Documentation
¶
Overview ¶
Package revocation provides a credential-format-agnostic interface for checking the revocation status of verifiable credentials.
The interface is designed to support multiple revocation mechanisms:
- Token Status List (draft-ietf-oauth-status-list) — implemented
- OCSP, CRL, or future mechanisms — plug in via the Checker interface
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CheckResult ¶
type CheckResult struct {
// Status is the credential's revocation status.
Status Status
// StatusCode is the raw status byte from the underlying mechanism.
StatusCode uint8
// CheckedAt is when the check was performed.
CheckedAt time.Time
// URI is the status list URI that was checked.
URI string
// Index is the index that was checked.
Index int64
}
CheckResult contains the outcome of a revocation status check.
type Checker ¶
type Checker interface {
// CheckStatus checks the revocation status of a credential.
CheckStatus(ctx context.Context, ref *Reference) (*CheckResult, error)
// Supports returns true if this checker handles the given scheme.
Supports(scheme Scheme) bool
// Extract extracts a revocation Reference from credential claims.
// Returns nil if the claims don't contain revocation info for this mechanism.
Extract(claims map[string]any) *Reference
}
Checker is the interface for revocation status verification. Implementations handle specific revocation mechanisms (Token Status List, OCSP, etc.).
type KeyResolver ¶
type KeyResolver interface {
ResolveKey(ctx context.Context, issuer string, keyID string) (any, error)
}
KeyResolver resolves public keys for verifying signed revocation tokens. Each checker implementation uses this to verify the authenticity of fetched revocation data (e.g., status list JWT signatures).
type Reference ¶
type Reference struct {
// Scheme identifies the revocation mechanism (e.g., "status_list").
Scheme Scheme
// URI is the endpoint to query for status information.
URI string
// Index is the credential's position within the status list (status_list scheme only).
Index int64
}
Reference contains the information needed to check a credential's revocation status. Each credential format (SD-JWT, mDoc, etc.) extracts this from its own claims structure.
func ExtractStatusListReference ¶
ExtractStatusListReference extracts a Token Status List reference from SD-JWT credential claims. Returns nil if no status claim is present (credential is not revocable).
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry holds registered checkers, providing an opaque revocation validation method that callers use without knowing the mechanism.
func NewRegistry ¶
NewRegistry creates a new Registry with the provided checkers. The registry is extensible: pass multiple Checker implementations to support different revocation mechanisms (Token Status List, OCSP, W3C Bitstring, etc.). Each checker declares which scheme it handles via Supports() and provides its own Extract() to find revocation references in credential claims.
func (*Registry) CheckStatus ¶
CheckStatus dispatches to the appropriate checker based on the reference's scheme. Exposed for cases where the caller already has a Reference.
type Scheme ¶
type Scheme string
Scheme identifies the revocation mechanism type.
const ( // SchemeStatusList is the Token Status List mechanism (draft-ietf-oauth-status-list). SchemeStatusList Scheme = "status_list" )
type Status ¶
type Status int
Status represents the revocation status of a credential.
const ( // StatusValid indicates the credential is valid (not revoked). StatusValid Status = iota // StatusInvalid indicates the credential has been revoked. StatusInvalid // StatusSuspended indicates the credential is temporarily suspended. StatusSuspended // StatusUnknown indicates the status could not be determined. StatusUnknown )
type StatusListChecker ¶
type StatusListChecker struct {
// contains filtered or unexported fields
}
StatusListChecker implements the Checker interface using Token Status Lists (draft-ietf-oauth-status-list).
func NewStatusListChecker ¶
func NewStatusListChecker(opts ...StatusListCheckerOption) (*StatusListChecker, error)
NewStatusListChecker creates a new Token Status List checker. A cache must be provided via WithCache.
func (*StatusListChecker) CheckStatus ¶
func (c *StatusListChecker) CheckStatus(ctx context.Context, ref *Reference) (*CheckResult, error)
CheckStatus checks the revocation status via Token Status List.
func (*StatusListChecker) Extract ¶
func (c *StatusListChecker) Extract(claims map[string]any) *Reference
Extract extracts a Token Status List reference from credential claims.
func (*StatusListChecker) Supports ¶
func (c *StatusListChecker) Supports(scheme Scheme) bool
Supports returns true for the status_list scheme.
type StatusListCheckerOption ¶
type StatusListCheckerOption func(*StatusListChecker)
StatusListCheckerOption configures a StatusListChecker.
func WithCache ¶
func WithCache(ch cache.Cache[[]uint8]) StatusListCheckerOption
WithCache sets an external cache implementation. The cache's TTL (set at creation time) controls how long status lists are cached.
func WithHTTPClient ¶
func WithHTTPClient(client *http.Client) StatusListCheckerOption
WithHTTPClient sets a custom HTTP client.
func WithKeyResolver ¶
func WithKeyResolver(kr KeyResolver) StatusListCheckerOption
WithKeyResolver sets the key resolver for verifying status list token signatures. The checker uses this internally to build format-specific verification (e.g., jwt.Keyfunc).
Source Files