Versions in this module Expand all Collapse all v0 v0.4.0 Nov 7, 2026 Changes in this version + const MaxTokenBytes + var AllowedAlgorithms = []jose.SignatureAlgorithm + var ErrBadTenant = errors.New(...) + var ErrBadUID = errors.New(...) + var ErrClaimMismatch = errors.New("grant: registered claims disagree with the grant claim") + var ErrEmptyGrant = errors.New("grant: grant_uid is empty") + var ErrJWKSStale = errors.New("grant: key set older than the lease TTL") + var ErrKeyMismatchAlg = errors.New("grant: key algorithm does not match token") + var ErrKeyRingExists = errors.New("grant: a key ring is already stored") + var ErrLeaseTooLong = errors.New("grant: lease longer than this home accepts") + var ErrMissingGrant = errors.New("grant: token carries no grant claim") + var ErrNeverLoaded = errors.New("grant: key set never loaded") + var ErrNoKID = errors.New("grant: token has no kid header") + var ErrNoKeyRing = errors.New("grant: no key ring is stored") + var ErrTokenTooLarge = fmt.Errorf("grant: token exceeds %d bytes", MaxTokenBytes) + var ErrUnknownKey = errors.New("grant: no key for kid") + var ErrWrongAudience = core.ErrWrongAudience + var ErrWrongIssuer = errors.New("grant: issuer mismatch") + func Deadline(ts *timestamppb.Timestamp, now time.Time) (time.Duration, bool) + func FromProto(p *grantv1.CapacityGrant) core.Grant + func GenerateKey(alg jose.SignatureAlgorithm) (*jose.JSONWebKey, error) + func LoadKey(path string) (*jose.JSONWebKey, error) + func PeekExpiry(token string) (time.Time, error) + func PeekUID(token string) (string, error) + func PublicJWKS(keys ...*jose.JSONWebKey) jose.JSONWebKeySet + func SaveKey(path string, k *jose.JSONWebKey) error + func Sign(g core.Grant, key *jose.JSONWebKey, now time.Time) (string, error) + func ToProto(g core.Grant) *grantv1.CapacityGrant + func Verify(token string, pub *jose.JSONWebKey, opts VerifyOptions) (core.Grant, error) + type Cache struct + IssuerURL string + MinRefresh time.Duration + Now func() time.Time + OnRefresh func(at time.Time) + func (c *Cache) Key(ctx context.Context, kid string) (*jose.JSONWebKey, error) + func (c *Cache) LastRefresh() time.Time + func (c *Cache) Refresh(ctx context.Context) error + func (c *Cache) RefreshIfDue(ctx context.Context) (bool, error) + func (c *Cache) Run(ctx context.Context, every time.Duration) + type InsecureJSONVerifier struct + func (InsecureJSONVerifier) Verify(_ context.Context, token []byte) (core.Grant, error) + type Issuer struct + Key *jose.JSONWebKey + Now func() time.Time + Ring KeyRing + URL string + func (i *Issuer) Handler() http.Handler + func (i *Issuer) JWKS() jose.JSONWebKeySet + func (i *Issuer) Mint(g core.Grant) (string, error) + func (i *Issuer) Renew(previous string, now time.Time) (string, error) + type KeyRing []StoredKey + func DecodeKeyRing(raw []byte) (KeyRing, error) + func LoadOrCreate(ctx context.Context, store KeyStore, generate func() (KeyRing, error)) (KeyRing, error) + func NewKeyRing(alg jose.SignatureAlgorithm) (KeyRing, error) + func (r KeyRing) Encode() ([]byte, error) + func (r KeyRing) Public() jose.JSONWebKeySet + func (r KeyRing) Signing() (*jose.JSONWebKey, error) + type KeyStore interface + Create func(ctx context.Context, raw []byte) error + Load func(ctx context.Context) ([]byte, error) + type StoredKey struct + JWK jose.JSONWebKey + SignedUntil *time.Time + func (k StoredKey) GoString() string + func (k StoredKey) MarshalLog() any + func (k StoredKey) String() string + type Verifier struct + Audience string + Cache *Cache + MaxLease time.Duration + MaxStale time.Duration + Now func() time.Time + func (v *Verifier) Verify(ctx context.Context, token []byte) (core.Grant, error) + type VerifyOptions struct + Audience string + Issuer string + MaxLease time.Duration v0.4.0-rc.1 Nov 6, 2026
Go to main page