aicverifier

package module

Go to main page

Versions in this module

v0

v0.3.0-rc2

Sep 23, 2026

v0.3.0-rc1

Sep 23, 2026

v0.2.0

Sep 14, 2026

Changes in this version

+ const AdmissionRecordPredicateType

+ const AdmissionRecordVersion

+ const OutcomeExecuted

+ const OutcomeFailed

+ const OutcomeIndeterminate

+ const OutcomeObserved

+ const OutcomeRecordPredicateType

+ const OutcomeRecordVersion

+ const ProblemContentType

+ const ProblemTypeEvidenceRequired

+ var ErrRecordSignerMismatch = errors.New("aic-verifier: record signature does not verify against the pinned key")

+ func BuildSourceChain(clientCert *x509.Certificate, aic *AIC, userCert *x509.Certificate) (*semantics.SourceChain, error)

+ func ConnectionConstraintEvaluator(clientIP string) func(op Operation, unresolved []string) bool

+ func LoadEvidenceRecord(path string) (*semantics.DecisionRecord, error)

+ func NewAdmissionEnvelope(rec AdmissionRecord) (semantics.Envelope, error)

+ func NewOutcomeEnvelope(rec OutcomeRecord) (semantics.Envelope, error)

+ func ProfileSubjectDigest(env semantics.Envelope) (semantics.Digest, bool, error)

+ func RecorderSubjectDigest(env semantics.Envelope) (semantics.Digest, bool, error)

+ func SubjectDigestByName(env semantics.Envelope, name string) (semantics.Digest, bool, error)

+ func VerifyFnFromPublicKey(pub *ecdsa.PublicKey) func(keyID string, pae, sig []byte) error

type AdmissionConfig

+ DecisionContext *semantics.DecisionContext

+ DischargeObligations bool

+ ObligationsUnderstood []string

+ RequireFreshDecisionContext bool

+ type AdmissionFact struct

+ Digest semantics.Digest

+ Note string

+ Type string

+ type AdmissionIdentity struct

+ AgentID string

+ Principal string

+ SPIFFEID string

+ Serial string

+ type AdmissionRecord struct

+ At time.Time

+ Facts []AdmissionFact

+ Identity AdmissionIdentity

+ Outcome string

+ Reason string

+ RecorderID string

+ Stage string

+ Ver string

+ func NewAdmissionRecord(ctx EvidenceContext, err *AuthError, facts []AdmissionFact) AdmissionRecord

+ func ParseAdmissionEnvelope(env semantics.Envelope) (AdmissionRecord, error)

+ func (r AdmissionRecord) Digest() (semantics.Digest, error)

type AdmissionResult

+ Sources *semantics.SourceChain

type AuditEntry

+ RecordDigest string

type AuthContext

+ Evidence []RecordRef

+ Satisfaction *semantics.RequirementResult

type AuthError

+ Evidence []RecordRef

+ Problem *ProblemDetails

+ Satisfaction *semantics.RequirementResult

+ Stage string

type Capability

+ func ConstraintToCapability(c string) (Capability, bool)

+ type ChallengeCarrier interface

+ Write func(w http.ResponseWriter, problem *ProblemDetails) error

+ var DefaultChallengeCarrier ChallengeCarrier = problemJSONCarrier{}

+ type ChallengeConfig struct

+ Audience string

+ NewID func() string

+ NewNonce func() string

+ Now func() time.Time

+ ObtainHints []semantics.ObtainHint

+ RetryAfter time.Duration

+ TTL time.Duration

type Config

+ ChallengeCarrier ChallengeCarrier

+ Challenges *ChallengeConfig

+ DecisionContext *semantics.DecisionContext

+ DischargeObligations bool

+ Evidence *EvidenceConfig

+ EvidenceFacts func(r *http.Request, ac *AuthContext) ([]semantics.EvidenceFact, error)

+ EvidenceProfile string

+ EvidenceRequirement *semantics.Requirement

+ ObligationsUnderstood []string

+ RequireFreshDecisionContext bool

type EvidenceBundle

+ func (b *EvidenceBundle) CheckDecisions() error

+ type EvidenceConfig struct

+ Audience string

+ EmitOutcome bool

+ Gaps *GapCounter

+ KeyID string

+ Now func() time.Time

+ OnError func(ctx EvidenceContext, err error)

+ Profile *EvidenceProfile

+ Recorder *RecorderDescriptor

+ RecorderID string

+ Requirement *semantics.Requirement

+ Sign func(pae []byte) ([]byte, error)

+ Sink EvidenceSink

+ Strict bool

+ TTL time.Duration

+ type EvidenceContainer string

+ const ContainerDSSEInToto

+ type EvidenceContext struct

+ AgentID string

+ At time.Time

+ Facts []AdmissionFact

+ Method string

+ OperationID string

+ Outcome EvidenceOutcome

+ Path string

+ Principal string

+ RecorderID string

+ Serial string

+ TraceID string

type EvidenceDecision

+ Record *semantics.DecisionRecord

+ RecordDigest string

+ func (d *EvidenceDecision) ApplyRecord(rec *semantics.DecisionRecord) error

+ type EvidenceFailure struct

+ Path string

+ Reason string

+ type EvidenceKind string

+ const KindAdmission

+ const KindDecision

+ const KindOutcome

+ func CheckEvidenceEnvelope(env semantics.Envelope) (EvidenceKind, error)

+ func VerifyEvidenceEnvelope(env semantics.Envelope, verify func(keyID string, pae, sig []byte) error) (EvidenceKind, error)

+ type EvidenceOutcome string

+ const EvidenceAdmitted

+ const EvidenceRefused

+ type EvidenceProfile struct

+ Admission bool

+ Container EvidenceContainer

+ Decision bool

+ Freshness time.Duration

+ Name string

+ Outcome bool

+ Requirement *semantics.Requirement

+ Sources bool

+ func LookupEvidenceProfile(name string) (EvidenceProfile, error)

+ func (p EvidenceProfile) Apply(cfg *EvidenceConfig) (*EvidenceConfig, error)

+ func (p EvidenceProfile) ID() (semantics.Digest, error)

+ func (p EvidenceProfile) Validate() error

type EvidenceQuery

+ Record *semantics.DecisionRecord

+ type EvidenceSink interface

+ Emit func(ctx EvidenceContext, rec semantics.DecisionRecord, env semantics.Envelope) (RecordRef, error)

+ EmitAdmission func(ctx EvidenceContext, rec AdmissionRecord, env semantics.Envelope) (RecordRef, error)

+ type EvidenceVerifyReport struct

+ Admission int

+ Decision int

+ Failures []EvidenceFailure

+ Outcome int

+ Total int

+ func VerifyEvidenceDir(dir string, verify func(keyID string, pae, sig []byte) error) (EvidenceVerifyReport, error)

type FileEvidenceExporter

+ EvidenceDir string

+ type FileSink struct

+ Dir string

+ RecorderID string

+ func (s *FileSink) Emit(ctx EvidenceContext, rec semantics.DecisionRecord, env semantics.Envelope) (RecordRef, error)

+ func (s *FileSink) EmitAdmission(ctx EvidenceContext, rec AdmissionRecord, env semantics.Envelope) (RecordRef, error)

+ func (s *FileSink) EmitOutcome(ctx EvidenceContext, rec OutcomeRecord, env semantics.Envelope) (RecordRef, error)

+ type GapCounter struct

+ func (g *GapCounter) Count() int64

+ func (g *GapCounter) Inc()

type OperationDecision

+ Grants []semantics.Grant

+ type OutcomeRecord struct

+ At time.Time

+ DecisionDigest string

+ Facts []AdmissionFact

+ Identity AdmissionIdentity

+ Note string

+ OperationID string

+ Outcome string

+ RecorderID string

+ StatusCode int

+ Ver string

+ func ParseOutcomeEnvelope(env semantics.Envelope) (OutcomeRecord, error)

+ func (r OutcomeRecord) Digest() (semantics.Digest, error)

+ type OutcomeSink interface

+ EmitOutcome func(ctx EvidenceContext, rec OutcomeRecord, env semantics.Envelope) (RecordRef, error)

type PipelineConfig

+ DecisionContext *semantics.DecisionContext

+ DischargeObligations bool

+ ObligationsUnderstood []string

+ RequireFreshDecisionContext bool

+ type ProblemDetails struct

+ Challenge *semantics.Challenge

+ Detail string

+ Instance string

+ Status int

+ Title string

+ Type string

+ type RecordRef struct

+ Digest string

+ Path string

+ Verdict string

+ func EmitDecisionRecords(cfg *EvidenceConfig, sinkCtx EvidenceContext, cert *x509.Certificate, aic *AIC, ...) ([]RecordRef, error)

+ func ReportOutcome(sink OutcomeSink, cfg *EvidenceConfig, ctx EvidenceContext, rec OutcomeRecord) (RecordRef, error)

+ type RecorderDescriptor struct

+ ID string

+ Kind string

+ Note string

+ func (r RecorderDescriptor) Digest() (semantics.Digest, error)

+ type SlogSink struct

+ Logger *slog.Logger

+ func (s SlogSink) Emit(ctx EvidenceContext, rec semantics.DecisionRecord, env semantics.Envelope) (RecordRef, error)

+ func (s SlogSink) EmitAdmission(ctx EvidenceContext, rec AdmissionRecord, env semantics.Envelope) (RecordRef, error)

+ func (s SlogSink) EmitOutcome(ctx EvidenceContext, rec OutcomeRecord, env semantics.Envelope) (RecordRef, error)

v0.1.0

Sep 12, 2026

Changes in this version

+ const CLCRevision

+ const ConstraintAuditRequiredKey

+ const ConstraintCIDRKey

+ const ConstraintConcurrentKey

+ const ConstraintGeoFenceKey

+ const ConstraintHardTimeoutKey

+ const ConstraintIdleTimeoutKey

+ const ConstraintReadOnlyKey

+ const ConstraintTimeWindowKey

+ const DefaultDAAgeMax

+ const DefaultMaskRune

+ const DefaultMaxBodyBytes

+ const DefaultMaxChainLength

+ const HardTimeoutMax

+ const HardTimeoutMin

+ const IdleTimeoutMax

+ const IdleTimeoutMin

+ const MaxConcurrentMax

+ const MaxConcurrentMin

+ const OCSPFallbackAllow

+ const OCSPFallbackCRL

+ const OCSPFallbackDeny

+ const OfflineLifetimeLimit

+ const RoleAdmin

+ const RoleAudit

+ const RoleDeploy

+ const RoleOps

+ const RolePrefix

+ const RoleRead

+ const RoleWild

+ const SupervisionDecisionApproved

+ const SupervisionDecisionDenied

+ const SupervisionDecisionPending

+ var AIAOID = asn1.ObjectIdentifier

+ var OCSPOID = asn1.ObjectIdentifier

+ var OIDSHA256 = pki.OIDSHA256

+ var OIDSHA384 = pki.OIDSHA384

+ var OIDSHA512 = pki.OIDSHA512

+ var OIDSigECDSAWithSHA256 = pki.OIDSigECDSAWithSHA256

+ var OIDSigECDSAWithSHA384 = pki.OIDSigECDSAWithSHA384

+ var OIDSigECDSAWithSHA512 = pki.OIDSigECDSAWithSHA512

+ var OIDSigEd25519 = pki.OIDSigEd25519

+ var OIDSigRSAPSSWithSHA256 = pki.OIDSigRSAPSSWithSHA256

+ var OIDSigRSAWithSHA256 = pki.OIDSigRSAWithSHA256

+ var OIDSigRSAWithSHA384 = pki.OIDSigRSAWithSHA384

+ var OIDSigRSAWithSHA512 = pki.OIDSigRSAWithSHA512

+ var SecureCipherSuites = []uint16

+ var Version = "0.1.0"

+ func AICFingerprint(cert *x509.Certificate) string

+ func ArchiveAuditFile(path string) error

+ func AuditDuration(start time.Time, entry *AuditEntry)

+ func AuthorizeCapabilities(caps []Capability, opID string, params map[string]any) (semantics.Decision, error)

+ func AuthorizeCapabilitiesWithConstraints(caps, constraints []Capability, opID string, params map[string]any) (semantics.Decision, error)

+ func AuthorizeGrants(grants []semantics.Grant, opID string, params map[string]any) (semantics.Decision, error)

+ func AuthorizeOperation(aic *AIC, pa *PrincipalAuthorization, opID string, params map[string]any) (semantics.Decision, error)

+ func BaseTLSConfig(cipherSuites []string, minTLSVersion string) *tls.Config

+ func BuildCipherSuites(names []string) []uint16

+ func CanonicalJSON(v any) ([]byte, error)

+ func CheckAuthorizationConstraints(constraints []Capability, clientIP string) error

+ func CheckAuthorizationConstraintsAt(constraints []Capability, clientIP, timeHHMM string) error

+ func CheckDAFreshness(ts time.Time, now time.Time, maxAge time.Duration) error

+ func CheckDelegatedAgentCert(cert *x509.Certificate) string

+ func CheckDelegatedAgentHeaders(cert *x509.Certificate, r *http.Request) string

+ func CheckRole(roles []string, allowed []string) bool

+ func ClientTLSConfig(caCertFile, certFile, keyFile string, cipherSuites []string, ...) (*tls.Config, error)

+ func ConstraintRecheckLoop(aicConstraints, paConstraints []Capability, clientIP string, ...)

+ func ConstraintStrings(constraints []Capability) []string

+ func DAHash(cert *x509.Certificate) string

+ func DAHashFromAIC(aic *AIC) string

+ func DecodeBase64(s string) ([]byte, error)

+ func DelegatedAgentServerIdentity(cert *x509.Certificate, principal string) (user string, expiry time.Time, reason string)

+ func EffectiveDelegationCapabilities(chain []*x509.Certificate, principalCaps []pki.Capability, maxChainLen int) ([]pki.Capability, error)

+ func EffectiveDelegationCapabilitiesFromAIC(chain []*x509.Certificate, topPrincipal *x509.Certificate, maxChainLen int) ([]pki.Capability, error)

+ func EncodeBase64(data []byte) string

+ func ExtractOCSPURL(cert *x509.Certificate) string

+ func ExtractPolicyRoles(cert *x509.Certificate) []string

+ func ExtractRoles(cert *x509.Certificate) []string

+ func ExtractSPIFFEIDFromCert(cert *x509.Certificate) string

+ func FetchOCSPResponseRaw(cert, issuer *x509.Certificate, ocspURL string) ([]byte, error)

+ func FilterAuditFile(file string, since time.Time, action string, cn, serial, mapping string) error

+ func FindStartOffsetByTime(file string, target time.Time) (int64, error)

+ func HasAIC(cert *x509.Certificate) bool

+ func HasDelegatedAgentOU(cert *x509.Certificate) bool

+ func HashLeaf(data []byte) []byte

+ func HashNode(left, right []byte) []byte

+ func IsAdminOU(ou string) bool

+ func LoadCA(caCertFile string) (*x509.CertPool, error)

+ func LoadCACert(caCertFile string) (*x509.Certificate, error)

+ func LoadCAFromFile(path string) (*x509.CertPool, error)

+ func LoadCert(certFile, keyFile string) (*tls.Certificate, error)

+ func LoadGatewayPolicy(policyPath, sigSuffix string, opts *PolicyVerifyOptions, require bool) error

+ func LogAdmission(result AdmissionResult, clientIP string, logger *slog.Logger)

+ func LogPluginDecision(logger *AuditLogger, entry PluginAuditEntry)

+ func MTLSServerConfig(caCertFile string, cert *tls.Certificate, cipherSuites []string, ...) (*tls.Config, error)

+ func MarshalTSARequest(req TimeStampReq) ([]byte, error)

+ func MaskCertSerial(serial string) string

+ func MaskEmail(email string) string

+ func MaskFilePath(path string) string

+ func MaskString(s string, visible int) string

+ func MaskToken(token string) string

+ func MatchCapability(id, pattern string) bool

+ func MatchCapabilityPriority(id, pattern string) int

+ func MatchCapabilityRules(id string, rules []pki.CapabilityRule) pki.CapabilityRuleMatch

+ func NeedRevoke(cert *x509.Certificate) bool

+ func NewReplayNonceStore(ttl time.Duration, max int) *memReplayStore

+ func NormalizeSerial(serial *big.Int) string

+ func OfflineLifetimeFor(ocspFallback string) time.Duration

+ func ParseCertPEM(data []byte) (*x509.Certificate, error)

+ func ParseCertPEMFile(path string) (*x509.Certificate, error)

+ func ParsePrivateKeyPEM(data []byte) (crypto.Signer, error)

+ func ParsePrivateKeyPEMFile(path string) (crypto.Signer, error)

+ func PeerCertRoles(r *http.Request) []string

+ func RegisterConstraint(ev ConstraintEvaluator) error

+ func RegisterGeoResolver(name string, fn GeoResolver)

+ func RegisterParameterValidator(v ParameterValidator) error

+ func RegisterPlugin(p CapabilityPlugin) error

+ func ReplaceConstraint(ev ConstraintEvaluator) error

+ func RequireRoles(r *http.Request, allowedRoles []string) bool

+ func ResetConstraints()

+ func ResetParameterValidators()

+ func ResetPlugins()

+ func SanitizeString(s string) string

+ func ServerTLSConfig(cert *tls.Certificate, cipherSuites []string, minTLSVersion string) *tls.Config

+ func SetAuthorizationPolicy(p *AuthorizationPolicy)

+ func SetGlobalCapabilityRegistry(cr CapabilityRegistry)

+ func SetIdentityHeaderMode(r *http.Request, mode IdentityHeaderMode)

+ func SignPolicy(policyData []byte, cert *x509.Certificate, signer crypto.Signer) ([]byte, error)

+ func SignerHasAdminOU(cert *x509.Certificate) bool

+ func StartOCSPStapling(tlsCert *tls.Certificate, cfg *tls.Config, caCertFile string, ...)

+ func SynthesizeCertFromJWT(outer *aicjwt.OuterClaims) (*x509.Certificate, error)

+ func TLSVersionFromString(s string) uint16

+ func ToGrant(c Capability) (semantics.Grant, error)

+ func ToGrantSet(caps []Capability) ([]semantics.Grant, error)

+ func ValidateAIC(aic *AIC) error

+ func VerifyAuditEntry(data []byte, tsaClient *TSAClient) error

+ func VerifyBundle(bundle *CredentialBundle, roots *x509.CertPool) error

+ func VerifyDelegationAuth(aic *AIC, userCert *x509.Certificate) error

+ func VerifyDelegationChain(chain []*x509.Certificate, topPrincipal *x509.Certificate, maxDepth int) error

+ func VerifyDelegationChainWithCaps(chain []*x509.Certificate, topPrincipal *x509.Certificate, ...) ([]pki.Capability, error)

+ func VerifyLayer2(chain []*x509.Certificate, cfg *PipelineConfig, roles []string) (AdmissionResult, *Layer2Result)

+ func VerifyPrincipalKeyHash(agent, principal *x509.Certificate) error

+ func VerifyProof(leaf []byte, proof []ProofStep, root []byte) bool

+ func VerifyProofBounded(leaf []byte, proof []ProofStep, root []byte, maxProofLen int) bool

+ func VerifySPIFFESAN(cert *x509.Certificate, expectedID string) bool

+ func VerifySignedPolicy(sigDER, policyData []byte, roots *x509.CertPool, requireAdminOU bool) (*x509.Certificate, error)

+ type AIC = pki.AIC

+ func ParseAIC(cert *x509.Certificate) (*AIC, error)

+ type AdmissionConfig struct

+ AuditLogger *AuditLogger

+ CheckDAAge bool

+ ClientIP string

+ CredentialBundle *CredentialBundle

+ DAAgeMax time.Duration

+ DisallowRepresentative bool

+ EnforceCapSizeConstraints bool

+ EnforceConstraints bool

+ EnforceSize32 bool

+ NonceCache *NonceCache

+ Operations []Operation

+ RejectOverflow bool

+ RequireAIC bool

+ RequireUserAuth bool

+ RequireUserPermission bool

+ RequiredCapabilities []string

+ RequiredProtocol string

+ RequiredRuleId string

+ StrictConstraints bool

+ UnresolvedEvaluator func(op Operation, unresolved []string) bool

+ UserCert *x509.Certificate

+ UserCertResolver func(keyHash []byte) (*x509.Certificate, error)

+ func (c AdmissionConfig) Validate() error

+ type AdmissionResult struct

+ AIC *AIC

+ Decision DecisionResult

+ EffectiveCaps []Capability

+ OperationDecisions []OperationDecision

+ PrincipalAuthorization *PrincipalAuthorization

+ PrincipalUid string

+ Reason string

+ func CheckAdmission(cert *x509.Certificate, cfg AdmissionConfig) AdmissionResult

+ type AlgorithmIdentifier = pki.AlgorithmIdentifier

+ type ApprovalRequester interface

+ Request func(ctx context.Context, risk RiskAssessment) (*SupervisionResult, error)

+ type AuditAction string

+ const ActionCompleted

+ const ActionConnected

+ const ActionDenied

+ const ActionDisconnected

+ const ActionNoRoute

+ const ActionPluginDecision

+ const ActionProxied

+ const ActionRevoked

+ const ActionUnknownConstraint

+ const ActionWSClose

+ const ActionWSConnect

+ type AuditChain struct

+ func NewAuditChain(batchSize int, onSeal func(root []byte)) *AuditChain

+ func (c *AuditChain) BatchCount() int

+ func (c *AuditChain) Dump() string

+ func (c *AuditChain) GetTree(batchNumber int) *SealedTree

+ func (c *AuditChain) LatestRoot() string

+ func (c *AuditChain) LatestRootBytes() []byte

+ func (c *AuditChain) Seal(entries [][]byte, previousRoot string) *SealedTree

+ func (c *AuditChain) SealChecked(entries [][]byte, previousRoot string) (*SealedTree, error)

+ func (c *AuditChain) Verify(batchNumber int, leaf []byte, proof []ProofStep) (bool, error)

+ func (c *AuditChain) VerifyContinuity() error

+ func (c *AuditChain) VerifyJSON(req *VerifyRequest) *VerifyResponse

+ type AuditEntry struct

+ AICFingerprint string

+ Action string

+ AgentId string

+ BytesIn int64

+ BytesOut int64

+ Capabilities []string

+ ClientCN string

+ ClientSerial string

+ DaHash string

+ Decision string

+ DelegationMode int

+ DenyReason string

+ Duration string

+ GatewayId string

+ Level string

+ Mapping string

+ PolicyVersion uint64

+ PrincipalUid string

+ Protocol string

+ Roles []string

+ SPIFFEID string

+ SessionId string

+ SrcIP string

+ Target string

+ TargetID string

+ Time string

+ TraceId string

+ func NewAuditEntryDenied(srcIP, mappingName, target, reason string, cert *x509.Certificate) AuditEntry

+ func NewAuditEntryFromConn(srcIP, mappingName, target string, cert *x509.Certificate) AuditEntry

+ func ReadAuditEntries(file string, filter AuditFilter) ([]AuditEntry, error)

+ func (e *AuditEntry) SetV12Fields(protocol, gatewayId, traceId, sessionId, decision string)

+ func (e *AuditEntry) WithEvidenceFingerprints(cert *x509.Certificate) *AuditEntry

+ type AuditFilter struct

+ Action string

+ ClientCN string

+ Limit int

+ Mapping string

+ Offset int

+ Serial string

+ Since time.Time

+ Sort string

+ Until time.Time

+ type AuditLogger struct

+ func NewAuditLogger(file string, tsa *TSAClient, maxSize int64, maxBak int) (*AuditLogger, error)

+ func (l *AuditLogger) Close() error

+ func (l *AuditLogger) Dropped() int64

+ func (l *AuditLogger) File() string

+ func (l *AuditLogger) Log(entry AuditEntry)

+ type AuditVerifier struct

+ type AuthContext struct

+ AIC *AIC

+ AgentID string

+ Bearer bool

+ Capabilities []string

+ ClientCert *x509.Certificate

+ OperationDecisions []OperationDecision

+ Principal string

+ Reason string

+ Roles []string

+ SPIFFEID string

+ Serial string

+ Unresolved []string

+ Verdict string

+ func AuthContextFromHeaders(r *http.Request) *AuthContext

+ func FromContext(ctx context.Context) *AuthContext

+ type AuthError struct

+ Code ErrorCode

+ Message string

+ Status int

+ func (e *AuthError) Error() string

+ type AuthMode int

+ const BearerOnly

+ const MTLSOnly

+ const MTLSOrBearer

+ type AuthorizationPolicy struct

+ CapabilityParameters map[string]map[string]any

+ GatewayNamespaces map[string]PolicyNamespace

+ OUMapping map[string]string

+ Roles map[string]PolicyRole

+ Version string

+ func GetAuthorizationPolicy() *AuthorizationPolicy

+ func LoadAuthorizationPolicy(policyPath, sigSuffix string, opts *PolicyVerifyOptions) (*AuthorizationPolicy, error)

+ func ParseAuthorizationPolicy(data []byte) (*AuthorizationPolicy, error)

+ func (p *AuthorizationPolicy) HasGrant(role, capability string) bool

+ func (p *AuthorizationPolicy) HasParamDefault(scheme, capID, param string) (any, bool)

+ func (p *AuthorizationPolicy) IntersectGrants(roles []string, aicCapIds []string) []string

+ func (p *AuthorizationPolicy) ParamDefaults(scheme, capID string) map[string]any

+ func (p *AuthorizationPolicy) RoleByOU(ou string) string

+ func (p *AuthorizationPolicy) RoleGrants(role string) []string

+ type CRLCache struct

+ func NewCRLCache(caCert *x509.Certificate, url string, refreshSec int, translator Translator, ...) *CRLCache

+ func (c *CRLCache) ForceRefresh() error

+ func (c *CRLCache) IsRevoked(caDN string, serial *big.Int) (bool, error)

+ func (c *CRLCache) IsRevokedCert(cert *x509.Certificate) (bool, error)

+ func (c *CRLCache) LastRefresh() time.Time

+ func (c *CRLCache) Start(stop <-chan struct{})

+ func (c *CRLCache) Stats() (int, time.Time, time.Time)

+ type CRLRevokedFunc func(caDN string, serial *big.Int) (bool, error)

+ type Capability = pki.Capability

+ type CapabilityPlugin = pki.CapabilityPlugin

+ type CapabilityRegistry interface

+ Enabled func() bool

+ ValidateCapability func(formatted string) error

+ func GetGlobalCapabilityRegistry() CapabilityRegistry

+ type Config struct

+ ApprovalRequester ApprovalRequester

+ AuditLogFile string

+ AuditLogger *AuditLogger

+ AuditTSAURL string

+ AuthMode AuthMode

+ BackendRootCA string

+ CACertFile string

+ CRLCache *CRLCache

+ CapabilityRegistry CapabilityRegistry

+ DisallowRepresentative bool

+ EnforceConstraints bool

+ EvidenceExporter EvidenceExporter

+ Hooks *Hooks

+ IdentityMode IdentityHeaderMode

+ JWTAudience []string

+ JWTCAFile string

+ JWTIssuer string

+ LogFile string

+ Logger *slog.Logger

+ NonceCache *NonceCache

+ OCSPCache *OCSPCache

+ OverrideRecorder OverrideRecorder

+ PluginRegistry *PluginRegistry

+ ReplayProtection *bool

+ RequireAIC bool

+ RequireApproval func(ctx *AuthContext, r *http.Request) bool

+ RequireUserAuth bool

+ RequiredCapabilities []string

+ RequiredOperations []Operation

+ ServerOptions *ServerOptions

+ StreamBody bool

+ SupervisionLogFile string

+ SupervisionPolicy SupervisionPolicy

+ SupervisionStore *SupervisionStore

+ TLSCertFile string

+ TLSKeyFile string

+ UnresolvedEvaluator func(op Operation, unresolved []string) bool

+ UserCert *x509.Certificate

+ UserCertResolver func(keyHash []byte) (*x509.Certificate, error)

+ func LoadConfigFile(path string) (*Config, error)

+ func ParseConfig(data []byte) (*Config, error)

+ func (c *Config) AuthMiddleware(next http.Handler) http.Handler

+ func (c *Config) CloseLogger() error

+ func (c *Config) Handler(next http.Handler) (http.Handler, error)

+ type ConstraintContext struct

+ ClientIP string

+ Now time.Time

+ type ConstraintEvaluator interface

+ CapabilityId func() string

+ Evaluate func(cap *Capability, ctx *ConstraintContext) error

+ type ConstraintRegistry struct

+ func NewConstraintRegistry() *ConstraintRegistry

+ func (r *ConstraintRegistry) Find(capabilityId string) (ConstraintEvaluator, error)

+ func (r *ConstraintRegistry) Keys() []string

+ func (r *ConstraintRegistry) Len() int

+ func (r *ConstraintRegistry) Register(ev ConstraintEvaluator) error

+ func (r *ConstraintRegistry) Remove(capabilityId string)

+ func (r *ConstraintRegistry) Replace(ev ConstraintEvaluator) error

+ func (r *ConstraintRegistry) Reset()

+ type ContentInfo struct

+ Content asn1.RawValue

+ ContentType asn1.ObjectIdentifier

+ type CredentialBundle struct

+ AgentChain []*x509.Certificate

+ CACerts []*x509.Certificate

+ PrincipalChain []*x509.Certificate

+ func NewCredentialBundle(agentChain, principalChain, caCerts []*x509.Certificate) (*CredentialBundle, error)

+ func ParseCredentialBundlePEM(data []byte) (*CredentialBundle, error)

+ func (b *CredentialBundle) Agent() *x509.Certificate

+ func (b *CredentialBundle) Principal() *x509.Certificate

+ type DecisionResult int

+ const DecisionAllow

+ const DecisionDeny

+ const DecisionNeedAuth

+ type DelegationAuthTBS = pki.DelegationAuthTBS

+ type DelegationAuthorization = pki.DelegationAuthorization

+ type DelegationChainVerifier struct

+ MaxChainLength int

+ MaxDepth int

+ func (v *DelegationChainVerifier) Verify(chain []*x509.Certificate, topPrincipal *x509.Certificate) error

+ type DelegationMode = pki.DelegationMode

+ const DelegationAuthorized

+ const DelegationRepresentative

+ type DelegationPolicy = pki.DelegationPolicy

+ type ErrorCode int

+ const ErrBearerNeedsTLS

+ const ErrChainInvalid

+ const ErrConfig

+ const ErrDenied

+ const ErrInvalidBearer

+ const ErrNoCredential

+ const ErrNoVerifier

+ func (c ErrorCode) String() string

+ type EvidenceAuditChain struct

+ Anchor string

+ Entries []EvidenceAuditEntry

+ MerkleRoot string

+ TSA string

+ type EvidenceAuditEntry struct

+ Action string

+ Actor string

+ EntryHash string

+ PrevHash string

+ Seq int64

+ Ts string

+ type EvidenceAuthorization struct

+ Capabilities []EvidenceCapability

+ Ceiling string

+ Constraints string

+ DelegationMode string

+ ExpiresAt string

+ GrantRef *EvidenceGrantRef

+ Principal string

+ ValidFrom string

+ type EvidenceBundle struct

+ AuditChain EvidenceAuditChain

+ Authorization EvidenceAuthorization

+ Decision EvidenceDecision

+ Manifest EvidenceManifest

+ Operation EvidenceOperation

+ Signatures map[string]json.RawMessage

+ Subject EvidenceSubject

+ Supervision []EvidenceSupervisionEvent

+ func (b *EvidenceBundle) JSON() ([]byte, error)

+ type EvidenceCapability struct

+ CapabilityID string

+ Parameters string

+ Scheme string

+ type EvidenceDecision struct

+ Decision string

+ EvaluatedCapabilities []string

+ MatchedPolicy string

+ PdpContext string

+ ReasonCodes []string

+ type EvidenceExporter interface

+ Export func(ctx context.Context, q EvidenceQuery) (*EvidenceBundle, error)

+ type EvidenceGrantRef struct

+ Digest string

+ Ref string

+ type EvidenceManifest struct

+ BundleID string

+ ExportedAt time.Time

+ Generator string

+ HashAlg string

+ PolicyRef string

+ Schema string

+ Version string

+ type EvidenceOperation struct

+ Action string

+ FinishedAt string

+ OperationID string

+ Outcome string

+ RequestedParams Summary

+ Resource string

+ StartedAt string

+ type EvidenceQuery struct

+ AgentID string

+ DaHash string

+ IncludeSupervision bool

+ OperationID string

+ TimeRange *TimeRange

+ type EvidenceSubject struct

+ AgentID string

+ KeyBinding string

+ PresentedCredentialRef string

+ TransportIdentity string

+ type EvidenceSupervisionEvent struct

+ Actor string

+ DecisionRef string

+ EvidenceRef string

+ OccurredAt string

+ Type string

+ type ExtField = pki.ExtField

+ type ExternalPolicyRef = pki.ExternalPolicyRef

+ type FileEvidenceExporter struct

+ AuditFile string

+ Generator string

+ Now func() time.Time

+ SupervisionFile string

+ func NewFileEvidenceExporter(auditFile, supervisionFile string) *FileEvidenceExporter

+ func (e *FileEvidenceExporter) Export(ctx context.Context, q EvidenceQuery) (*EvidenceBundle, error)

+ type GeoResolver func(ip string) (string, error)

+ type HTTPFacts = pki.HTTPFacts

+ type Hooks struct

+ Authenticated func(ctx *AuthContext, r *http.Request) error

+ Denied func(r *http.Request, err *AuthError)

+ Forwarded func(r *http.Request, resp *http.Response)

+ type IdentityHeaderMode int

+ const IdentityAIC

+ const IdentityForwardClientCert

+ const IdentityMinimal

+ const IdentityXForwarded

+ type JWTVerifier struct

+ func LoadJWTVerifier(caFiles ...string) (*JWTVerifier, error)

+ func NewJWTVerifier(cas []*x509.Certificate) *JWTVerifier

+ func (v *JWTVerifier) SetBearerPolicy(expectedIssuer string, expectedAudience []string, nonces aicjwt.NonceStore)

+ func (v *JWTVerifier) VerifyBearer(token string, now time.Time, opts ...JWTVerifyOptions) (*x509.Certificate, *aicjwt.OuterClaims, error)

+ type JWTVerifyOptions struct

+ ExpectedAudience []string

+ ExpectedIssuer string

+ NonceStore aicjwt.NonceStore

+ PresenterKey crypto.PublicKey

+ RequireJtiNonceMatch bool

+ StatusChecker aicjwt.StatusChecker

+ type Layer1Result struct

+ Reason string

+ Roles []string

+ Verified bool

+ func VerifyLayer1(chain []*x509.Certificate, cfg *PipelineConfig) *Layer1Result

+ type Layer2Result struct

+ AIC *AIC

+ PrincipalAuthorization *PrincipalAuthorization

+ PrincipalUid string

+ Reason string

+ Verified bool

+ type Layer3Result struct

+ Reason string

+ Verified bool

+ func VerifyLayer3(chain []*x509.Certificate, cfg *PipelineConfig) *Layer3Result

+ type MerkleTree struct

+ func NewMerkleTree(leaves [][]byte) *MerkleTree

+ func (m *MerkleTree) Proof(leafIndex int) ([]ProofStep, error)

+ func (m *MerkleTree) Root() []byte

+ func (m *MerkleTree) RootHex() string

+ type MessageImprint struct

+ HashAlgorithm AlgorithmIdentifier

+ HashedMessage []byte

+ type NonceCache struct

+ func NewNonceCache() *NonceCache

+ func (nc *NonceCache) CheckAndAdd(scope string, nonce []byte) bool

+ func (nc *NonceCache) Len() int

+ func (nc *NonceCache) Stop()

+ type OCSPCache struct

+ func NewOCSPCache(ttl time.Duration, fallback string, translator Translator, lang string) *OCSPCache

+ func (c *OCSPCache) Check(cert, issuer *x509.Certificate) error

+ func (c *OCSPCache) Flush()

+ func (c *OCSPCache) SetCRLChecker(fn CRLRevokedFunc)

+ func (c *OCSPCache) Stats() (int, int)

+ type OfflineRBAC struct

+ func NewOfflineRBAC(roles []string) *OfflineRBAC

+ func NewOfflineRBACFromCert(cert *x509.Certificate) *OfflineRBAC

+ func (r *OfflineRBAC) CheckRole(allowed []string) bool

+ type Operation = semantics.Operation

+ type OperationDecision struct

+ ID string

+ Params map[string]any

+ Reason string

+ Released bool

+ Unresolved []string

+ Verdict string

+ type OverrideRecorder interface

+ Record func(ctx context.Context, risk RiskAssessment, actor, reason string) (*SupervisionResult, error)

+ type PKIStatusInfo struct

+ Status int

+ type ParameterValidator interface

+ Scheme func() string

+ Validate func(granted, declared Capability) error

+ var MaxRowsValidator ParameterValidator = maxRowsValidator{}

+ type ParameterValidatorRegistry struct

+ func BuiltinParameterValidators() *ParameterValidatorRegistry

+ func NewParameterValidatorRegistry() *ParameterValidatorRegistry

+ func (r *ParameterValidatorRegistry) Find(schemeID string) (ParameterValidator, error)

+ func (r *ParameterValidatorRegistry) Keys() []string

+ func (r *ParameterValidatorRegistry) Len() int

+ func (r *ParameterValidatorRegistry) Register(v ParameterValidator) error

+ func (r *ParameterValidatorRegistry) Reset()

+ func (r *ParameterValidatorRegistry) ValidateCapability(granted, declared Capability) error

+ type PermissionDef = pki.PermissionDef

+ type PermissionLevel = pki.PermissionLevel

+ const PermissionAuto

+ const PermissionRequiresApproval

+ type PipelineCheck int

+ const CheckFullChain

+ const CheckLeafOnly

+ type PipelineConfig struct

+ AllowRoles []string

+ AllowedSPIFFEIDs []string

+ AuditLogger *AuditLogger

+ CRLCache *CRLCache

+ CapabilityPluginRegistry *PluginRegistry

+ CapabilityPluginResolver func(agentID string) (version uint64, reg *PluginRegistry)

+ CapabilityRegistry CapabilityRegistry

+ CheckScope PipelineCheck

+ ClientIP string

+ CredentialBundle *CredentialBundle

+ DisallowRepresentative bool

+ EnforceCapSizeConstraints bool

+ EnforceConstraints bool

+ EnforceSize32 bool

+ HTTPFacts *HTTPFacts

+ MaxConnsPerCert int

+ NonceCache *NonceCache

+ OCSPCache *OCSPCache

+ OfflineMaxCertLifetime time.Duration

+ Operations []Operation

+ ParameterValidators *ParameterValidatorRegistry

+ PolicyServer PolicyServer

+ PolicyVersion uint64

+ RejectOverflow bool

+ RequireAIC bool

+ RequireSPIFFE bool

+ RequireUserAuth bool

+ RequireUserPermission bool

+ RequiredCapabilities []string

+ RequiredProtocol string

+ RequiredRuleId string

+ RiskMonitor *RiskMonitor

+ SPIFFETrustDomain string

+ StrictConstraints bool

+ UnresolvedEvaluator func(op Operation, unresolved []string) bool

+ UserCert *x509.Certificate

+ UserCertResolver func(keyHash []byte) (*x509.Certificate, error)

+ type PipelineResult struct

+ AIC *AIC

+ AgentId string

+ CLCReason string

+ CLCUnresolved []string

+ CLCVerdict string

+ DenyReason string

+ Granted bool

+ OperationDecisions []OperationDecision

+ Principal string

+ PrincipalAuthorization *PrincipalAuthorization

+ Roles []string

+ SPIFFEID string

+ Serial string

+ func RunAccessPipeline(chain []*x509.Certificate, cfg *PipelineConfig) *PipelineResult

+ func VerifyTrustLayers(chain []*x509.Certificate, cfg *PipelineConfig) *PipelineResult

+ type PluginAuditEntry struct

+ CapabilityID string

+ ClientCN string

+ DaHash string

+ Decision string

+ Level string

+ PolicyVersion uint64

+ Principal string

+ Reason string

+ Scheme string

+ type PluginContext = pki.PluginContext

+ type PluginDecision = pki.PluginDecision

+ const PluginAllow

+ const PluginBypass

+ const PluginDeny

+ type PluginRegistry = pki.PluginRegistry

+ func NewPluginRegistry() *PluginRegistry

+ type PluginResult = pki.PluginResult

+ func CheckOperationCapability(reg *PluginRegistry, cap *Capability, ctx *PluginContext) (*PluginResult, error)

+ func ExecutePlugin(schemeID string, cap *pki.Capability, ctx *PluginContext) (*PluginResult, error)

+ type PolicyNamespace struct

+ DisplayName string

+ Grants []string

+ Prefix string

+ type PolicyRole struct

+ DisplayName string

+ Grants []string

+ Profiles []string

+ Scope []string

+ type PolicyServer interface

+ CheckOnline func(leaf *x509.Certificate, aic *AIC) error

+ Name func() string

+ type PolicySigningConfig struct

+ CAFile string

+ Enabled bool

+ Require bool

+ RequireAdminOU *bool

+ SigSuffix string

+ func (ps *PolicySigningConfig) BuildPolicyVerifyOptions(tlsClientCA string) (*PolicyVerifyOptions, error)

+ type PolicySigningIdentity struct

+ Cert *x509.Certificate

+ Key crypto.Signer

+ func LoadPolicySigningIdentity(certPEM, keyPEM string) (*PolicySigningIdentity, error)

+ type PolicyVerifyOptions struct

+ RequireAdminOU bool

+ Roots *x509.CertPool

+ type PrincipalAuthorization = pki.PrincipalAuthorization

+ func ParseUserPermissionExtension(cert *x509.Certificate) (*PrincipalAuthorization, error)

+ type PrincipalUid = pki.PrincipalUid

+ func MakePrincipalUidFromCert(realm, identifier string, certDER []byte) PrincipalUid

+ func ParsePrincipalUid(s string) (PrincipalUid, error)

+ type ProofStep struct

+ Left bool

+ Sibling []byte

+ type ProofStepJSON struct

+ Left bool

+ Sibling string

+ type Reason = pki.Reason

+ type ResourceScope = pki.ResourceScope

+ type RiskAssessment struct

+ AgentID string

+ Capabilities []string

+ DAHash string

+ Operation string

+ OperationID string

+ PolicyVersion uint64

+ PrincipalUid string

+ RequestedParams Summary

+ Semantic *SemanticVerdict

+ Violations []string

+ type RiskMonitor struct

+ func NewRiskMonitor(cfg RiskMonitorConfig) *RiskMonitor

+ func (m *RiskMonitor) RecordViolation(v RiskViolation) bool

+ func (m *RiskMonitor) Rules() []RiskRule

+ func (m *RiskMonitor) SetRules(rules []RiskRule)

+ func (m *RiskMonitor) Violations(agentId string) int

+ type RiskMonitorConfig struct

+ Logger *slog.Logger

+ OnAction func(agentId, action, reason string)

+ Rules []RiskRule

+ type RiskRule struct

+ Action string

+ Name string

+ Reason string

+ Signals []string

+ Threshold int

+ WindowSeconds int

+ type RiskViolation struct

+ AgentId string

+ At int64

+ CapabilityId string

+ Details string

+ Signal string

+ type RoleDef = pki.RoleDef

+ type RotatingFile struct

+ func NewRotatingFile(path string, maxSize int64, maxBak int) (*RotatingFile, error)

+ func (r *RotatingFile) Close() error

+ func (r *RotatingFile) Write(p []byte) (int, error)

+ type Route struct

+ AllowMethods []string

+ Path string

+ RequiredCapabilities []string

+ Target *url.URL

+ type SPIFFEID struct

+ Path string

+ TrustDomain string

+ func ExtractSPIFFEID(cert *x509.Certificate) *SPIFFEID

+ func ParseSPIFFEID(id string) (*SPIFFEID, error)

+ func (s *SPIFFEID) Equal(other *SPIFFEID) bool

+ func (s *SPIFFEID) String() string

+ type SealedTree struct

+ BatchNumber int

+ Previous string

+ Root string

+ Size int

+ Timestamp string

+ type SemanticVerdict struct

+ Confidence float64

+ Decision string

+ Err string

+ Failed bool

+ InputDigest string

+ Model string

+ OutputJSON []byte

+ PromptHash string

+ Version string

+ type Server struct

+ func NewServer(c *Config, routes []Route) (*Server, error)

+ func (s *Server) Close(ctx context.Context) error

+ func (s *Server) Handler() http.Handler

+ func (s *Server) ListenAndServe(addr string) error

+ type ServerOptions struct

+ IdleTimeout time.Duration

+ MaxHeaderBytes int

+ ReadHeaderTimeout time.Duration

+ ReadTimeout time.Duration

+ WriteTimeout time.Duration

+ type SignedAuditEntry struct

+ Entry AuditEntry

+ TST string

+ type SignedSupervisionEvent struct

+ Event pki.SupervisionEvent

+ TST string

+ type Summary string

+ func NewSummaryFromBody(body []byte) Summary

+ type SupervisionPolicy struct

+ AllowBreakGlass bool

+ RequireEvidenceExport bool

+ RequireRuntimeApproval bool

+ type SupervisionQuery struct

+ AgentID string

+ DaHash string

+ Limit int

+ OperationID string

+ TimeRange *TimeRange

+ Type pki.SupervisionEventType

+ type SupervisionResult struct

+ Approver string

+ DecidedAt time.Time

+ Decision string

+ EvidenceRef string

+ Reason string

+ func (r *SupervisionResult) Approved() bool

+ type SupervisionStore struct

+ func NewSupervisionStore(file string, tsa *TSAClient, maxSize int64, maxBak int) (*SupervisionStore, error)

+ func (s *SupervisionStore) Close() error

+ func (s *SupervisionStore) File() string

+ func (s *SupervisionStore) Query(filter SupervisionQuery) ([]pki.SupervisionEvent, error)

+ func (s *SupervisionStore) Record(ev *pki.SupervisionEvent) error

+ type TSAClient struct

+ CACert *x509.Certificate

+ HTTPClient *http.Client

+ SignFunc func(data []byte) ([]byte, error)

+ URL string

+ func NewTSAClient(url string) *TSAClient

+ func (t *TSAClient) SetCACert(certFile string) error

+ func (t *TSAClient) SetMaxTSTAge(d time.Duration)

+ func (t *TSAClient) Sign(data []byte) (tstDER []byte, err error)

+ func (t *TSAClient) Verify(entryJSON, tstDER []byte) error

+ type TSTInfo struct

+ Accuracy asn1.RawValue

+ GenTime time.Time

+ MessageImprint MessageImprint

+ Nonce *int

+ Ordering bool

+ Policy asn1.ObjectIdentifier

+ SerialNumber int

+ TSA asn1.RawValue

+ Version int

+ func UnmarshalTimestampToken(data []byte) (*TSTInfo, error)

+ type TimeRange struct

+ End time.Time

+ Start time.Time

+ type TimeStampReq struct

+ CertReq bool

+ Extensions []asn1.RawValue

+ MessageImprint MessageImprint

+ Nonce *int

+ ReqPolicy asn1.ObjectIdentifier

+ Version int

+ type TimeStampResp struct

+ Status PKIStatusInfo

+ TimeStampToken asn1.RawValue

+ type Translator interface

+ T func(lang, key string, args ...any) string

+ type TrustLayer int

+ const Layer1Identity

+ const Layer2Representation

+ const Layer3OnlineAuthorization

+ func (l TrustLayer) String() string

+ type UserPermission = pki.UserPermission

+ type VerifyRequest struct

+ Batch int

+ Leaf string

+ Proof []ProofStepJSON

+ type VerifyResponse struct

+ Error string

+ Valid bool

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL