util

Documentation

Index

• func GenerateElevation(ttl time.Duration, pl ElevationClaims, secret string) (string, error)
• type ElevationClaims
  • func ValidateElevation(token, secret string) (*ElevationClaims, error)

Functions

func GenerateElevation

func GenerateElevation(ttl time.Duration, pl ElevationClaims, secret string) (string, error)

GenerateElevation signs a short-lived elevation token. ttl is typically 5 minutes; the matching cookie should expire at the same time.

Types

type ElevationClaims

type ElevationClaims struct {
	Email     string
	Host      string
	Role      string
	IssuedAt  time.Time
	ExpiresAt time.Time
}

ElevationClaims is the payload of an elevation token. Distinct from the session JWT (entity.TokenPayload) so a stolen session cookie can't be used as an elevation token.

Role is the per-host role the agent granted to this caller at /auth time. "user" by default; "admin" if the agent's MATRIX_ADMIN_USERS list includes the caller's email. The cloud uses it to gate per-app access (guest apps bypass entirely, user/admin apps require role >= required).

IssuedAt/ExpiresAt are populated by ValidateElevation. For GenerateElevation: a zero IssuedAt is replaced by now (fresh elevation); a non-zero IssuedAt is preserved (slide refresh) so the absolute lifetime cap stays anchored to the original password prompt.

func ValidateElevation

func ValidateElevation(token, secret string) (*ElevationClaims, error)

ValidateElevation parses and verifies an elevation JWT.