rootproto

Documentation

Index

• type KeyStore
• type Keypair
  • func GenerateKeypair() (*Keypair, error)
• type ReplayStore
• type RequestHandler
• type RespondFn
• type Server
  • func NewServer(selfID string, keyStore KeyStore, replayStore ReplayStore) (*Server, error)
  • func (s *Server) ClearClient(clientID string) error
  • func (s *Server) Close() error
  • func (s *Server) OffRequest(msgType string) error
  • func (s *Server) OnRequest(msgType string, handler RequestHandler) error
  • func (s *Server) Push(clientID, msgType string, payload any, write WriteFn) error
  • func (s *Server) Receive(bytes []byte, write WriteFn) error
• type Session
  • func DeriveSession(privateKey, publicKey []byte) (*Session, error)
  • func SessionFromKey(key []byte) (*Session, error)
  • func (s *Session) Decrypt(ciphertext, aad []byte) ([]byte, error)
  • func (s *Session) Encrypt(plaintext, aad []byte) ([]byte, error)
• type WriteFn

Types

type KeyStore

type KeyStore struct {
	GetPrivateKey         func() ([]byte, error)                           // raw 32-byte scalar
	GetClientPublicKey    func(clientID string) ([]byte, bool)             // raw uncompressed SEC1, (nil,false) if unknown
	CommitClientPublicKey func(clientID string, newPublicKey []byte) error // persist after validated renewKeyAck
}

KeyStore is the server's callback seam into host-owned persistence The server holds one long-lived private key shared across all clients

type Keypair

type Keypair struct {
	PublicKey  []byte
	PrivateKey []byte
}

Keypair holds raw P-256 public and private key bytes Public key: 65-byte uncompressed SEC1 (0x04 || X || Y) Private key: 32-byte raw scalar

func GenerateKeypair

func GenerateKeypair() (*Keypair, error)

GenerateKeypair creates a new P-256 keypair

type ReplayStore

type ReplayStore struct {
	Load   func() ([]byte, error)
	Append func(entry []byte) error
	Save   func(snapshot []byte) error
}

ReplayStore is the host's callback seam for persisting seen requestIDs Append is called after every accepted message; Save replaces the persisted state on client deletion; Load returns the concatenation of every record the host has persisted

type RequestHandler

type RequestHandler func(clientID string, payload []byte, respond RespondFn) (responsePayload any)

RequestHandler processes a client request Either return the response payload, or call respond() to send it immediately (return value will be ignored)

type RespondFn

type RespondFn func(payload any) error

RespondFn sends the response synchronously from inside the handler

type Server

type Server struct {
	// contains filtered or unexported fields
}

func NewServer

func NewServer(selfID string, keyStore KeyStore, replayStore ReplayStore) (*Server, error)

NewServer constructs a server Close when the host shuts down to stop the background key-cleanup goroutine

func (*Server) ClearClient

func (s *Server) ClearClient(clientID string) error

ClearClient drops all per-client state (cached session and replay history)

func (*Server) Close

func (s *Server) Close() error

Close stops background goroutines and releases per-client state

func (*Server) OffRequest

func (s *Server) OffRequest(msgType string) error

OffRequest unregisters the handler for a type

func (*Server) OnRequest

func (s *Server) OnRequest(msgType string, handler RequestHandler) error

OnRequest registers the handler for a client-request type Only one handler per type; calling OnRequest twice for the same type replaces the prior handler

func (*Server) Push

func (s *Server) Push(clientID, msgType string, payload any, write WriteFn) error

Push encrypts and sends a message not triggered by an incoming request RequestID on the wire is empty; clients distinguish pushes from replies by that

func (*Server) Receive

func (s *Server) Receive(bytes []byte, write WriteFn) error

Receive is the entry point for every inbound envelope from the transport layer Reserved types are handled internally; app requests are dispatched to the handler registered via OnRequest

type Session

type Session struct {
	// contains filtered or unexported fields
}

Session holds an AES-256-GCM cipher bound to a derived key

func DeriveSession

func DeriveSession(privateKey, publicKey []byte) (*Session, error)

DeriveSession performs P-256 ECDH between your private key and the other side's public key, runs HKDF-SHA256 over the result, and returns an AES-GCM session bound to the derived key

func SessionFromKey

func SessionFromKey(key []byte) (*Session, error)

SessionFromKey builds an AES-GCM session from a 32-byte key

func (*Session) Decrypt

func (s *Session) Decrypt(ciphertext, aad []byte) ([]byte, error)

Decrypt consumes `nonce(12) || ciphertext || tag(16)`

func (*Session) Encrypt

func (s *Session) Encrypt(plaintext, aad []byte) ([]byte, error)

Encrypt produces `nonce(12) || ciphertext || tag(16)`

type WriteFn

type WriteFn func(bytes []byte) error

WriteFn is the host-owned wire