delegation

package

v0.23.18 Latest Latest Go to latest Published: Oct 23, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/PastureStack/websocket-proxy

Links

Open Source Insights

Documentation ¶

Overview ¶

Package delegation verifies target-bound API Key stream tickets against the trusted Engine. It never accepts an introspection URL from a JWT.

Index ¶

Constants
Variables
func Integer(v interface{}) (int64, bool)
type FailureReporter
- func NewFailureReporter(engine string) *FailureReporter
type Grant
- func Parse(claims map[string]interface{}) (*Grant, error)
- func (g *Grant) AllowsPath(path string) bool
type Verifier
- func New(platformURL string) *Verifier

Constants ¶

View Source

const Claim = "apiKeyDelegation"

View Source

const Interval = 5 * time.Second

View Source

const MaxTokenBytes = 16 << 10

Variables ¶

View Source

var ErrDenied = errors.New("delegated API key access denied")

Functions ¶

func Integer ¶

func Integer(v interface{}) (int64, bool)

Types ¶

type FailureReporter ¶

type FailureReporter struct {
	Endpoint string
	Client   *http.Client
}

FailureReporter proves both possession of a stream grant and the currently authenticated backend connection ticket. It cannot choose an outcome or exercise any general Agent API authority.

func NewFailureReporter ¶

func NewFailureReporter(engine string) *FailureReporter

func (*FailureReporter) Report ¶

func (reporter *FailureReporter) Report(token, backendToken string) bool

func (*FailureReporter) ReportExpired ¶

func (reporter *FailureReporter) ReportExpired(token, backendToken, attemptID string) bool

Engine independently requires a verified owned ticket that is truly expired.

func (*FailureReporter) ReportRouteDenied ¶

func (reporter *FailureReporter) ReportRouteDenied(token, backendToken, attemptID string) bool

ReportRouteDenied has one fixed meaning. A caller cannot choose an outcome, failure reason, Key identity, or target; Engine derives them from both tickets.

type Grant ¶

type Grant struct {
	KeyID      int64
	Revision   int64
	TargetType string
	TargetID   string
	Operation  string
	ExpiresAt  int64
	Payload    map[string]interface{}
}

func Parse ¶

func Parse(claims map[string]interface{}) (*Grant, error)

nil denotes an unchanged legacy token; a malformed new token is never legacy.

func (*Grant) AllowsPath ¶

func (g *Grant) AllowsPath(path string) bool

type Verifier ¶

type Verifier struct {
	Endpoint string
	Client   *http.Client
	Now      func() time.Time
}

func New ¶

func New(platformURL string) *Verifier

func (*Verifier) Check ¶

func (v *Verifier) Check(ctx context.Context, token string, g *Grant) error

func (*Verifier) Run ¶

func (v *Verifier) Run(ctx context.Context, token string, g *Grant, ticks, expiry <-chan time.Time, deny func())

Run accepts controllable barriers: tests do not sleep to simulate revocation.

func (*Verifier) Watch ¶

func (v *Verifier) Watch(parent context.Context, token string, g *Grant, deny func()) context.CancelFunc

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL