Documentation
¶
Index ¶
- func GenerateUserID() ([]byte, error)
- func RegisterShellCommand(pk *Passkeys, baseURL string)
- type Config
- type Passkeys
- type PendingRegistration
- type PendingStore
- type SessionInfo
- type SessionManager
- type Store
- func (s *Store) Add(cred StoredCredential) error
- func (s *Store) AllCredentials() []StoredCredential
- func (s *Store) FindByCredentialID(credID []byte) (*StoredCredential, bool)
- func (s *Store) FindByUserID(userID []byte) (*StoredCredential, bool)
- func (s *Store) Remove(name string) (bool, error)
- func (s *Store) UpdateSignCount(credID []byte, newCount uint32) error
- type StoreData
- type StoredCredential
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateUserID ¶
GenerateUserID creates a random 32-byte user handle.
func RegisterShellCommand ¶
RegisterShellCommand registers the `passkey` shell command backed by the given Passkeys instance. baseURL is the public HTTP origin used to build the registration link printed to the agent.
Types ¶
type Config ¶
type Config struct {
Enabled bool
RPID string
RPName string
RPOrigins []string
LorePath string
PasskeysFile string
SessionTTL time.Duration
}
Config holds the resolved passkey configuration.
type Passkeys ¶
type Passkeys struct {
// contains filtered or unexported fields
}
Passkeys orchestrates WebAuthn registration and login ceremonies and serves the HTTP endpoints that drive them. Credentials persist to a JSON file that agents can read and edit directly via the shell.
func New ¶
New constructs a Passkeys instance. The sessionKey seeds the HMAC used to sign browser session cookies.
func (*Passkeys) LoreBrowserHandler ¶
func (p *Passkeys) LoreBrowserHandler(fsys bashfs.FileSystem) http.Handler
LoreBrowserHandler serves an authenticated web browser over the filesystem. Unauthenticated requests are redirected to the passkey login page. The set of paths a session may view is restricted to the docsets granted by the session's lore spec.
func (*Passkeys) RegisterHTTPHandlers ¶
RegisterHTTPHandlers implements httpserver.MuxExtender. It mounts the passkey registration and login ceremony endpoints.
func (*Passkeys) SetAuthConfig ¶
func (p *Passkeys) SetAuthConfig(auth *config.AuthConfig)
SetAuthConfig provides the auth config used to map a lore spec to the docset paths a browser session may view.
type PendingRegistration ¶
type PendingRegistration struct {
Token string
Lore string
Name string
UserID []byte
Session *webauthn.SessionData
ExpiresAt time.Time
}
PendingRegistration represents an in-flight passkey registration.
type PendingStore ¶
type PendingStore struct {
// contains filtered or unexported fields
}
PendingStore holds pending registrations in memory with automatic expiry.
func NewPendingStore ¶
func NewPendingStore() *PendingStore
NewPendingStore creates a new in-memory pending registration store.
func (*PendingStore) Create ¶
func (ps *PendingStore) Create(loreName, passkeyName string) (*PendingRegistration, error)
Create generates a new pending registration and returns it.
func (*PendingStore) Delete ¶
func (ps *PendingStore) Delete(token string)
Delete removes a pending registration.
func (*PendingStore) Get ¶
func (ps *PendingStore) Get(token string) *PendingRegistration
Get retrieves a pending registration by token. Returns nil if not found or expired.
type SessionInfo ¶
SessionInfo holds the decoded session values.
type SessionManager ¶
type SessionManager struct {
// contains filtered or unexported fields
}
SessionManager handles HMAC-signed session cookies.
func NewSessionManager ¶
func NewSessionManager(key []byte, ttl time.Duration) *SessionManager
NewSessionManager creates a session manager keyed from the given secret.
func (*SessionManager) ClearCookie ¶
func (sm *SessionManager) ClearCookie(w http.ResponseWriter)
ClearCookie removes the session cookie.
func (*SessionManager) SetCookie ¶
func (sm *SessionManager) SetCookie(w http.ResponseWriter, lore string)
SetCookie creates and sets a signed session cookie on the response.
func (*SessionManager) ValidateRequest ¶
func (sm *SessionManager) ValidateRequest(r *http.Request) (*SessionInfo, bool)
ValidateRequest checks the session cookie and returns session info if valid.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store manages passkey credentials on disk as a JSON file.
func (*Store) AllCredentials ¶
func (s *Store) AllCredentials() []StoredCredential
AllCredentials returns all stored credentials.
func (*Store) FindByCredentialID ¶
func (s *Store) FindByCredentialID(credID []byte) (*StoredCredential, bool)
FindByCredentialID returns the stored credential matching the given WebAuthn credential ID.
func (*Store) FindByUserID ¶
func (s *Store) FindByUserID(userID []byte) (*StoredCredential, bool)
FindByUserID returns the stored credential matching the given user handle.
type StoreData ¶
type StoreData struct {
Credentials []StoredCredential `json:"credentials"`
}
StoreData is the on-disk JSON format.
type StoredCredential ¶
type StoredCredential struct {
// UserID is the WebAuthn user handle (random bytes, base64url-encoded in JSON).
UserID []byte `json:"user_id"`
// Name is a human-readable label for this passkey.
Name string `json:"name"`
// Lore is the lore spec this passkey grants access to.
Lore string `json:"lore"`
// CreatedAt is when the passkey was registered.
CreatedAt time.Time `json:"created_at"`
// Credential is the WebAuthn credential data.
Credential webauthn.Credential `json:"credential"`
}
StoredCredential wraps a webauthn.Credential with metadata.