security

package
v0.0.0-...-c814626 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 5, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

OAuth/OIDC authentication — you're a Neo admin or you're not. No roles, no permissions matrix, no junior accounts. SSO proves you're on the team. That's the only gate.

Package security implements agent-to-agent trust via ECDSA identity and ephemeral ECDH session encryption.

Each Neo has an ECDSA P-256 key pair. The private key never leaves the machine. The public key IS the identity. Gossip messages are signed. Sessions are encrypted with ECDH-derived ephemeral keys. Swarm secret rotates via gossip. Workers that miss rotation prove identity and get re-keyed automatically.

Secrets rotation tracking — monitors secret age and alerts when rotation is due. Integrates with Vault enricher and the knowledge graph.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DeleteToken 

func DeleteToken() error

DeleteToken removes the cached token (logout).

func GenerateSwarmSecret 

func GenerateSwarmSecret() ([]byte, error)

GenerateSwarmSecret creates a random 256-bit swarm secret.

func MarshalPublicKey 

func MarshalPublicKey(pub *ecdsa.PublicKey) string

MarshalPublicKey encodes a public key to base64 for transport.

func PublicEndpoint 

func PublicEndpoint(next http.HandlerFunc) http.HandlerFunc

PublicEndpoint wraps a handler with no auth (health checks, etc).

func RequireAPIKey 

func RequireAPIKey(keys map[string]string, next http.HandlerFunc) http.HandlerFunc

RequireAPIKey wraps a handler that requires an API key (for external clients).

func SaveToken 

func SaveToken(token *Token) error

SaveToken writes a token to the local config directory.

func UnmarshalPublicKey 

func UnmarshalPublicKey(b64 string) (*ecdsa.PublicKey, error)

UnmarshalPublicKey decodes a base64 public key.

func VerifySignature 

func VerifySignature(pubKey *ecdsa.PublicKey, data, signature []byte) bool

VerifySignature checks an ECDSA signature against a public key.

Types

type AuditEntry 

type AuditEntry struct {
	Timestamp time.Time `json:"timestamp"`
	User      string    `json:"user"`
	Role      string    `json:"role"`
	Action    string    `json:"action"`
	Target    string    `json:"target"`
	SourceIP  string    `json:"source_ip"`
}

AuditLog records an authenticated action.

type AuditLogger 

type AuditLogger struct {
	// contains filtered or unexported fields
}

AuditLogger records actions for compliance.

func NewAuditLogger 

func NewAuditLogger() *AuditLogger

func (*AuditLogger) Log 

func (a *AuditLogger) Log(user, role, action, target, sourceIP string)

func (*AuditLogger) Recent 

func (a *AuditLogger) Recent(limit int) []AuditEntry

type Auth 

type Auth struct {
	// contains filtered or unexported fields
}

Auth handles OAuth/OIDC authentication.

func NewAuth 

func NewAuth(config AuthConfig) *Auth

NewAuth creates an auth handler.

func (*Auth) ExchangeCode 

func (a *Auth) ExchangeCode(ctx context.Context, code string) (*Token, error)

ExchangeCode trades an OAuth code for a token.

func (*Auth) IsEnabled 

func (a *Auth) IsEnabled() bool

IsEnabled returns true if auth is configured.

func (*Auth) LoginURL 

func (a *Auth) LoginURL() string

LoginURL returns the OAuth authorization URL for browser-based login.

func (*Auth) RequireAuth 

func (a *Auth) RequireAuth(next http.HandlerFunc) http.HandlerFunc

RequireAuth wraps an HTTP handler with OAuth token validation. You're an admin or you get 401. No roles.

func (*Auth) ValidateToken 

func (a *Auth) ValidateToken(ctx context.Context, accessToken string) (string, error)

ValidateToken checks if a bearer token is valid and the user is allowed.

type AuthConfig 

type AuthConfig struct {
	Enabled       bool     `yaml:"enabled"`
	Provider      string   `yaml:"provider"` // oidc, google, github, okta, azure-ad
	Issuer        string   `yaml:"issuer"`   // OIDC issuer URL
	ClientID      string   `yaml:"client_id"`
	ClientSecret  string   `yaml:"client_secret"`
	RedirectURL   string   `yaml:"redirect_url"`
	AllowedEmails []string `yaml:"allowed_emails"` // explicit allowlist (empty = all from issuer)
	AllowedDomain string   `yaml:"allowed_domain"` // domain allowlist: "example.com"
}

AuthConfig holds OAuth/OIDC configuration.

type Identity 

type Identity struct {
	PrivateKey *ecdsa.PrivateKey
	PublicKey  *ecdsa.PublicKey
	PublicB64  string // base64-encoded public key for display/transport
}

Identity holds this Neo's ECDSA key pair.

func GenerateIdentity 

func GenerateIdentity() (*Identity, error)

GenerateIdentity creates a new ECDSA P-256 key pair.

func LoadOrCreateIdentity 

func LoadOrCreateIdentity(dir string) (*Identity, error)

LoadOrCreateIdentity loads identity from disk, or generates a new one.

func (*Identity) Sign 

func (id *Identity) Sign(data []byte) ([]byte, error)

Sign produces an ECDSA signature over the SHA-256 hash of the data.

type Keyring 

type Keyring struct {
	// contains filtered or unexported fields
}

Keyring holds trusted public keys. Backed by shared database in enterprise, in-memory for workstation mode.

func NewKeyring 

func NewKeyring() *Keyring

NewKeyring creates an empty keyring.

func (*Keyring) Count 

func (k *Keyring) Count() int

Count returns the number of trusted keys.

func (*Keyring) GetKey 

func (k *Keyring) GetKey(pubB64 string) *ecdsa.PublicKey

GetKey returns the parsed public key if trusted.

func (*Keyring) IsTrusted 

func (k *Keyring) IsTrusted(pubB64 string) bool

IsTrusted returns true if the public key is in the keyring.

func (*Keyring) List 

func (k *Keyring) List() []TrustedKey

List returns all trusted keys.

func (*Keyring) Revoke 

func (k *Keyring) Revoke(pubB64 string)

Revoke removes a public key from the keyring.

func (*Keyring) Trust 

func (k *Keyring) Trust(pubB64, workerID, trustedBy string) error

Trust adds a public key to the keyring.

func (*Keyring) Verify 

func (k *Keyring) Verify(pubB64 string, data, signature []byte) string

Verify checks that a message was signed by a trusted identity. Returns the worker ID if valid, empty string if not.

type Middleware 

type Middleware struct {
	// contains filtered or unexported fields
}

Middleware wraps HTTP handlers with security checks.

func NewMiddleware 

func NewMiddleware(keyring *Keyring, swarm *SwarmSecret) *Middleware

NewMiddleware creates a security middleware.

func (*Middleware) RequireSwarmAuth 

func (m *Middleware) RequireSwarmAuth(next http.HandlerFunc) http.HandlerFunc

RequireSwarmAuth wraps a handler that requires authenticated Neo-to-Neo communication. Checks: X-Neo-PublicKey header present, X-Neo-Signature verifies, key is trusted.

type RotationTracker 

type RotationTracker struct {
	// contains filtered or unexported fields
}

RotationTracker monitors all known secrets for rotation compliance.

func NewRotationTracker 

func NewRotationTracker() *RotationTracker

NewRotationTracker creates a tracker.

func (*RotationTracker) Add 

func (t *RotationTracker) Add(s SecretInfo)

Add registers a secret for tracking.

func (*RotationTracker) Format 

func (t *RotationTracker) Format() string

Format produces a human-readable rotation report.

func (*RotationTracker) NeedingRotation 

func (t *RotationTracker) NeedingRotation() []SecretInfo

NeedingRotation returns all secrets that need rotation.

type SecretInfo 

type SecretInfo struct {
	Name       string    `json:"name"`
	Service    string    `json:"service"`
	Type       string    `json:"type"`   // api_key, password, certificate, ssh_key, token
	Source     string    `json:"source"` // vault, env, config, manual
	CreatedAt  time.Time `json:"created_at"`
	RotatedAt  time.Time `json:"rotated_at"`
	ExpiresAt  time.Time `json:"expires_at,omitempty"`
	MaxAgeDays int       `json:"max_age_days"` // policy: rotate after N days
}

SecretInfo tracks a secret's lifecycle.

func (*SecretInfo) AgeDays 

func (s *SecretInfo) AgeDays() int

AgeDays returns how many days since last rotation.

func (*SecretInfo) DaysUntilExpiry 

func (s *SecretInfo) DaysUntilExpiry() int

DaysUntilExpiry returns days until the secret expires (-1 if no expiry).

func (*SecretInfo) NeedsRotation 

func (s *SecretInfo) NeedsRotation() bool

NeedsRotation returns true if the secret exceeds max age or is near expiry.

type Session 

type Session struct {
	// contains filtered or unexported fields
}

Session is an ephemeral encrypted channel between two Neos. Derived via ECDH from both parties' ECDSA keys. Lives in memory only — never persisted, never reused.

func NewSession 

func NewSession(myPriv *ecdsa.PrivateKey, theirPub *ecdsa.PublicKey) (*Session, error)

NewSession creates an ephemeral encrypted session with a peer. Uses ECDH: my private key + their public key → shared secret → AES-256-GCM key.

func (*Session) Decrypt 

func (s *Session) Decrypt(ciphertext []byte) ([]byte, error)

Decrypt decrypts ciphertext with the session key.

func (*Session) Encrypt 

func (s *Session) Encrypt(plaintext []byte) ([]byte, error)

Encrypt encrypts plaintext with the session key. Each call uses a random nonce.

type SwarmSecret 

type SwarmSecret struct {
	// contains filtered or unexported fields
}

SwarmSecret handles swarm-wide encryption for gossip messages. Rotates via gossip propagation — FIFO, no grace window.

func NewSwarmSecret 

func NewSwarmSecret(secret []byte) (*SwarmSecret, error)

NewSwarmSecret creates a swarm secret from the initial key (from registration).

func (*SwarmSecret) ApplyRotation 

func (s *SwarmSecret) ApplyRotation(newSecret []byte) error

ApplyRotation switches to a new swarm secret. FIFO — immediate, no grace window.

func (*SwarmSecret) Decrypt 

func (s *SwarmSecret) Decrypt(msg []byte) ([]byte, error)

Decrypt decrypts a gossip message. Rejects stale timestamps (>60s drift).

func (*SwarmSecret) Encrypt 

func (s *SwarmSecret) Encrypt(plaintext []byte) ([]byte, error)

Encrypt encrypts a gossip message with the swarm secret. Format: [12 nonce][N ciphertext+tag][8 timestamp][8 version]

func (*SwarmSecret) Rotate 

func (s *SwarmSecret) Rotate() (newSecretEncrypted []byte, newSecretRaw []byte, err error)

Rotate generates a new swarm secret and returns the encrypted rotation message. The new secret is encrypted with the OLD secret so only current swarm members can read it.

func (*SwarmSecret) Version 

func (s *SwarmSecret) Version() uint64

Version returns the current secret version.

type Token 

type Token struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	Email        string    `json:"email"`
	ExpiresAt    time.Time `json:"expires_at"`
}

Token is a cached auth token.

func LoadToken 

func LoadToken() (*Token, error)

LoadToken reads a cached token from disk.

type TrustedKey 

type TrustedKey struct {
	PublicKeyB64 string
	PublicKey    *ecdsa.PublicKey
	WorkerID     string
	TrustedAt    time.Time
	TrustedBy    string // who ran `neo admin trust`
}

TrustedKey is a trusted Neo identity.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.