identity

Documentation

Overview

Package identity owns who this device is: the keypair, the device id, and per-module credential scoping. The Provider is the seam hardware backing (Secure Enclave, TPM) slots into; v1 is a software Ed25519 key persisted in the encrypted store. Identity is local: nothing outside the machine assigns it.

Index

• Variables
• type Provider
  • func (p *Provider) Credential(_ context.Context, module string, scopes []string) (string, int64, []string, error)
  • func (p *Provider) Disable(err error)
  • func (p *Provider) Enrolled() bool
  • func (p *Provider) Init() error
  • func (p *Provider) Unavailable() error
  • func (p *Provider) WhoAmI(_ context.Context) (string, bool, string)

Variables

var ErrCredentialsUnsupported = errors.New("identity: scoped credentials are not yet implemented")

ErrCredentialsUnsupported is Credential's answer: core issues no scoped credentials.

Types

type Provider

type Provider struct {
	Log *slog.Logger
	// Store persists the keypair and any recorded device id, encrypted.
	Store hostserv.StoreBackend
	// contains filtered or unexported fields
}

Provider is the identity seam. Software today; hardware-backed implementations replace the key handling.

func (*Provider) Credential

func (p *Provider) Credential(
	_ context.Context,
	module string,
	scopes []string,
) (string, int64, []string, error)

Credential implements hostserv.IdentityBackend. It fails closed: until there are real, verifiable, issuer-signed token semantics (with core deciding the granted subset, never echoing the request), minting a forgeable token that merely looks scoped and expiring is worse than none — it invites something downstream to trust it. Returning an error keeps that contract honest.

func (*Provider) Disable

func (p *Provider) Disable(err error)

Disable marks the identity unavailable for err: core could not load it, and serves no identity rather than inventing one that would overwrite the real one once the store is back.

func (*Provider) Enrolled

func (p *Provider) Enrolled() bool

Enrolled reports, for the control surface, whether the device has its persistent id (true once Init has run).

func (*Provider) Init

func (p *Provider) Init() error

Init loads or creates the keypair and the device id. Call once at startup.

func (*Provider) Unavailable

func (p *Provider) Unavailable() error

Unavailable returns why there is no identity, or nil when there is one.

func (*Provider) WhoAmI

func (p *Provider) WhoAmI(_ context.Context) (string, bool, string)

WhoAmI implements hostserv.IdentityBackend. The id is persistent once Init has run; ephemeral is reported only for a provider that was never initialised, which core never runs.