replidentity

package module
Version: v0.0.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 7, 2022 License: MIT Imports: 15 Imported by: 0

README

Repl Identity

Blog post on https://blog.replit.com coming soon!

Repl Identity stores a REPL_IDENTITY token in every Repl automatically. This token is a signed PASETO that includes verifiable repl identity data (such as the user in the repl, and the repl ID).

WARNING: in their current form, these tokens are very forwardable! You should only send these tokens to repls that you trust, or between repls that you own.

This package provides the necessary code to verify these tokens.

Check the example at examples/extract.go for an example usage. You can also see this in action at https://replit.com/@mattiselin/repl-identity. If you are logged in to Replit, you'll see your username when you click "Run" on the Cover Page - that's Repl Identity at work.

Documentation

Overview

Package replidentity provides verification utilities for Repl Identity tokens.

Example
identity := os.Getenv("REPL_IDENTITY")
if identity == "" {
	fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
	return
}
identityKey := os.Getenv("REPL_IDENTITY_KEY")
if identity == "" {
	fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
	return
}

// This should be set to the Repl ID of the repl you want to prove your
// identity to.
targetRepl := "target_repl"

// Create a signing authority that is authorized to emit tokens for the
// current repl.
signingAuthority, err := replidentity.NewSigningAuthority(
	string(identityKey),
	identity,
	os.Getenv("REPL_ID"),
	replidentity.ReadPublicKeyFromEnv,
)
if err != nil {
	panic(err)
}

signedToken, err := signingAuthority.Sign(targetRepl)
if err != nil {
	panic(err)
}

// Verify the signed token, pretending we are the target repl.
replIdentity, err := replidentity.VerifyIdentity(
	signedToken,
	targetRepl,
	replidentity.ReadPublicKeyFromEnv,
)
if err != nil {
	panic(err)
}

fmt.Println()
fmt.Printf("The identity in the repl's token (%d bytes) is:\n", len(identity))
fmt.Printf(
	"repl id: %s\n   user: %s\n   slug: %s  audience: %s\n",
	replIdentity.Replid,
	replIdentity.User,
	replIdentity.Slug,
	replIdentity.Aud,
)
Output:

Index

Examples

Constants

This section is empty.

Variables

This section is empty.

Functions

func CreateIdentityTokenAddressedTo added in v0.0.2

func CreateIdentityTokenAddressedTo(audience string) (string, error)

CreateIdentityTokenAddressedTo returns a Replit identity token that proves this Repl's identity that includes an audience claim to restrict forwarding. It creates a new signing authority each time, which can be slow. If you plan on signing multiple tokens, use CreateIdentityTokenSigningAuthority() to create an authority to sign with.

func ReadPublicKeyFromEnv

func ReadPublicKeyFromEnv(keyid, issuer string) (ed25519.PublicKey, error)

ReadPublicKeyFromEnv provides a PubKeySource that reads public keys from the `REPL_PUBKEYS` environment variable that is present in all repls.

func VerifyIdentity

func VerifyIdentity(message string, audience string, getPubKey PubKeySource) (*api.GovalReplIdentity, error)

VerifyIdentity verifies that the given `REPL_IDENTITY` value is in fact signed by Goval's chain of authority, and addressed to the provided audience (the `REPL_ID` of the recipient).

func VerifyIdentityWithSource added in v0.0.5

func VerifyIdentityWithSource(message string, audience string, sourceReplid string, getPubKey PubKeySource) (*api.GovalReplIdentity, error)

VerifyIdentityWithSource verifies that the given `REPL_IDENTITY` value is in fact signed by Goval's chain of authority, and addressed to the provided audience (the `REPL_ID` of the recipient). It also verifies that the identity's origin replID matches the given source, if present. This can be used to enforce specific clients in servers when verifying identities.

Types

type MessageClaims

type MessageClaims struct {
	Repls    map[string]struct{}
	Users    map[string]struct{}
	Clusters map[string]struct{}
	Flags    map[api.FlagClaim]struct{}
}

MessageClaims is a collection of indexable claims that are made by a certificate.

type PubKeySource

type PubKeySource func(keyid, issuer string) (ed25519.PublicKey, error)

PubKeySource provides an interface for looking up an [ed25519.PublicKey] from some external source.

type SigningAuthority

type SigningAuthority struct {
	// contains filtered or unexported fields
}

SigningAuthority can generate tokens that prove the identity of one repl (your own) against another repl (the audience). Use this to prevent the target repl from spoofing your own identity by forwarding the token.

func CreateIdentityTokenSigningAuthority added in v0.0.2

func CreateIdentityTokenSigningAuthority() (*SigningAuthority, error)

CreateIdentityTokenSigningAuthority creates a signing authority with this repl's identity key.

func NewSigningAuthority

func NewSigningAuthority(
	marshaledPrivateKey,
	marshaledIdentity string,
	replid string,
	getPubKey PubKeySource,
) (*SigningAuthority, error)

NewSigningAuthority returns a new SigningAuthority given the marshaled private key (obtained from the `REPL_IDENTITY_KEY` environment variable), the identity token (obtained from the `REPL_IDENTITY` environment variable), the current Repl ID (obtained from the `REPL_ID` environment varaible), and the source of public keys (typically ReadPublicKeyFromEnv).

func (*SigningAuthority) Sign

func (a *SigningAuthority) Sign(audience string) (string, error)

Sign generates a new token that can be given to the provided audience, and is resistant against forwarding, so that the recipient cannot forward this token to another repl and claim it came directly from you.

Directories

Path Synopsis
Package paserk contains implementations of [PASERK](https://github.com/paseto-standard/paserk), an extension to PASETO that allows for key sharing.
Package paserk contains implementations of [PASERK](https://github.com/paseto-standard/paserk), an extension to PASETO that allows for key sharing.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL