash []byte) []byte + func ComputeCommitMAC(ikm, ctx, hash []byte) ([]byte, error) + func CreateClientAttestation(opts CreateSpaceTokenOptions, signer Signer) (string, error) + func CreateCredential(opts CreateSpaceTokenOptions, signer Signer) (string, error) + func CreateDPoPProof(signer DPoPSigner, opts CreateDpopProofOptions) (string, error) + func CreateDelegationToken(opts CreateSpaceTokenOptions, signer Signer) (string, error) + func CreateDpopProof(signer DPoPSigner, opts CreateDpopProofOptions) (string, error) + func CreateSpaceCredential(opts CreateSpaceTokenOptions, signer Signer) (string, error) + func CreateSpaceToken(kind TokenType, opts CreateSpaceTokenOptions, signer Signer) (string, error) + func DPoPJKTForKey(key *ecdsa.PublicKey) (string, error) + func DpopJKTForKey(key *ecdsa.PublicKey) (string, error) + func EncodeCommitContext(ctx CommitContext, ikm []byte) ([]byte, error) + func EncodeCommitCtx(ctx CommitContext, ikm []byte) ([]byte, error) + func EncodeRepoIndex(index RepoIndex) ([]byte, error) + func EncodeSignedCommit(c SignedCommit) ([]byte, error) + func ExpandElement(element string) []byte + func FormatElement(collection, rkey, cid string) string + func FormatSetHashElement(collection, rkey, cid string) string + func NormalizeDpopHTU(raw string) (string, error) + func NormalizeHTU(raw string) (string, error) + func SerializeRepo(commit SignedCommit, records []SerializedRecord, opts ...SerializeRepoOptions) ([]byte, error) + func SerializeRepoCAR(commit SignedCommit, records []SerializedRecord, opts ...SerializeRepoOptions) ([]byte, error) + func VerifyCommit(commit SignedCommit, ctx CommitContext, didKey string) bool + func VerifyCommitError(commit SignedCommit, ctx CommitContext, didKey string) error + func VerifyCommitWithPublicKey(commit SignedCommit, ctx CommitContext, verifier CommitVerifier) bool + func VerifyCommitWithVerifier(commit SignedCommit, ctx CommitContext, verifier CommitVerifier) bool + func WriteRepoCAR(w io.Writer, commit SignedCommit, records []SerializedRecord, ...) error + type AtprotoSigner struct + func NewAtprotoSigner(key *atcrypto.PrivateKeyK256) (*AtprotoSigner, error) + func (s *AtprotoSigner) Algorithm() string + func (s *AtprotoSigner) Sign(input []byte) ([]byte, error) + type AtprotoVerifier struct + func NewAtprotoVerifier(key atcrypto.PublicKey) (*AtprotoVerifier, error) + func (v *AtprotoVerifier) Algorithm() string + func (v *AtprotoVerifier) Verify(input, sig []byte) error + type BatchReplayStore interface + ConsumeBatch func(ctx context.Context, artifacts []ReplayArtifact) error + type CAROptions = SerializeRepoOptions + type CommitContext struct + Author string + Rev string + Space string + type CommitCtx = CommitContext + type CommitSignOptions = SignOptions + type CommitSigner interface + HashAndSign func(content []byte) ([]byte, error) + type CommitVerifier interface + HashAndVerify func(content, sig []byte) error + type CreateDpopProofOptions struct + Credential string + CredentialPresent bool + HTTPMethod string + HTTPURL string + Htm string + Htu string + JTI string + Now func() time.Time + Random io.Reader + type CreateSpaceTokenOptions struct + Aud string + DPoPJKT string + ExpiresIn time.Duration + Iss string + JTI string + Kid string + Now func() time.Time + Random io.Reader + Sub string + type DPoPSigner interface + PublicJWK func() ([]byte, error) + type DpopProof struct + HTM string + HTU string + IssuedAt time.Time + JKT string + JTI string + func VerifyDPoPProof(ctx context.Context, raw string, opts VerifyDpopProofOptions) (DpopProof, error) + func VerifyDpopProof(ctx context.Context, raw string, opts VerifyDpopProofOptions) (DpopProof, error) + type ECDSASigner struct + func NewECDSASigner(key *ecdsa.PrivateKey, alg string, random io.Reader) (*ECDSASigner, error) + func (s *ECDSASigner) Algorithm() string + func (s *ECDSASigner) PublicJWK() ([]byte, error) + func (s *ECDSASigner) PublicKey() *ecdsa.PublicKey + func (s *ECDSASigner) Sign(input []byte) ([]byte, error) + type ECDSAVerifier struct + func NewECDSAVerifier(key *ecdsa.PublicKey, alg string) (*ECDSAVerifier, error) + func (v *ECDSAVerifier) Algorithm() string + func (v *ECDSAVerifier) Verify(input, sig []byte) error + type GORMReplayStore struct + DB *gorm.DB + func NewGORMReplayStore(db *gorm.DB) *GORMReplayStore + func (s *GORMReplayStore) Consume(ctx context.Context, jti, tokenType string, expiresAt time.Time) error + func (s *GORMReplayStore) ConsumeBatch(ctx context.Context, artifacts []ReplayArtifact) error + func (s *GORMReplayStore) DeleteExpired(ctx context.Context, now time.Time, limit int) (int, error) + type KeyResolutionRequest struct + Algorithm string + ForceRefresh bool + Issuer string + Kid string + type KeyResolver func(context.Context, string, string, string) (Verifier, error) + type LtHash struct + func LtHashFromState(state []byte) (*LtHash, error) + func NewLtHash(states ...[]byte) (*LtHash, error) + func NewLtHashFromState(state []byte) (*LtHash, error) + func (h *LtHash) Add(element string) *LtHash + func (h *LtHash) Digest() []byte + func (h *LtHash) Equal(other *LtHash) bool + func (h *LtHash) Equals(other *LtHash) bool + func (h *LtHash) IsEmpty() bool + func (h *LtHash) Remove(element string) *LtHash + func (h *LtHash) State() []byte + type MemoryReplayStore struct + func NewMemoryReplayStore() *MemoryReplayStore + func NewMemoryReplayStoreWithClock(now func() time.Time) *MemoryReplayStore + func (s *MemoryReplayStore) Consume(ctx context.Context, jti, tokenType string, expiresAt time.Time) error + func (s *MemoryReplayStore) ConsumeBatch(_ context.Context, artifacts []ReplayArtifact) error + type RecordRef = RecordURI + func ParseRecordRef(raw string) (RecordRef, error) + type RecordURI struct + AuthorDID syntax.DID + AuthorityDID syntax.DID + Collection syntax.NSID + RKey syntax.RecordKey + SKey syntax.RecordKey + SpaceType syntax.NSID + func NewRecordURI(authorityDID, spaceType, skey, authorDID, collection, rkey string) (RecordURI, error) + func ParseRecord(raw string) (RecordURI, error) + func ParseRecordURI(raw string) (RecordURI, error) + func (u *RecordURI) UnmarshalText(text []byte) error + func (u RecordURI) MarshalText() ([]byte, error) + func (u RecordURI) Space() SpaceURI + func (u RecordURI) String() string + type ReplayArtifact struct + ExpiresAt time.Time + JTI string + TokenType string + type ReplayStore interface + Consume func(ctx context.Context, jti, tokenType string, expiresAt time.Time) error + type RepoCommit struct + SetHash *LtHash + func NewRepoCommit() *RepoCommit + func RepoCommitFromIndex(index RepoIndex) (*RepoCommit, error) + func RepoCommitFromRecords(records []SerializedRecord) (*RepoCommit, error) + func (r *RepoCommit) Add(collection, rkey string, recordCID interface{ ... }) *RepoCommit + func (r *RepoCommit) Hash() []byte + func (r *RepoCommit) Matches(commit SignedCommit) bool + func (r *RepoCommit) Remove(collection, rkey string, recordCID interface{ ... }) *RepoCommit + func (r *RepoCommit) Sign(ctx CommitContext, signer CommitSigner, opts ...SignOptions) (SignedCommit, error) + type RepoIndex map[string]cid.Cid + func DecodeRepoIndex(data []byte) (RepoIndex, error) + type SerializeRepoOptions struct + ExcludeValues bool + type SerializedRecord struct + Bytes []byte + CID cid.Cid + Collection string + RKey string + Rkey string + func NewSerializedRecord(collection, rkey string, record interface{}) (SerializedRecord, error) + func SerializeRecord(collection, rkey string, record interface{}) (SerializedRecord, error) + func SerializeRecordBytes(collection, rkey string, recordCID cid.Cid, data []byte) (SerializedRecord, error) + type SignOptions struct + IKM []byte + Rand io.Reader + type SignedCommit struct + Hash []byte + IKM []byte + MAC []byte + Rev string + Sig []byte + Ver uint64 + func DecodeSignedCommit(data []byte) (SignedCommit, error) + func SignCommit(hash []byte, ctx CommitContext, signer CommitSigner, opts ...SignOptions) (SignedCommit, error) + func (c *SignedCommit) UnmarshalJSON(data []byte) error + func (c SignedCommit) MarshalJSON() ([]byte, error) + func (c SignedCommit) Validate() error + type Signer interface + Algorithm func() string + Sign func([]byte) ([]byte, error) + type SignerFunc struct + Alg string + Func func([]byte) ([]byte, error) + func (s SignerFunc) Algorithm() string + func (s SignerFunc) Sign(b []byte) ([]byte, error) + type SigningKeyResolver interface + ResolveSigningKey func(context.Context, KeyResolutionRequest) (Verifier, error) + type SigningKeyResolverFunc func(context.Context, KeyResolutionRequest) (Verifier, error) + func (f SigningKeyResolverFunc) ResolveSigningKey(ctx context.Context, req KeyResolutionRequest) (Verifier, error) + type SpaceAuthError struct + Code string + Err error + Msg string + func (e *SpaceAuthError) Error() string + func (e *SpaceAuthError) Unwrap() error + type SpaceRef = SpaceURI + func ParseSpaceRef(raw string) (SpaceRef, error) + type SpaceToken struct + Claims SpaceTokenClaims + Header SpaceTokenHeader + Signature []byte + SigningInput []byte + func ParseSpaceToken(kind TokenType, raw string) (SpaceToken, error) + func VerifyClientAttestation(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error) + func VerifyCredential(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error) + func VerifyDelegationToken(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error) + func VerifySpaceCredential(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error) + func VerifySpaceToken(ctx context.Context, kind TokenType, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error) + type SpaceTokenClaims struct + Aud *string + Cnf *SpaceTokenConfirmation + Exp int64 + IAT int64 + Iss string + JTI string + Sub string + type SpaceTokenConfirmation struct + JKT string + type SpaceTokenHeader struct + Alg string + Kid string + Typ string + type SpaceTokenType = TokenType + type SpaceURI struct + AuthorityDID syntax.DID + SKey syntax.RecordKey + SpaceType syntax.NSID + func NewSpaceURI(authorityDID, spaceType, skey string) (SpaceURI, error) + func ParseSpace(raw string) (SpaceURI, error) + func ParseSpaceURI(raw string) (SpaceURI, error) + func (u *SpaceURI) UnmarshalText(text []byte) error + func (u SpaceURI) MarshalText() ([]byte, error) + func (u SpaceURI) SpaceScopeComponents() (authority, spaceType, skey string) + func (u SpaceURI) String() string + type TokenType string + const TokenClientAttestation + const TokenCredential + const TokenDelegation + type VerifiedRecord struct + Bytes []byte + CID cid.Cid + Collection string + RKey string + type VerifiedRepo struct + Commit SignedCommit + Index RepoIndex + Records []VerifiedRecord + Repo *RepoCommit + Roots []cid.Cid + func ParseRepoCAR(data []byte, params VerifyRepoParams) (VerifiedRepo, error) + func VerifyRepoCAR(data []byte, params VerifyRepoParams) (VerifiedRepo, error) + func VerifyRepoCARFull(data []byte, params VerifyRepoParams) (VerifiedRepo, error) + func VerifyRepoCar(data []byte, params VerifyRepoParams) (VerifiedRepo, error) + type Verifier interface + Algorithm func() string + Verify func([]byte, []byte) error + type VerifierFunc struct + Alg string + Func func([]byte, []byte) error + func (v VerifierFunc) Algorithm() string + func (v VerifierFunc) Verify(b, sig []byte) error + type VerifyDpopProofOptions struct + ClockSkew time.Duration + Context context.Context + Credential string + CredentialPresent bool + ExpectedJKT string + HTTPMethod string + HTTPURL string + Htm string + Htu string + JKT string + Now func() time.Time + Replay ReplayStore + type VerifyRepoParams struct + Author string + DIDKey string + ExpectValues interface{} + Space string + type VerifySpaceTokenOptions struct + Audience string + ClockSkew time.Duration + Context context.Context + Issuer string + KeyResolver KeyResolver + Now func() time.Time + Replay ReplayStore + Resolver KeyResolver + SigningKeyResolver SigningKeyResolver + Subject string + Verifier Verifier
Go to main page