auth

Documentation

Index

• Constants
• func RemoveTrustedDevice(ctx context.Context, client *http.Client, cfg *LoginConfig, td *TrustedDevice) error
• type Bootstrap
  • func LoginPassword(ctx context.Context, client *http.Client, cfg *LoginConfig, ...) (*Bootstrap, error)
  • func LoginTrustedDevice(ctx context.Context, client *http.Client, cfg *LoginConfig, td *TrustedDevice) (*Bootstrap, error)
• type LoginConfig
  • func FetchLoginConfig(ctx context.Context, client *http.Client) (*LoginConfig, error)
  • func (c *LoginConfig) AuthURL() string
• type SignKey
  • func NewSignKey() (*SignKey, error)
  • func (k *SignKey) ConnectionParam() (string, error)
  • func (k *SignKey) InitValue() (string, error)
  • func (k *SignKey) MarshalJSON() ([]byte, error)
  • func (k *SignKey) NextReconnectKey() (string, error)
  • func (k *SignKey) NextSessionKey() (string, error)
  • func (k *SignKey) UnmarshalJSON(b []byte) error
• type TrustedDevice
• type TrustedDeviceRequest
  • func NewTrustedDeviceRequest(name string) *TrustedDeviceRequest
• type TwoFactorFunc

Constants

const LoginPageURL = "https://access.dwservice.net/login.dw"

LoginPageURL is the entry point served by DWService.

Functions

func RemoveTrustedDevice

func RemoveTrustedDevice(ctx context.Context, client *http.Client, cfg *LoginConfig, td *TrustedDevice) error

RemoveTrustedDevice deregisters a trusted device on the account, freeing its slot (device registrations are capped). It mirrors the client's removeDevice flow: a signed device request with removeDevice=true.

Types

type Bootstrap

type Bootstrap struct {
	Raw     map[string]any // full authentication.dw "ok" response
	SignKey *SignKey       // account-session signing key (private kept here)

	// TrustedDeviceID/Name are set when a trusted device was registered.
	TrustedDeviceID   string
	TrustedDeviceName string
}

Bootstrap is the result of a successful login: everything needed to open the account command channel. The raw "ok" response is preserved because the exact field set is server-defined and may carry either a single node URL or a node list.

func LoginPassword

func LoginPassword(ctx context.Context, client *http.Client, cfg *LoginConfig, user, password string, trusted *TrustedDeviceRequest, twoFA TwoFactorFunc) (*Bootstrap, error)

LoginPassword performs the user+password login, transparently handling a second factor (TOTP or email) via twoFA when the server requests one. On success it returns a Bootstrap; if trusted is non-nil a trusted device is registered on the successful step and returned via trusted for persistence.

func LoginTrustedDevice

func LoginTrustedDevice(ctx context.Context, client *http.Client, cfg *LoginConfig, td *TrustedDevice) (*Bootstrap, error)

LoginTrustedDevice performs passwordless login using a stored trusted device.

type LoginConfig

type LoginConfig struct {
	ServerKeyB64 string // cryptAlgorithmAccept[0].importKey.keyData (SPKI, P-256)
	BaseURL      string // e.g. https://access.dwservice.net/
	RequestURL   string // authentication endpoint base
}

LoginConfig holds the values dwshell needs from the login page. The server's ECDH public key rotates, so this must be fetched live before each login.

func FetchLoginConfig

func FetchLoginConfig(ctx context.Context, client *http.Client) (*LoginConfig, error)

FetchLoginConfig loads the login page and extracts the crypto config.

func (*LoginConfig) AuthURL

func (c *LoginConfig) AuthURL() string

AuthURL returns the authentication.dw endpoint.

type SignKey

type SignKey struct {
	Name string // e.g. "SIGN_ECDSA_512"
	// contains filtered or unexported fields
}

SignKey is a per-session ECDSA signing key. DWService generates one at login and one per agent/share connection, then authenticates each subsequent request by signing a monotonic counter with it (see PROTOCOL.md §1.3).

The default algorithm is SIGN_ECDSA_512 (curve P-521, hash SHA-512), which is what the browser client selects in practice.

func NewSignKey

func NewSignKey() (*SignKey, error)

NewSignKey generates a fresh SIGN_ECDSA_512 signing key.

func (*SignKey) ConnectionParam

func (k *SignKey) ConnectionParam() (string, error)

ConnectionParam returns the JSON sessionKey parameter for an agent/share connection (full generated key). The same SignKey then signs that session.

func (*SignKey) InitValue

func (k *SignKey) InitValue() (string, error)

InitValue returns the cached signed seed (see initValue).

func (*SignKey) MarshalJSON

func (k *SignKey) MarshalJSON() ([]byte, error)

MarshalJSON serializes the key as {name, private JWK} for config storage.

func (*SignKey) NextReconnectKey

func (k *SignKey) NextReconnectKey() (string, error)

NextReconnectKey returns the per-request auth string for ?request=initialize. The counter starts at the seed and decrements (matching getNewReconnectKey).

func (*SignKey) NextSessionKey

func (k *SignKey) NextSessionKey() (string, error)

NextSessionKey returns the per-request auth string for command POSTs and the WebSocket handshake. The counter is epoch millis, forced strictly increasing (matching getNewSessionKey).

func (*SignKey) UnmarshalJSON

func (k *SignKey) UnmarshalJSON(b []byte) error

UnmarshalJSON restores a key previously produced by MarshalJSON.

type TrustedDevice

type TrustedDevice struct {
	ID      string   `json:"id"`
	Name    string   `json:"name"`
	AuthKey *SignKey `json:"authKey"` // serialized via SignKey's JSON methods
}

TrustedDevice is a persisted passwordless credential: a device id plus the private signing key registered with the account. It is the "permanent token".

type TrustedDeviceRequest

type TrustedDeviceRequest struct {
	Name string
	Type string
	OS   string

	Result *TrustedDevice
}

TrustedDeviceRequest asks LoginPassword to register a trusted device. After a successful login, Result holds the credential to persist.

func NewTrustedDeviceRequest

func NewTrustedDeviceRequest(name string) *TrustedDeviceRequest

NewTrustedDeviceRequest builds a request with sensible local defaults.

type TwoFactorFunc

type TwoFactorFunc func(method string, retry bool) (string, error)

TwoFactorFunc supplies a second-factor code on demand. method is the server's requested factor ("totp" or "email"); retry is true after a rejected code.