tokenauth

Jul 13, 2026

Changes in this version

+ const BucketSourceCaller

+ const BucketSourceClaim

type GateRule

+ BucketSource string

Jul 7, 2026

Changes in this version

+ const AuthorizationVersion

+ const DefaultAuthorizationTTLSecs

+ func VerifyPolicySidecar(policyJSON []byte, sidecar string, trustedPubs [][32]byte) error

+ type AttesterSigner struct

+ func NewAttesterSigner(seed []byte) (*AttesterSigner, error)

+ func (s *AttesterSigner) Public() [32]byte

+ func (s *AttesterSigner) Sign(auth *IssuanceAuthorization, rho []byte) error

+ type IssuanceAuthorization struct

+ BindingHex string

+ Exp uint64

+ Iat uint64

+ MaxBatch uint32

+ PolicyLabel string

+ RateLimitID []byte

+ RateLimitIDB64 string

+ Sig []byte

+ SigB64 string

+ Version uint32

+ func (a *IssuanceAuthorization) Normalize() error

+ func (a *IssuanceAuthorization) SignedBytes() ([]byte, error)

+ func (a *IssuanceAuthorization) Verify(attesterPub [32]byte, now uint64) error

+ type PolicySigner struct

+ func NewPolicySigner(seed []byte) (*PolicySigner, error)

+ func (s *PolicySigner) Public() [32]byte

+ func (s *PolicySigner) SignPolicy(policyJSON, rho []byte) (string, error)

Jul 7, 2026

Changes in this version

type Eligibility

+ GateKind GateKind

+ type GateKind string

+ const GateEmail

+ const GateTEE

+ type GateRule struct

+ AddressClaim string

+ AllowedHosts []string

+ BucketClaim string

+ Enabled bool

type Source

+ Gates map[string]GateRule

type TokenRule

+ AllowedGates []string

Jul 7, 2026

Changes in this version

+ const AssuranceVerified

+ const ModeDevelopment

+ const ModeProduction

+ var ErrBudgetExceeded = errors.New("issuance budget exceeded for this bucket in the current window")

+ type BridgeKind string

+ const BridgeEmail

+ const BridgeTEE

+ type BridgeRule struct

+ AddressClaim string

+ AllowedHosts []string

+ BucketClaim string

+ Enabled bool

+ type BudgetRule struct

+ Limit int

+ WindowSeconds int

+ type BudgetStore interface

+ Reserve func(key string, amount int, limit int, window time.Duration, now time.Time) error

+ type Check struct

+ Detail string

+ Name string

+ Pass bool

+ type Defaults struct

+ AllowSoftwareWitness bool

+ AuthorizationTTL int

+ MaxBatch int

+ type Eligibility struct

+ Assurance string

+ BridgeKind BridgeKind

+ BucketID string

+ Claims map[string]string

+ type MeasurementRule struct

+ Allow []string

+ ValueX string

+ type MemoryBudgetStore struct

+ func NewMemoryBudgetStore() *MemoryBudgetStore

+ func (m *MemoryBudgetStore) Prune(now time.Time)

+ func (m *MemoryBudgetStore) Reserve(key string, amount, limit int, window time.Duration, now time.Time) error

+ type MintConstraints struct

+ Address string

+ BindingB64 string

+ BudgetKey string

+ Count int

+ ExpiresAt int64

+ KeyVersion uint32

+ Origin string

+ TokenFamily TokenFamily

+ type MintDecision struct

+ Allow bool

+ Checks []Check

+ Constraints MintConstraints

+ Reason string

+ type MintRequest struct

+ Address string

+ Binding []byte

+ Count int

+ Eligibility []Eligibility

+ KeyVersion uint32

+ Origin string

+ Subject Subject

+ TokenFamily TokenFamily

+ type Policy struct

+ func Compile(src Source) (*Policy, error)

+ func CompileJSON(raw []byte) (*Policy, error)

+ func (p *Policy) AuthorizeMint(req MintRequest, budgets BudgetStore, now time.Time) MintDecision

+ func (p *Policy) Mode() string

+ type Source struct

+ Bridges map[string]BridgeRule

+ Budgets map[string]BudgetRule

+ Defaults Defaults

+ Measurements []MeasurementRule

+ Mode string

+ TokenFamilies map[string]TokenRule

+ Version int

+ type Subject struct

+ Claims map[string]string

+ Platform string

+ Runtime string

+ ValueX string

+ type TokenFamily string

+ const TokenBurn

+ const TokenPolicyEmail

+ const TokenPrivateIdentity

+ type TokenRule struct

+ AllowedBridges []string

+ AllowedOrigins []string

+ BudgetGroup string

+ Enabled bool

+ MaxBatch int

+ RequiresAddressClaim bool

+ RequiresAttestation bool

+ RequiresOrigin bool