passkeys

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 24, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GenerateUserID

func GenerateUserID() ([]byte, error)

GenerateUserID creates a random 32-byte user handle.

func RegisterShellCommand

func RegisterShellCommand(pk *Passkeys, baseURL string)

RegisterShellCommand registers the `passkey` shell command backed by the given Passkeys instance. baseURL is the public HTTP origin used to build the registration link printed to the agent.

Types

type Config

type Config struct {
	Enabled      bool
	RPID         string
	RPName       string
	RPOrigins    []string
	LorePath     string
	PasskeysFile string
	SessionTTL   time.Duration
}

Config holds the resolved passkey configuration.

type Passkeys

type Passkeys struct {
	// contains filtered or unexported fields
}

Passkeys orchestrates WebAuthn registration and login ceremonies and serves the HTTP endpoints that drive them. Credentials persist to a JSON file that agents can read and edit directly via the shell.

func New

func New(cfg Config, sessionKey []byte, logger *slog.Logger) (*Passkeys, error)

New constructs a Passkeys instance. The sessionKey seeds the HMAC used to sign browser session cookies.

func (*Passkeys) LoreBrowserHandler

func (p *Passkeys) LoreBrowserHandler(fsys bashfs.FileSystem) http.Handler

LoreBrowserHandler serves an authenticated web browser over the filesystem. Unauthenticated requests are redirected to the passkey login page. The set of paths a session may view is restricted to the docsets granted by the session's lore spec.

func (*Passkeys) RegisterHTTPHandlers

func (p *Passkeys) RegisterHTTPHandlers(mux *http.ServeMux)

RegisterHTTPHandlers implements httpserver.MuxExtender. It mounts the passkey registration and login ceremony endpoints.

func (*Passkeys) SetAuthConfig

func (p *Passkeys) SetAuthConfig(auth *config.AuthConfig)

SetAuthConfig provides the auth config used to map a lore spec to the docset paths a browser session may view.

func (*Passkeys) Shutdown

func (p *Passkeys) Shutdown()

Shutdown stops background goroutines.

type PendingRegistration

type PendingRegistration struct {
	Token     string
	Lore      string
	Name      string
	UserID    []byte
	Session   *webauthn.SessionData
	ExpiresAt time.Time
}

PendingRegistration represents an in-flight passkey registration.

type PendingStore

type PendingStore struct {
	// contains filtered or unexported fields
}

PendingStore holds pending registrations in memory with automatic expiry.

func NewPendingStore

func NewPendingStore() *PendingStore

NewPendingStore creates a new in-memory pending registration store.

func (*PendingStore) Create

func (ps *PendingStore) Create(loreName, passkeyName string) (*PendingRegistration, error)

Create generates a new pending registration and returns it.

func (*PendingStore) Delete

func (ps *PendingStore) Delete(token string)

Delete removes a pending registration.

func (*PendingStore) Get

func (ps *PendingStore) Get(token string) *PendingRegistration

Get retrieves a pending registration by token. Returns nil if not found or expired.

func (*PendingStore) Stop

func (ps *PendingStore) Stop()

Stop shuts down the cleanup goroutine.

type SessionInfo

type SessionInfo struct {
	Lore      string
	ExpiresAt time.Time
}

SessionInfo holds the decoded session values.

type SessionManager

type SessionManager struct {
	// contains filtered or unexported fields
}

SessionManager handles HMAC-signed session cookies.

func NewSessionManager

func NewSessionManager(key []byte, ttl time.Duration) *SessionManager

NewSessionManager creates a session manager keyed from the given secret.

func (*SessionManager) ClearCookie

func (sm *SessionManager) ClearCookie(w http.ResponseWriter)

ClearCookie removes the session cookie.

func (*SessionManager) SetCookie

func (sm *SessionManager) SetCookie(w http.ResponseWriter, lore string)

SetCookie creates and sets a signed session cookie on the response.

func (*SessionManager) ValidateRequest

func (sm *SessionManager) ValidateRequest(r *http.Request) (*SessionInfo, bool)

ValidateRequest checks the session cookie and returns session info if valid.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store manages passkey credentials on disk as a JSON file.

func NewStore

func NewStore(path string) (*Store, error)

NewStore creates or loads a passkey store from the given file path.

func (*Store) Add

func (s *Store) Add(cred StoredCredential) error

Add persists a new credential.

func (*Store) AllCredentials

func (s *Store) AllCredentials() []StoredCredential

AllCredentials returns all stored credentials.

func (*Store) FindByCredentialID

func (s *Store) FindByCredentialID(credID []byte) (*StoredCredential, bool)

FindByCredentialID returns the stored credential matching the given WebAuthn credential ID.

func (*Store) FindByUserID

func (s *Store) FindByUserID(userID []byte) (*StoredCredential, bool)

FindByUserID returns the stored credential matching the given user handle.

func (*Store) Remove

func (s *Store) Remove(name string) (bool, error)

Remove deletes a credential by name. Returns true if found and removed.

func (*Store) UpdateSignCount

func (s *Store) UpdateSignCount(credID []byte, newCount uint32) error

UpdateSignCount updates the sign count for a credential after successful auth.

type StoreData

type StoreData struct {
	Credentials []StoredCredential `json:"credentials"`
}

StoreData is the on-disk JSON format.

type StoredCredential

type StoredCredential struct {
	// UserID is the WebAuthn user handle (random bytes, base64url-encoded in JSON).
	UserID []byte `json:"user_id"`
	// Name is a human-readable label for this passkey.
	Name string `json:"name"`
	// Lore is the lore spec this passkey grants access to.
	Lore string `json:"lore"`
	// CreatedAt is when the passkey was registered.
	CreatedAt time.Time `json:"created_at"`
	// Credential is the WebAuthn credential data.
	Credential webauthn.Credential `json:"credential"`
}

StoredCredential wraps a webauthn.Credential with metadata.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL