Documentation
¶
Overview ¶
Package gatetoken issues and authenticates the per-session bearer tokens a session's egress gate presents to the controlplane's internal gate-config endpoint (docs/plan/12_vaults-credentials.md slice 4). Only the hash is stored (the internal/api environment-key precedent); a token is valid for its session's life, so it is minted once when the gate is created and never rotated on the wall clock — a controlplane outage longer than a TTL therefore cannot be misread as a revocation.
Index ¶
- Constants
- func Authenticate(ctx context.Context, pool *pgxpool.Pool, token string) (string, error)
- func Ensure(ctx context.Context, pool *pgxpool.Pool, sessionID, token string) error
- func HashToken(token string) string
- func Mint() string
- func MintWithPrefix(prefix string) string
- func Revoke(ctx context.Context, pool *pgxpool.Pool, sessionID string) error
Constants ¶
const TokenPrefix = "gtk_"
TokenPrefix marks a session-gate token value. Internal-only (never on the /v1 wire), like the apikey_/envkey_ credential values — deliberately NOT in domain/id.go knownPrefixes. The gtk_ prefix makes a leaked token secret-scanner-recognizable.
Variables ¶
This section is empty.
Functions ¶
func Authenticate ¶
Authenticate resolves a gate token to the session it is scoped to, or "" if the token is unknown, revoked, or its session has been archived (fail-closed: an archived session's gate must stop being served). There is no wall-clock expiry — validity is the session's lifetime. A deleted session's token is cascade-removed and resolves to "" with no error.
func Ensure ¶
Ensure makes token the one live gate token for sessionID: in one transaction it revokes every prior unrevoked token for the session and inserts the new hash. Re-minting on a replacement gate therefore invalidates the predecessor (revoke-on-re-mint), and the partial unique index keeps at most one live token per session. Only the hash is stored. It takes the session row before either of those, the order a session delete takes and load-bearing against it (#313) — the body says why.
func HashToken ¶ added in v0.4.0
HashToken is the digest stored in place of a token — sha256, hex — shared by every table that keeps one, for MintWithPrefix's reason.
func MintWithPrefix ¶ added in v0.4.0
MintWithPrefix returns a fresh opaque token value under prefix — 32 random bytes in the encoding above. It is the one mint for every internal bearer the platform issues (the gate's gtk_, the work item's wtk_ in internal/worktoken), so their entropy and alphabet cannot drift. It panics only if the system CSPRNG fails, which is unrecoverable for a server that must mint credentials.
func Revoke ¶
Revoke marks sessionID's live gate token revoked without minting a successor — the gated→ungated teardown, where a provision dismantles the session's gate for good and Ensure's revoke-on-re-mint will never run (#197). Idempotent: a session with no live token is a no-op, so a provider that revokes before tearing the pair down can safely retry both if the teardown fails partway.
Types ¶
This section is empty.
Source Files