valiss

Jul 13, 2026

Changes in this version

type Identity

+ Operator *OperatorClaims

type Verifier

+ func NewKeyringVerifier(keyring *Keyring, allowlist Allowlist, opts ...VerifierOption) *Verifier

Jul 13, 2026

Changes in this version

+ func IssueAccount(operator nkeys.KeyPair, tenantPubKey string, opts ...IssueOption) (string, error)

type IssueOption

+ func WithName(name string) IssueOption

+ type Keyring struct

+ func NewKeyring(operatorTokens ...string) (*Keyring, error)

type MessageClaims

+ Operator *OperatorClaims

+ func VerifyMessageKeyring(token string, keyring *Keyring, opts ...VerifyMessageOption) (*MessageClaims, error)

type OperatorClaims

+ Name string

Jul 13, 2026

Changes in this version

+ const ChainRequired

+ const HeaderChain

+ const HeaderChainAccountToken

+ const HeaderChainUserToken

+ var ErrNoChain = errors.New(...)

+ type ChainCache interface

+ Del func(userPubKey string)

+ Get func(userPubKey string) (accountToken, userToken string, ok bool)

+ Put func(userPubKey, accountToken, userToken string)

+ type MemoryChainCache struct

+ func NewMemoryChainCache() *MemoryChainCache

+ func (c *MemoryChainCache) Del(userPubKey string)

+ func (c *MemoryChainCache) Get(userPubKey string) (string, string, bool)

+ func (c *MemoryChainCache) Put(userPubKey, accountToken, userToken string)

Jul 13, 2026

Changes in this version

+ const DefaultMessageTTL

+ const HeaderMessageToken

+ func Checksum(payload []byte) string

+ func ContextWithMessage(ctx context.Context, c *MessageClaims) context.Context

+ func IssueMessage(user nkeys.KeyPair, opts ...IssueOption) (string, error)

type IssueOption

+ func WithAudience(aud string) IssueOption

+ func WithChain(accountToken, userToken string) IssueOption

+ func WithChecksum(sum string) IssueOption

+ type MessageClaims struct

+ Account *AccountClaims

+ Audience string

+ Checksum string

+ Epoch uint64

+ Ext Extensions

+ User *UserClaims

+ func MessageFromContext(ctx context.Context) (*MessageClaims, bool)

+ func VerifyMessage(token, operatorPubKey string, opts ...VerifyMessageOption) (*MessageClaims, error)

+ type VerifyMessageOption func(*verifyMessageConfig)

+ func At(t time.Time) VerifyMessageOption

+ func ExpectAudience(aud string) VerifyMessageOption

+ func RequireChecksum() VerifyMessageOption

+ func WithChainTokens(accountToken, userToken string) VerifyMessageOption

+ func WithMessageSkew(d time.Duration) VerifyMessageOption

+ func WithOperatorPolicy(operatorToken string) VerifyMessageOption

+ func WithPayload(payload []byte) VerifyMessageOption

Jul 10, 2026

Changes in this version

+ const HeaderNonce

+ func NewNonce() string

+ type MemoryReplayCache struct

+ func NewMemoryReplayCache() *MemoryReplayCache

+ func (c *MemoryReplayCache) SeenBefore(nonce string, expiry time.Time) bool

+ type ReplayCache interface

+ SeenBefore func(nonce string, expiry time.Time) bool

type Request

+ Context []byte

+ Nonce string

type VerifierOption

+ func WithReplayCache(cache ReplayCache) VerifierOption

Jul 10, 2026

Changes in this version

+ func IssueOperator(operator nkeys.KeyPair, opts ...IssueOption) (string, error)

type AccountClaims

+ Epoch uint64

type IssueOption

+ func WithEpoch(epoch uint64) IssueOption

+ type OperatorClaims struct

+ Epoch uint64

+ Ext Extensions

+ func VerifyOperator(token, operatorPubKey string) (*OperatorClaims, error)

type UserClaims

+ Epoch uint64

type VerifierOption

+ func WithOperatorToken(token string) VerifierOption

Jul 9, 2026

Changes in this version

+ const DefaultSkew

+ const HeaderAccountToken

+ const HeaderSignature

+ const HeaderTimestamp

+ const HeaderUserToken

+ func ContextWithIdentity(ctx context.Context, id *Identity) context.Context

+ func Covered(granted []string, required string) bool

+ func ExtOf[T Extension](exts Extensions) (T, bool, error)

+ func Issue(operator nkeys.KeyPair, name, tenantPubKey string, opts ...IssueOption) (string, error)

+ func IssueUser(account nkeys.KeyPair, name, userPubKey string, opts ...IssueOption) (string, error)

+ func IssuerOf(token string) (string, error)

+ func SignRequest(tenant nkeys.KeyPair, now time.Time) (timestamp, signature string, err error)

+ func VerifySignature(tenantPubKey, timestamp, signature string, now time.Time, skew time.Duration) error

+ type AccountClaims struct

+ Ext Extensions

+ Name string

+ func VerifyAccount(token, operatorPubKey string) (*AccountClaims, error)

+ type AccountTokenResolver func(accountPubKey string) (string, error)

+ func StaticAccountTokens(tokens ...string) (AccountTokenResolver, error)

+ type AllowAll struct

+ func (AllowAll) Allowed(string) bool

+ type Allowlist interface

+ Allowed func(jti string) bool

+ type Claims struct

+ ExpiresAt time.Time

+ ID string

+ IssuedAt time.Time

+ Issuer string

+ NotBefore time.Time

+ Subject string

+ func Decode(token string) (*Claims, error)

+ func (c *Claims) Expired(now time.Time, skew time.Duration) bool

+ func (c *Claims) NotYetValid(now time.Time, skew time.Duration) bool

+ type ClaimsValidator func(req Request, id *Identity) error

+ func ExtValidator[T Extension](fn func(req Request, id *Identity, acct, user T) error) ClaimsValidator

+ type Extension interface

+ ExtensionName func() string

+ type Extensions map[string]json.RawMessage

+ type Identity struct

+ Account *AccountClaims

+ User *UserClaims

+ func IdentityFromContext(ctx context.Context) (*Identity, bool)

+ type IssueOption func(*issueConfig)

+ func WithBearer() IssueOption

+ func WithExpiry(t time.Time) IssueOption

+ func WithExtension(v Extension) IssueOption

+ func WithNotBefore(t time.Time) IssueOption

+ func WithTTL(ttl time.Duration) IssueOption

+ type Request struct

+ AccountToken string

+ Signature string

+ Timestamp string

+ UserToken string

+ type StaticAllowlist struct

+ func LoadAllowlistFile(path string) (*StaticAllowlist, error)

+ func NewStaticAllowlist(ids ...string) *StaticAllowlist

+ func (a *StaticAllowlist) Allowed(jti string) bool

+ func (a *StaticAllowlist) Set(ids []string)

+ type UserClaims struct

+ Bearer bool

+ Ext Extensions

+ Name string

+ func VerifyUser(token, accountPubKey string) (*UserClaims, error)

+ type Verifier struct

+ func NewVerifier(operatorPubKey string, allowlist Allowlist, opts ...VerifierOption) *Verifier

+ func (v *Verifier) VerifyRequest(req Request) (*Identity, error)

+ type VerifierOption func(*Verifier)

+ func WithAccountTokenResolver(fn AccountTokenResolver) VerifierOption

+ func WithClaimsValidator(fn ClaimsValidator) VerifierOption

+ func WithClock(now func() time.Time) VerifierOption

+ func WithExtensionType[T Extension]() VerifierOption

+ func WithSkew(d time.Duration) VerifierOption