Versions in this module Expand all Collapse all v0 v0.2.0 Oct 9, 2026 Changes in this version + const LogApproval + const LogAudit + const LogClarification + const LogCompletion + const LogInteraction + const LogPermission + const LogTermination + const LogTokenRequest + const LogUpdate + const MissionActive + const MissionTerminated + var ErrAgentRevoked = errors.New("personserver: agent token revoked") + var ErrBindingConflict = errors.New("personserver: agent is bound to another person") + var ErrBindingRevoked = errors.New("personserver: agent binding revoked") + var ErrClarificationLimit = errors.New("personserver: clarification round limit reached") + var ErrConflict = errors.New("personserver: version conflict") + var ErrExists = errors.New("personserver: already exists") + var ErrFederating = errors.New("personserver: the request is waiting on the access server") + var ErrInvalidCode = errors.New("personserver: invalid_code") + var ErrMissionTerminated = errors.New("personserver: mission terminated") + var ErrNotFound = errors.New("personserver: not found") + var ErrQuestionPending = errors.New("personserver: a clarification is already pending") + var ErrResolved = errors.New("personserver: pending request already resolved") + var ErrRevoked = errors.New("personserver: person token revoked") + func DirectedSubject(key []byte, person, resource string) string + func ResourceInteractionURL(p *Pending, callback string) (string, error) + type AgentRef struct + Issuer string + Subject string + func (a AgentRef) IsZero() bool + func (a AgentRef) String() string + type AgentTokenRecord struct + Exp time.Time + Issuer string + JTI string + Subject string + type AuthTokenRecord struct + Agent AgentRef + Exp time.Time + Issuer string + JTI string + MissionS256 string + Person string + PersonIssuer string + PersonJTI string + PresentedJTI string + Resource string + Subagent AgentRef + Subject string + type BindingStore interface + Bind func(ctx context.Context, agent AgentRef, person string) error + BoundPerson func(ctx context.Context, agent AgentRef) (string, error) + Unbind func(ctx context.Context, agent AgentRef) error + type ClaimsProvider func(ctx context.Context, person string, required []string) (map[string]any, error) + type Config struct + AcceptRevocation func(ctx context.Context, caller aauth.ServerCaller) bool + AgentResolver aauth.KeyResolver + Audit bool + AuditSink func(ctx context.Context, agent AgentRef, r aauth.AuditRequest) + AuthTokenTTL time.Duration + ClaimsProvider ClaimsProvider + ClaimsSupported []string + CollocatedAS func(resource string) bool + Decider Decider + Federator Federator + HTTPClient *http.Client + InsecureSkipIdentifierCheck bool + InteractionRelay InteractionRelay + InteractionURL string + Issuer string + Key crypto.Signer + KeyID string + Limiter aauth.Limiter + Logger *slog.Logger + MaxClarificationRounds int + MaxWait time.Duration + Metadata aauth.ServerMetadata + MissionApprover MissionApprover + MissionControlEndpoint string + Notify func(ctx context.Context, p *Pending) + Now func() time.Time + Paths Paths + PendingTTL time.Duration + PermissionDecider PermissionDecider + PersonTokenTTL time.Duration + PublishedKeys []aauth.JWK + Revoker Revoker + ScopesSupported []string + ServerResolver aauth.KeyResolver + SignatureWindow time.Duration + Store Store + SubjectKey []byte + TokenResolver aauth.KeyResolver + type Decider interface + Decide func(ctx context.Context, r *TokenRequest) (Decision, error) + type DeciderFunc func(ctx context.Context, r *TokenRequest) (Decision, error) + func (f DeciderFunc) Decide(ctx context.Context, r *TokenRequest) (Decision, error) + type Decision struct + Code string + Grant Grant + Outcome Outcome + Question *Question + Reason string + Requirement string + RetryAfter int + func Allow(g Grant) Decision + func DeferApproval() Decision + func DeferClarification(question string, options ...string) Decision + func DeferInteraction() Decision + func Deny(reason string) Decision + type Exchange struct + Answer string + FromAS bool + Justification string + Question string + Time time.Time + Updated bool + type FederationRequest struct + AccessServer string + AgentToken string + PresentedToken string + ResourceToken string + SubagentToken string + UpstreamToken string + type FederationResponse struct + AuthToken string + ErrorCode string + ErrorDetail string + ErrorStatus int + ExpiresIn int64 + PendingURL string + Question *Question + RequiredClaims []string + Requirement aauth.Requirement + RetryAfter int + Status string + type FederationState struct + AccessServer string + GrantedScope string + PendingURL string + Question *Question + Requirement aauth.Requirement + RetryAfter int + Status string + type Federator interface + Answer func(ctx context.Context, pendingURL string, body any) error + Federate func(ctx context.Context, r *FederationRequest) (*FederationResponse, error) + Poll func(ctx context.Context, pendingURL string) (*FederationResponse, error) + type Grant struct + Answer string + Mission *MissionGrant + Person string + Scope string + TTL time.Duration + Tenant string + type HTTPRevoker struct + Client aauth.RevocationClient + HTTPClient *http.Client + func (h HTTPRevoker) Revoke(ctx context.Context, recipient, dwk string, req aauth.RevocationRequest) (*aauth.RevocationResponse, error) + type InteractionRelay interface + Relay func(ctx context.Context, r *InteractionRequest) (Decision, error) + type InteractionRelayFunc func(ctx context.Context, r *InteractionRequest) (Decision, error) + func (f InteractionRelayFunc) Relay(ctx context.Context, r *InteractionRequest) (Decision, error) + type InteractionRequest struct + Agent *aauth.AgentClaims + Mission *MissionRecord + Person string + Request *aauth.InteractionRequest + type Kind string + const KindAuthToken + const KindInteraction + const KindMissionCompletion + const KindMissionProposal + const KindMissionUpdate + const KindPermission + const KindPersonToken + type MemoryStore struct + func NewMemoryStore() *MemoryStore + func (m *MemoryStore) AgentToken(_ context.Context, iss, jti string) (*AgentTokenRecord, error) + func (m *MemoryStore) AppendMissionLog(_ context.Context, s256 string, e MissionLogEntry) error + func (m *MemoryStore) AuthToken(_ context.Context, iss, jti string) (*AuthTokenRecord, error) + func (m *MemoryStore) AuthTokensForMission(_ context.Context, s256 string) ([]AuthTokenRecord, error) + func (m *MemoryStore) AuthTokensForPersonToken(_ context.Context, jti string) ([]AuthTokenRecord, error) + func (m *MemoryStore) Bind(_ context.Context, agent AgentRef, person string) error + func (m *MemoryStore) BoundPerson(_ context.Context, agent AgentRef) (string, error) + func (m *MemoryStore) CreateMission(_ context.Context, r *MissionRecord) error + func (m *MemoryStore) CreatePending(_ context.Context, p *Pending) error + func (m *MemoryStore) IsRevoked(_ context.Context, iss, jti string) (bool, error) + func (m *MemoryStore) MarkPresented(_ context.Context, jti, as string) error + func (m *MemoryStore) Mission(_ context.Context, s256 string) (*MissionRecord, error) + func (m *MemoryStore) MissionLog(_ context.Context, s256 string) ([]MissionLogEntry, error) + func (m *MemoryStore) Pending(_ context.Context, id string) (*Pending, error) + func (m *MemoryStore) PendingByCode(_ context.Context, code string) (*Pending, error) + func (m *MemoryStore) PendingForMission(_ context.Context, s256 string) ([]*Pending, error) + func (m *MemoryStore) PendingForResourceToken(_ context.Context, iss, jti string) ([]*Pending, error) + func (m *MemoryStore) PersonToken(_ context.Context, jti string) (*PersonTokenRecord, error) + func (m *MemoryStore) PersonTokensForSubject(_ context.Context, resource, sub string) ([]PersonTokenRecord, error) + func (m *MemoryStore) PersonTokensFromUpstream(_ context.Context, iss, jti string) ([]PersonTokenRecord, error) + func (m *MemoryStore) RecordAgentToken(_ context.Context, r AgentTokenRecord) error + func (m *MemoryStore) RecordAuthToken(_ context.Context, r AuthTokenRecord) error + func (m *MemoryStore) RecordPersonToken(_ context.Context, r PersonTokenRecord) error + func (m *MemoryStore) RecordSubject(_ context.Context, resource, sub, person string) error + func (m *MemoryStore) ResolvePendingIfMissionActive(_ context.Context, p *Pending) error + func (m *MemoryStore) Revoke(_ context.Context, iss, jti string, exp time.Time) error + func (m *MemoryStore) SubjectPerson(_ context.Context, resource, sub string) (string, error) + func (m *MemoryStore) TerminateMission(_ context.Context, s256, reason string) error + func (m *MemoryStore) TokensForAgent(_ context.Context, agent AgentRef) ([]PersonTokenRecord, []AuthTokenRecord, error) + func (m *MemoryStore) Unbind(_ context.Context, agent AgentRef) error + func (m *MemoryStore) UpdatePending(_ context.Context, p *Pending) error + type MissionApprover interface + DecideMission func(ctx context.Context, r *MissionRequest) (Decision, error) + type MissionApproverFunc func(ctx context.Context, r *MissionRequest) (Decision, error) + func (f MissionApproverFunc) DecideMission(ctx context.Context, r *MissionRequest) (Decision, error) + type MissionGrant struct + Capabilities []string + Description string + ExpiresAt time.Time + Extra map[string]any + Resources []string + Tools []aauth.MissionTool + type MissionLogEntry struct + Agent AgentRef + Body json.RawMessage + Kind string + S256 string + Time time.Time + type MissionRecord struct + ApprovedAt time.Time + Blob []byte + Capabilities []string + ExpiresAt time.Time + Owner AgentRef + Person string + S256 string + Status string + TerminationReason string + type MissionRequest struct + Action *aauth.MissionAction + Agent *aauth.AgentClaims + Kind Kind + Mission *MissionRecord + Person string + Proposal *aauth.MissionProposal + type MissionStore interface + AppendMissionLog func(ctx context.Context, s256 string, e MissionLogEntry) error + CreateMission func(ctx context.Context, m *MissionRecord) error + Mission func(ctx context.Context, s256 string) (*MissionRecord, error) + MissionLog func(ctx context.Context, s256 string) ([]MissionLogEntry, error) + TerminateMission func(ctx context.Context, s256, reason string) error + type Outcome int + const Allowed + const Deferred + const Denied + type Paths struct + Audit string + AuthToken string + Interaction string + JWKS string + Mission string + Pending string + Permission string + PersonToken string + Revocation string + func DefaultPaths() Paths + type Pending struct + AccessServer string + Agent AgentRef + AgentJTI string + Code string + CodeCanonical string + CodeConsumed bool + CreatedAt time.Time + ExpiresAt time.Time + Federation *FederationState + Hints aauth.TokenRequestHints + ID string + Interaction *aauth.InteractionRequest + InteractionURL string + Kind Kind + MissionAction *aauth.MissionAction + MissionS256 string + Permission *aauth.PermissionRequest + Person string + Proposal *aauth.MissionProposal + Question *Question + QuestionAt time.Time + QuestionFromAS bool + ReceivedAt time.Time + RelayDeadline time.Time + Request json.RawMessage + Requirement string + Resource string + ResourceInteraction *aauth.ResourceInteraction + ResourceInteractionDone bool + ResourceTokenIssuer string + ResourceTokenJTI string + Result *Result + RetryAfter int + Rounds int + Scope string + State State + Subagent AgentRef + Transcript []Exchange + UpstreamIssuer string + UpstreamJTI string + Version int64 + func (p *Pending) Open() bool + type PendingStore interface + CreatePending func(ctx context.Context, p *Pending) error + Pending func(ctx context.Context, id string) (*Pending, error) + PendingByCode func(ctx context.Context, code string) (*Pending, error) + PendingForMission func(ctx context.Context, s256 string) ([]*Pending, error) + PendingForResourceToken func(ctx context.Context, iss, jti string) ([]*Pending, error) + ResolvePendingIfMissionActive func(ctx context.Context, p *Pending) error + UpdatePending func(ctx context.Context, p *Pending) error + type PermissionDecider interface + DecidePermission func(ctx context.Context, r *PermissionRequest) (Decision, error) + type PermissionDeciderFunc func(ctx context.Context, r *PermissionRequest) (Decision, error) + func (f PermissionDeciderFunc) DecidePermission(ctx context.Context, r *PermissionRequest) (Decision, error) + type PermissionRequest struct + Agent *aauth.AgentClaims + Mission *MissionRecord + Person string + Request *aauth.PermissionRequest + type PersonTokenRecord struct + Agent AgentRef + AgentJTI string + Exp time.Time + JTI string + MissionS256 string + Person string + PresentedTo []string + Resource string + Subagent AgentRef + SubagentJTI string + Subject string + UpstreamIssuer string + UpstreamJTI string + type Question struct + Options []string + Text string + Timeout int + type RateLimitError struct + RetryAfter time.Duration + func (e *RateLimitError) Error() string + type Result struct + Body []byte + ContentType string + Status int + type Revoker interface + Revoke func(ctx context.Context, recipient, dwk string, req aauth.RevocationRequest) (*aauth.RevocationResponse, error) + type Server struct + func New(cfg Config) (*Server, error) + func (s *Server) Approve(ctx context.Context, id string, g Grant) error + func (s *Server) Ask(ctx context.Context, id string, q Question) error + func (s *Server) CompleteResourceInteraction(ctx context.Context, id, callbackError string) error + func (s *Server) ConsumeCode(ctx context.Context, code string) (*Pending, error) + func (s *Server) ConsumeCodeFor(ctx context.Context, code, client string) (*Pending, error) + func (s *Server) Deny(ctx context.Context, id, reason string) error + func (s *Server) Fail(ctx context.Context, id, code, detail string) error + func (s *Server) Issuer() string + func (s *Server) JWKS() aauth.JWKS + func (s *Server) MarkInteracting(ctx context.Context, id string) error + func (s *Server) Metadata() aauth.PersonServerMetadata + func (s *Server) Mission(ctx context.Context, s256 string) (*MissionRecord, error) + func (s *Server) MissionLog(ctx context.Context, s256 string) ([]MissionLogEntry, error) + func (s *Server) PendingRequest(ctx context.Context, id string) (*Pending, error) + func (s *Server) Register(mux *http.ServeMux) + func (s *Server) RevokeAgent(ctx context.Context, agent AgentRef) ([]aauth.RevocationOutcome, error) + func (s *Server) RevokeAuthToken(ctx context.Context, jti string) ([]aauth.RevocationOutcome, error) + func (s *Server) RevokeBinding(ctx context.Context, agent AgentRef) ([]aauth.RevocationOutcome, error) + func (s *Server) RevokePersonToken(ctx context.Context, jti string) ([]aauth.RevocationOutcome, error) + func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) + func (s *Server) Signer() aauth.ServerSigner + func (s *Server) TerminateMission(ctx context.Context, s256, reason string) ([]aauth.RevocationOutcome, error) + type State string + const StateCancelled + const StateDone + const StateInteracting + const StatePending + type Store interface + type SubjectStore interface + RecordSubject func(ctx context.Context, resource, sub, person string) error + SubjectPerson func(ctx context.Context, resource, sub string) (string, error) + type TokenRequest struct + AccessServer string + Agent *aauth.AgentClaims + Capabilities []string + Chained bool + Hints aauth.TokenRequestHints + Kind Kind + Mission *MissionRecord + Person string + Resource string + ResourceToken *aauth.ResourceClaims + Scope string + Subagent *aauth.AgentClaims + Upstream aauth.PresentedToken + type TokenStore interface + AgentToken func(ctx context.Context, iss, jti string) (*AgentTokenRecord, error) + AuthToken func(ctx context.Context, iss, jti string) (*AuthTokenRecord, error) + AuthTokensForMission func(ctx context.Context, s256 string) ([]AuthTokenRecord, error) + AuthTokensForPersonToken func(ctx context.Context, jti string) ([]AuthTokenRecord, error) + IsRevoked func(ctx context.Context, iss, jti string) (bool, error) + MarkPresented func(ctx context.Context, jti, as string) error + PersonToken func(ctx context.Context, jti string) (*PersonTokenRecord, error) + PersonTokensForSubject func(ctx context.Context, resource, sub string) ([]PersonTokenRecord, error) + PersonTokensFromUpstream func(ctx context.Context, iss, jti string) ([]PersonTokenRecord, error) + RecordAgentToken func(ctx context.Context, r AgentTokenRecord) error + RecordAuthToken func(ctx context.Context, r AuthTokenRecord) error + RecordPersonToken func(ctx context.Context, r PersonTokenRecord) error + Revoke func(ctx context.Context, iss, jti string, exp time.Time) error + TokensForAgent func(ctx context.Context, agent AgentRef) ([]PersonTokenRecord, []AuthTokenRecord, error)
Go to main page