identity

package
v0.15.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// IssuerRole is the role of an issuer
	IssuerRole RoleType = driver.IssuerRole
	// AuditorRole is the role of an auditor
	AuditorRole = driver.AuditorRole
	// OwnerRole is the role of an owner
	OwnerRole = driver.OwnerRole
	// CertifierRole is the role of a certifier
	CertifierRole = driver.CertifierRole
)

Variables

This section is empty.

Functions

func TypeToString 

func TypeToString(t driver.IdentityType) string

TypeToString return a string identifier for the given identity type. If the type is unknown, it returns the string "Type (<t>)".

Types

type ConfIDResolver added in v0.15.1 

type ConfIDResolver interface {
	// GetConfID returns the conf_id the identity was bound under, or an empty string and no
	// error if the identity has no known binding.
	GetConfID(ctx context.Context, identity driver.Identity) (string, error)
}

ConfIDResolver resolves the identity configuration id (conf_id, see driver.IdentityConfiguration.UniqueID) that an identity was bound under, regardless of role. It mirrors the read side of idriver.WalletStoreService.GetConfID.

type Deserializer 

type Deserializer interface {
	DeserializeSigner(ctx context.Context, raw []byte) (driver.Signer, error)
}

type EnrollmentIDUnmarshaler 

type EnrollmentIDUnmarshaler interface {
	// GetEnrollmentID returns the enrollment ID from the audit info
	GetEnrollmentID(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, error)
	// GetRevocationHandler returns the revocation handle from the audit info
	GetRevocationHandler(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, error)
	// GetEIDAndRH returns both enrollment ID and revocation handle
	GetEIDAndRH(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, string, error)
}

EnrollmentIDUnmarshaler decodes an enrollment ID form an audit info

type Identity 

type Identity = driver.Identity

func WrapWithType 

func WrapWithType(idType Type, id Identity) (Identity, error)

type Metrics added in v0.15.1 

type Metrics struct {
	// SignerResolutions counts GetSigner calls by how the signer was ultimately obtained:
	// "cache" (already cached), "routed" (conf_id-pinned SignerRouter hit), or "fallback"
	// (linear-scan probing deserializer).
	SignerResolutions metrics.Counter

	// GetSignerDuration is a histogram of GetSigner wall-clock time, in seconds, labeled by
	// the same "path" values as SignerResolutions. Comparing the "routed" and "fallback"
	// buckets shows the latency saved by skipping the cryptographic probe.
	GetSignerDuration metrics.Histogram

	// SignerRouterRegistrations counts conf_id->KeyManager bindings registered with the
	// SignerRouter. A near-zero count in a running deployment indicates routing is not being
	// populated and every GetSigner call is falling back to the probing deserializer.
	SignerRouterRegistrations metrics.Counter

	// NoProbeErrors counts failures of the SignerRouter's probe-free deserialization path
	// (ProbeFreeSignerDeserializer.DeserializeSignerNoProbe). Since that path skips the
	// cryptographic check that would otherwise catch a mismatched KeyManager, a non-zero
	// count is worth investigating as a potential conf_id routing bug.
	NoProbeErrors metrics.Counter
}

Metrics holds the instrumentation for the identity Provider and its SignerRouter.

func NewMetrics added in v0.15.1 

func NewMetrics(p metrics.Provider) *Metrics

NewMetrics creates a new Metrics instance with the given provider.

type NetworkBinderService 

type NetworkBinderService interface {
	Bind(ctx context.Context, longTerm driver.Identity, ephemeral ...driver.Identity) error
}

type Provider 

type Provider struct {
	Logger logging.Logger
	Binder NetworkBinderService
	// contains filtered or unexported fields
}

Provider implements the driver.IdentityProvider interface. Provider manages identity-related concepts like signature signers, verifiers, audit information, and so on.

func NewProvider 

func NewProvider(
	logger logging.Logger,
	storage Storage,
	deserializer Deserializer,
	binder NetworkBinderService,
	enrollmentIDUnmarshaler EnrollmentIDUnmarshaler,
	m *Metrics,
) *Provider

NewProvider returns a new instance of Provider. m may be nil, in which case the provider's metrics are a noop.

func (*Provider) AreMe 

func (p *Provider) AreMe(ctx context.Context, identities ...driver.Identity) []string

AreMe returns the hashes of the passed identities that have a signer registered before. Each identity is resolved via the signer cache and configured storage. There is no secondary "is me" cache: a real cache would need careful handling for single-use identities (for example Idemix nyms) and is intentionally omitted here.

func (*Provider) Bind 

func (p *Provider) Bind(ctx context.Context, longTerm driver.Identity, ephemeralIdentities ...driver.Identity) error

Bind binds longTerm to the passed ephemeral identities.

func (*Provider) GetAuditInfo 

func (p *Provider) GetAuditInfo(ctx context.Context, identity driver.Identity) ([]byte, error)

GetAuditInfo returns the audit information associated to the passed identity, nil otherwise. The audit info is retrieved from the configured storage.

func (*Provider) GetEIDAndRH 

func (p *Provider) GetEIDAndRH(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, string, error)

GetEIDAndRH returns both enrollment ID and revocation handle

func (*Provider) GetEnrollmentID 

func (p *Provider) GetEnrollmentID(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, error)

GetEnrollmentID extracts the enrollment ID from the passed audit info

func (*Provider) GetRevocationHandler 

func (p *Provider) GetRevocationHandler(ctx context.Context, identity driver.Identity, auditInfo []byte) (string, error)

GetRevocationHandler extracts the revocation handler from the passed audit info

func (*Provider) GetSigner 

func (p *Provider) GetSigner(ctx context.Context, identity driver.Identity) (driver.Signer, error)

GetSigner returns a Signer for passed identity. If a signer cannot be retrieved an error is returned. Signers that can be reused are cached. If a signer is not found in cache, this provider tries to construct an instance of driver.Signer that produces valid signatures under that identity.

func (*Provider) IsMe 

func (p *Provider) IsMe(ctx context.Context, identity driver.Identity) bool

IsMe returns true if a signer was ever registered for the passed identity

func (*Provider) RegisterIdentityDescriptor 

func (p *Provider) RegisterIdentityDescriptor(ctx context.Context, identityDescriptor *idriver.IdentityDescriptor, alias driver.Identity) error

RegisterIdentityDescriptor stores the given identity descriptor in the configured storage. If alias is not nil, the alias can be used as an alternative to `idriver.IdentityDescriptor#Identity`.

func (*Provider) RegisterRecipientData 

func (p *Provider) RegisterRecipientData(ctx context.Context, data *driver.RecipientData) error

RegisterRecipientData stores the passed recipient data in the configured storage.

func (*Provider) RegisterRecipientIdentity 

func (p *Provider) RegisterRecipientIdentity(ctx context.Context, id driver.Identity) error

RegisterRecipientIdentity registers the passed identity as a third-party recipient identity. The wallet layer performs matching and persistence; this provider records nothing here.

func (*Provider) RegisterSigner 

func (p *Provider) RegisterSigner(ctx context.Context, identity driver.Identity, signer driver.Signer, verifier driver.Verifier, signerInfo []byte, ephemeral bool) error

RegisterSigner registers a Signer and a Verifier for passed identity. This is implemented via an invocation of RegisterIdentityDescriptor using an IdentityDescriptor with empty AuditInfo. The audit info might or might not be already stored.

func (*Provider) RollbackPartialRecipientRegistration 

func (p *Provider) RollbackPartialRecipientRegistration(ctx context.Context, id driver.Identity)

RollbackPartialRecipientRegistration implements RecipientRegistrationRollback. This provider does not keep partial recipient-registration marks in memory; the hook remains for other IdentityProvider implementations.

func (*Provider) SetSignerRouter added in v0.15.1 

func (p *Provider) SetSignerRouter(router *SignerRouter)

SetSignerRouter sets the router consulted for conf_id-pinned signer resolution before falling back to the linear-scan deserializer. Passing nil disables routing (the default), leaving GetSigner's fallback behavior unchanged.

type RecipientRegistrationRollback 

type RecipientRegistrationRollback interface {
	RollbackPartialRecipientRegistration(ctx context.Context, id driver.Identity)
}

RecipientRegistrationRollback is implemented by identity providers that record side effects in RegisterRecipientIdentity before RegisterRecipientData. If RegisterRecipientData never succeeds, the implementation should undo those effects so the node is not left in a half-registered state.

type RoleType 

type RoleType = driver.IdentityRoleType

RoleType is the role of an identity

type SignerEntry 

type SignerEntry struct {
	Signer     driver.Signer
	DebugStack []byte
}

type SignerRouter added in v0.15.1 

type SignerRouter struct {
	// contains filtered or unexported fields
}

SignerRouter routes signer reconstruction directly to the single KeyManager pinned by an identity's conf_id, bypassing the fallback deserializer's linear scan across every KeyManager registered under the identity's type and the cryptographic probe that scan relies on to detect a mismatched KeyManager. Skipping that probe is only safe once the KeyManager is pinned this way, so Resolve reports ok=false (never an error) whenever routing cannot be attempted - callers MUST fall back to the probing deserializer in that case, not treat it as a hard failure.

func NewSignerRouter added in v0.15.1 

func NewSignerRouter(m *Metrics) *SignerRouter

NewSignerRouter returns an empty SignerRouter. It resolves nothing until KeyManagers are registered via Register and a resolver is set via SetConfIDResolver. m may be nil, in which case the router's metrics are a noop.

func (*SignerRouter) Register added in v0.15.1 

func (r *SignerRouter) Register(confID string, deserializer idriver.SignerDeserializer)

Register binds confID to the deserializer (KeyManager) that originated it. A later registration for the same confID replaces the earlier one.

func (*SignerRouter) Resolve added in v0.15.1 

func (r *SignerRouter) Resolve(ctx context.Context, id driver.Identity) (driver.Signer, bool)

Resolve attempts to reconstruct a Signer for id via conf_id-based routing. ok is false, with a nil error, whenever routing cannot be attempted (no resolver set, no conf_id mapping, no KeyManager registered for that conf_id) or the routed KeyManager itself fails to reconstruct the signer - callers MUST treat ok=false as "try the fallback path", never as a hard failure.

func (*SignerRouter) SetConfIDResolver added in v0.15.1 

func (r *SignerRouter) SetConfIDResolver(resolver ConfIDResolver)

SetConfIDResolver sets the resolver used to map an identity to its conf_id. Callers typically set this once the wallet store backing the resolver becomes available, which can be after the router has already had KeyManagers registered with it.

type Storage 

type Storage interface {
	GetAuditInfo(ctx context.Context, id []byte) ([]byte, error)
	StoreIdentityData(ctx context.Context, id []byte, identityAudit []byte, tokenMetadata []byte, tokenMetadataAudit []byte) error
	StoreSignerInfo(ctx context.Context, id driver.Identity, info []byte) error
	GetExistingSignerInfo(ctx context.Context, ids ...driver.Identity) ([]string, error)
	SignerInfoExists(ctx context.Context, id []byte) (bool, error)
	GetSignerInfo(ctx context.Context, identity []byte) ([]byte, error)
	RegisterIdentityDescriptor(ctx context.Context, descriptor *idriver.IdentityDescriptor, alias driver.Identity) error
}

type StorageProvider 

type StorageProvider = idriver.StorageProvider

StorageProvider returns storage services scoped to a specific token management system (TMS) identified by token.TMSID. Callers request the concrete store service for the given TMS and use the returned service to access persisted wallet, identity, or keystore data.

type Type 

type Type = driver.IdentityType

type TypedIdentity 

type TypedIdentity struct {
	// Type encodes the type of the identity
	Type Type `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,json=type,proto3"`
	// Identity encodes the identity itself
	Identity Identity `json:"identity,omitempty" protobuf:"bytes,2,opt,name=identity,proto3"`
}

TypedIdentity encodes an identity with a type.

func UnmarshalTypedIdentity 

func UnmarshalTypedIdentity(id Identity) (*TypedIdentity, error)

func (TypedIdentity) Bytes 

func (i TypedIdentity) Bytes() ([]byte, error)

Source Files

View all Source files

Directories

Path Synopsis
Package boolpolicy provides an identity type whose ownership is governed by a boolean expression over a set of component identities.
 Package boolpolicy provides an identity type whose ownership is governed by a boolean expression over a set of component identities.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
cache
crypto
crypto/protos-go/config
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
schema
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
nym
interop
htlc
htlc/mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
Code generated by counterfeiter.
 Code generated by counterfeiter.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
mock
Code generated by counterfeiter.
 Code generated by counterfeiter.
crypto
crypto/csp
crypto/mocks
Code generated by counterfeiter.
 Code generated by counterfeiter.
crypto/pkcs11
crypto/protos-go/config
crypto/protos-go/v1/config

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.