bridge

Aug 17, 2026

Changes in this version

+ const DefaultPort

+ const HeaderKey

+ const HeaderNonce

+ const HeaderSignature

+ const HeaderTimestamp

+ const KeyLen

+ const SASDigits

+ var ErrPairAmbiguous = errors.New("bridge: that code matched two phones — both were cancelled, please rescan")

+ var ErrPairBadCommit = errors.New("bridge: pairing requires a valid commitment")

+ var ErrPairBadKey = errors.New("bridge: pairing reveal requires the phone's public key")

+ var ErrPairCodeMismatch = errors.New("bridge: that code matches no waiting phone")

+ var ErrPairCommitMismatch = errors.New("bridge: pairing reveal did not match the commitment — rescan")

+ var ErrPairLockedOut = errors.New("bridge: pairing locked after repeated wrong codes — wait a moment")

+ var ErrPairNoAttempt = errors.New("bridge: pairing attempt not found or expired — rescan")

+ var ErrPairTooManyPending = errors.New("bridge: too many pending pairing attempts — wait a moment and rescan")

+ var ErrPairWindowClosed = errors.New(...)

+ func CanonicalRequest(ts int64, nonceHex, method, requestURI string, body []byte) []byte

+ func DecodeKey(s string) ([]byte, error)

+ func DecodeSig(s string) ([]byte, error)

+ func DeriveSAS(attemptID, commitHex string, nonceD, devicePub, nonceP, hostPub []byte) string

+ func EncodeKey(key []byte) string

+ func EncodeSig(sig []byte) string

+ func ProbeHandler(store *Store) http.Handler

+ func SASCommit(devicePub, nonceP []byte) string

+ func SignRequest(priv ed25519.PrivateKey, ts int64, nonceHex, method, requestURI string, ...) string

+ func VerifySASReply(hostPub []byte, attemptID, commitHex string, nonceD []byte, sigB64 string) bool

+ type AttemptState string

+ const AttemptApproved

+ const AttemptExpired

+ const AttemptPending

+ type Authenticator struct

+ func NewAuthenticator(store *Store, userID string, lg *log.Logger, now func() time.Time) *Authenticator

+ func (a *Authenticator) LastConnection() (device string, at time.Time)

+ func (a *Authenticator) MintSessionToken(devicePub []byte) (token string, expiresAt time.Time, err error)

+ func (a *Authenticator) Verify(r *http.Request) (auth.Principal, error)

+ type BindStatus struct

+ Err string

+ IP string

+ Reason bindReason

+ type DeviceRecord struct

+ AddedAt time.Time

+ LastSeen *time.Time

+ Name string

+ PubKey string

+ type ListenerOptions struct

+ Handler http.Handler

+ LANIP func() (net.IP, error)

+ Log *log.Logger

+ Network func(context.Context) Network

+ Port int

+ Store *Store

+ Tailnet func(context.Context) *Tailnet

+ type Listeners struct

+ func NewListeners(opts ListenerOptions) *Listeners

+ func (l *Listeners) Close()

+ func (l *Listeners) LastStatus() Status

+ func (l *Listeners) Refresh(ctx context.Context) Status

+ type Network struct

+ Fingerprint string

+ Label string

+ func CurrentNetwork(ctx context.Context) Network

+ type Pairing struct

+ func NewPairing(store *Store, now func() time.Time) *Pairing

+ func (p *Pairing) Begin(device, commitHex string) (id string, nonceD []byte, replySig string, err error)

+ func (p *Pairing) Complete(typed string) (device string, err error)

+ func (p *Pairing) PollAttempt(id string) AttemptState

+ func (p *Pairing) RefreshWindow() []string

+ func (p *Pairing) Reveal(id string, devicePub, nonceP []byte) error

+ type Status struct

+ Binds []BindStatus

+ LANIP string

+ Network Network

+ NetworkTrusted bool

+ Port int

+ Tailnet *Tailnet

+ type Store struct

+ func OpenStore(path string) (*Store, error)

+ func (s *Store) AddDevice(pub []byte, name string) error

+ func (s *Store) Device(pub []byte) (DeviceRecord, bool)

+ func (s *Store) Devices() []DeviceRecord

+ func (s *Store) HostPublicKey() []byte

+ func (s *Store) NetworkTrusted(fingerprint string) bool

+ func (s *Store) RemoveAllDevices() (int, error)

+ func (s *Store) RemoveDevice(pub []byte) (bool, error)

+ func (s *Store) SignNonce(nonce []byte) []byte

+ func (s *Store) SignSASReply(attemptID, commitHex string, nonceD []byte) []byte

+ func (s *Store) TouchDevice(pub []byte) error

+ func (s *Store) TrustNetwork(fingerprint, label string) error

+ type Tailnet struct

+ DNSName string

+ IP string

+ func DiscoverTailnet(ctx context.Context) *Tailnet

+ type TrustedNetwork struct

+ AddedAt time.Time

+ Label string