agenttoken

package

v0.1.8 Latest Latest Go to latest Published: Aug 15, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/KKloudTarus/synapse-ce

Links

Open Source Insights

Documentation ¶

Overview ¶

Package agenttoken mints and parses fleet agent credentials. A credential is opaque to the agent but carries a routable, non-secret prefix so the server can resolve the tenant (and agent) before a Row-Level-Security lookup, then verify the secret by a constant-time hash comparison. Only the hash of the secret is ever stored; the plaintext is shown once at creation.

Format: "<kind>.<b64url(tenantID)>.<b64url(id)>.<b64url(secret)>". For an enrolment token id is empty. The tenant/id parts are NOT secret (they just route the lookup); forging them fails the hash comparison because the attacker cannot produce the matching secret.

Index ¶

Constants
func B64(s string) string
func Equal(secret, storedHash string) bool
func Hash(secret string) string
func Mint(kind, tenantID, id string) (token, secretHash string, err error)
func Parse(token string) (kind, tenantID, id, secret string, ok bool)

Constants ¶

View Source

const (
	KindEnrol = "et" // single-use enrolment token
	KindAgent = "fa" // long-lived agent bearer credential
)

Kinds of credential.

Variables ¶

This section is empty.

Functions ¶

func B64 ¶

func B64(s string) string

B64 encodes a routable (non-secret) token part with the same alphabet Mint uses. Exposed so callers and tests can construct or inspect the tenant/id parts of a token.

func Equal ¶

func Equal(secret, storedHash string) bool

Equal reports whether secret hashes to storedHash, in constant time.

func Hash ¶

func Hash(secret string) string

Hash returns the hex SHA-256 of a secret. The stored hash is compared against this.

func Mint ¶

func Mint(kind, tenantID, id string) (token, secretHash string, err error)

Mint generates a credential of the given kind for (tenantID, id) and returns the full plaintext token plus the hash of its secret to store. id may be empty (enrolment tokens).

func Parse ¶

func Parse(token string) (kind, tenantID, id, secret string, ok bool)

Parse decodes a token into its parts. ok is false for any malformed token.

Types ¶

This section is empty.

Source Files ¶

View all Source files

agenttoken.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL