authentication

package
v0.9.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 11, 2026 License: Apache-2.0 Imports: 34 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DeviceManifestType         = "ANPDeviceManifest"
	ProfileCoreBindingV1       = "anp.core.binding.v1"
	ProfileIdentityDiscoveryV1 = "anp.identity.discovery.v1"
	ProfileDirectBaseV1        = "anp.direct.base.v1"
	ProfileGroupBaseV1         = "anp.group.base.v1"
	ProfileDirectE2EEV2        = "anp.direct.e2ee.v2"
	ProfileGroupE2EEV2         = "anp.group.e2ee.v2"

	// Compatibility constants for already published all-v2 draft Manifests.
	ProfileCoreBindingV2       = "anp.core.binding.v2"
	ProfileIdentityDiscoveryV2 = "anp.identity.discovery.v2"
	ProfileDirectBaseV2        = "anp.direct.base.v2"
	ProfileGroupBaseV2         = "anp.group.base.v2"
)
View Source 
const (
	VMKeyAuth             = "key-1"
	VMKeyE2EESigning      = "key-2"
	VMKeyE2EEAgreement    = "key-3"
	ANPMessageServiceType = "ANPMessageService"
)

Variables

This section is empty.

Functions

func AddDeviceToDIDDocument added in v0.9.0 

func AddDeviceToDIDDocument(
	didDocument map[string]any,
	rootKeyID string,
	device DeviceManifestEntry,
	deviceSigningVerificationMethod map[string]any,
	deviceE2EEVerificationMethod map[string]any,
	retiredDeviceIDs []string,
) (map[string]any, error)

AddDeviceToDIDDocument adds one device to a validated document and returns an unsigned copy.

func BuildANPMessageService 

func BuildANPMessageService(didOrServiceRef string, serviceEndpoint string, options AnpMessageServiceOptions) map[string]any

BuildANPMessageService builds a generic ANPMessageService record.

func BuildAgentMessageService 

func BuildAgentMessageService(did string, serviceEndpoint string, options AnpMessageServiceOptions) map[string]any

BuildAgentMessageService builds a direct agent ANPMessageService record.

func BuildContentDigest 

func BuildContentDigest(body []byte) string

BuildContentDigest builds a Content-Digest header value.

func BuildGroupMessageService 

func BuildGroupMessageService(did string, serviceEndpoint string, options AnpMessageServiceOptions) map[string]any

BuildGroupMessageService builds a group ANPMessageService record.

func BuildVNextDIDDocument added in v0.9.0 

func BuildVNextDIDDocument(
	baseDocument map[string]any,
	rootKeyID string,
	rootVerificationMethod map[string]any,
	device DeviceManifestEntry,
	deviceSigningVerificationMethod map[string]any,
	deviceE2EEVerificationMethod map[string]any,
) (map[string]any, error)

BuildVNextDIDDocument builds an unsigned vNext DID document from public key material only. The caller must root-sign the result before publishing it.

func ComputeJWKFingerprint 

func ComputeJWKFingerprint(publicKey anp.PublicKeyMaterial) (string, error)

ComputeJWKFingerprint computes the k1 fingerprint from a secp256k1 public key.

func ComputeMultikeyFingerprint 

func ComputeMultikeyFingerprint(publicKey anp.PublicKeyMaterial) (string, error)

ComputeMultikeyFingerprint computes the e1 fingerprint from an Ed25519 public key.

func ExtractPublicKey 

func ExtractPublicKey(method map[string]any) (anp.PublicKeyMaterial, error)

ExtractPublicKey extracts public key material from a DID verification method entry.

func FindVerificationMethod 

func FindVerificationMethod(didDocument map[string]any, verificationMethodID string) map[string]any

FindVerificationMethod looks up a verification method by identifier.

func GenerateAuthHeader 

func GenerateAuthHeader(didDocument map[string]any, serviceDomain string, privateKey anp.PrivateKeyMaterial, version string) (string, error)

GenerateAuthHeader generates a legacy DIDWba Authorization header.

func GenerateAuthJSON 

func GenerateAuthJSON(didDocument map[string]any, serviceDomain string, privateKey anp.PrivateKeyMaterial, version string) (string, error)

GenerateAuthJSON generates the JSON legacy DIDWba payload.

func GenerateHTTPSignatureHeaders 

func GenerateHTTPSignatureHeaders(didDocument map[string]any, requestURL string, requestMethod string, privateKey anp.PrivateKeyMaterial, headers map[string]string, body []byte, options HttpSignatureOptions) (map[string]string, error)

GenerateHTTPSignatureHeaders generates HTTP Message Signatures headers.

func IsAssertionMethodAuthorized 

func IsAssertionMethodAuthorized(didDocument map[string]any, verificationMethodID string) bool

IsAssertionMethodAuthorized reports whether a method is listed in assertionMethod.

func IsAuthenticationAuthorized 

func IsAuthenticationAuthorized(didDocument map[string]any, verificationMethodID string) bool

IsAuthenticationAuthorized reports whether a method is listed in authentication.

func RemoveDeviceFromDIDDocument added in v0.9.0 

func RemoveDeviceFromDIDDocument(
	didDocument map[string]any,
	rootKeyID string,
	deviceID string,
) (map[string]any, error)

RemoveDeviceFromDIDDocument removes one device and its active key references from an unsigned copy.

func ResolveDidDocument 

func ResolveDidDocument(ctx context.Context, did string, verifyProof bool) (map[string]any, error)

ResolveDidDocument resolves a did:wba or did:web document.

func ResolveDidDocumentWithOptions 

func ResolveDidDocumentWithOptions(ctx context.Context, did string, verifyProof bool, options DidResolutionOptions) (map[string]any, error)

ResolveDidDocumentWithOptions resolves a did:wba or did:web document with explicit options.

func ResolveDidWBADocument 

func ResolveDidWBADocument(ctx context.Context, did string, verifyProof bool) (map[string]any, error)

ResolveDidWBADocument resolves a did:wba document over HTTPS.

func ResolveDidWBADocumentWithOptions 

func ResolveDidWBADocumentWithOptions(ctx context.Context, did string, verifyProof bool, options DidResolutionOptions) (map[string]any, error)

ResolveDidWBADocumentWithOptions resolves a did:wba document with explicit options.

func UpdateDeviceInDIDDocument added in v0.9.0 

func UpdateDeviceInDIDDocument(
	didDocument map[string]any,
	rootKeyID string,
	device DeviceManifestEntry,
	deviceSigningVerificationMethod map[string]any,
	deviceE2EEVerificationMethod map[string]any,
) (map[string]any, error)

UpdateDeviceInDIDDocument replaces one device's public keys and Profile entry in an unsigned copy.

func ValidateDIDDocumentBinding 

func ValidateDIDDocumentBinding(didDocument map[string]any, verifyProof bool) bool

ValidateDIDDocumentBinding validates did:wba key binding constraints.

func VerifyAuthHeaderSignature 

func VerifyAuthHeaderSignature(authHeader string, didDocument map[string]any, serviceDomain string) error

VerifyAuthHeaderSignature verifies a legacy DIDWba Authorization header.

func VerifyAuthJSONSignature 

func VerifyAuthJSONSignature(authJSON string, didDocument map[string]any, serviceDomain string) error

VerifyAuthJSONSignature verifies a legacy DIDWba JSON payload.

func VerifyContentDigest 

func VerifyContentDigest(body []byte, contentDigest string) bool

VerifyContentDigest verifies a Content-Digest header value.

func VerifyDIDKeyBinding 

func VerifyDIDKeyBinding(did string, bindingMaterial map[string]any) bool

VerifyDIDKeyBinding verifies whether a verification method matches the key-binding suffix.

Types

type AnpMessageServiceOptions 

type AnpMessageServiceOptions struct {
	Fragment         string
	ServiceDID       string
	Profiles         []string
	SecurityProfiles []string
	Accepts          []string
	Priority         *int
	AuthSchemes      []string
}

AnpMessageServiceOptions configures ANPMessageService records.

type AuthMode 

type AuthMode string

AuthMode identifies the client authentication mode. 

const (
	AuthModeHTTPSignatures AuthMode = "http_signatures"
	AuthModeLegacyDidWba   AuthMode = "legacy_didwba"
	AuthModeAuto           AuthMode = "auto"
)

type DIDWbaAuthHeader 

type DIDWbaAuthHeader struct {
	// contains filtered or unexported fields
}

DIDWbaAuthHeader manages outgoing DIDWba and HTTP signature authentication headers.

func NewDIDWbaAuthHeader 

func NewDIDWbaAuthHeader(didDocumentPath string, privateKeyPath string, authMode AuthMode) *DIDWbaAuthHeader

NewDIDWbaAuthHeader creates a new auth header helper.

func (*DIDWbaAuthHeader) ClearAllTokens 

func (h *DIDWbaAuthHeader) ClearAllTokens()

ClearAllTokens clears all cached bearer tokens.

func (*DIDWbaAuthHeader) ClearToken 

func (h *DIDWbaAuthHeader) ClearToken(serverURL string)

ClearToken removes a cached bearer token for the given server.

func (*DIDWbaAuthHeader) GetAuthHeader 

func (h *DIDWbaAuthHeader) GetAuthHeader(serverURL string, forceNew bool, method string, headers map[string]string, body []byte) (map[string]string, error)

GetAuthHeader returns the next outbound authentication headers.

func (*DIDWbaAuthHeader) GetChallengeAuthHeader 

func (h *DIDWbaAuthHeader) GetChallengeAuthHeader(serverURL string, responseHeaders map[string]string, method string, headers map[string]string, body []byte) (map[string]string, error)

GetChallengeAuthHeader returns challenge-specific authentication headers.

func (*DIDWbaAuthHeader) ShouldRetryAfter401 

func (h *DIDWbaAuthHeader) ShouldRetryAfter401(responseHeaders map[string]string) bool

ShouldRetryAfter401 determines whether a 401 response should be retried with a new challenge response.

func (*DIDWbaAuthHeader) UpdateToken 

func (h *DIDWbaAuthHeader) UpdateToken(serverURL string, headers map[string]string) string

UpdateToken stores a bearer token discovered in response headers.

type DeviceManifest added in v0.9.0 

type DeviceManifest struct {
	Type    string                `json:"type"`
	Devices []DeviceManifestEntry `json:"devices"`
}

DeviceManifest is the typed value of a DID document deviceManifest extension.

func ParseDeviceManifest added in v0.9.0 

func ParseDeviceManifest(didDocument map[string]any) (*DeviceManifest, error)

ParseDeviceManifest parses the optional, closed vNext Device Manifest schema. Unknown members elsewhere in didDocument are not interpreted or modified.

func ValidateDeviceManifest added in v0.9.0 

func ValidateDeviceManifest(didDocument map[string]any) (*DeviceManifest, error)

ValidateDeviceManifest parses and validates references, relationships, and dependencies.

func (DeviceManifest) ToMap added in v0.9.0 

func (manifest DeviceManifest) ToMap() map[string]any

ToMap serializes the closed Device Manifest without changing its DID document.

type DeviceManifestEntry added in v0.9.0 

type DeviceManifestEntry struct {
	DeviceID     string   `json:"device_id"`
	SigningKeyID string   `json:"signing_key_id"`
	E2EEKeyID    string   `json:"e2ee_key_id"`
	Profiles     []string `json:"profiles"`
}

DeviceManifestEntry is one public cryptographic device endpoint.

func FindEligibleDevice added in v0.9.0 

func FindEligibleDevice(didDocument map[string]any, deviceID string, requiredProfile string) (*DeviceManifestEntry, error)

FindEligibleDevice returns a validated device that declares requiredProfile.

type DidDocumentBundle 

type DidDocumentBundle struct {
	DidDocument map[string]any                     `json:"did_document"`
	Keys        map[string]anp.GeneratedKeyPairPEM `json:"keys"`
}

DidDocumentBundle stores a generated DID document and its PEM encoded keys.

func CreateDidWBADocument 

func CreateDidWBADocument(hostname string, options DidDocumentOptions) (DidDocumentBundle, error)

CreateDidWBADocument creates a did:wba document and ANP PEM key bundle.

func CreateDidWBADocumentWithKeyBinding deprecated 

func CreateDidWBADocumentWithKeyBinding(hostname string, options DidDocumentOptions) (DidDocumentBundle, error)

Deprecated: Use CreateDidWBADocument with DidDocumentOptions{DidProfile: DidProfileK1} instead. CreateDidWBADocumentWithKeyBinding creates a k1 DID document and injects a path when absent.

type DidDocumentOptions 

type DidDocumentOptions struct {
	Port                *int
	PathSegments        []string
	AgentDescriptionURL string
	Services            []map[string]any
	ProofPurpose        string
	VerificationMethod  string
	Domain              string
	Challenge           string
	Created             string
	EnableE2EE          *bool
	DidProfile          DidProfile
}

DidDocumentOptions configures DID document generation.

type DidProfile 

type DidProfile string

DidProfile identifies the DID profile encoded in a did:wba identifier. 

const (
	DidProfileE1          DidProfile = "e1"
	DidProfileK1          DidProfile = "k1"
	DidProfilePlainLegacy DidProfile = "plain_legacy"
)

type DidResolutionOptions 

type DidResolutionOptions struct {
	TimeoutSeconds  float64
	VerifySSL       *bool
	BaseURLOverride string
	Headers         map[string]string
}

DidResolutionOptions configures DID document resolution.

type DidWbaVerifier 

type DidWbaVerifier struct {
	// contains filtered or unexported fields
}

DidWbaVerifier verifies inbound ANP HTTP requests.

func NewDidWbaVerifier 

func NewDidWbaVerifier(config DidWbaVerifierConfig) *DidWbaVerifier

NewDidWbaVerifier creates a request verifier with defaults.

func (*DidWbaVerifier) VerifyRequest 

func (v *DidWbaVerifier) VerifyRequest(ctx context.Context, method string, requestURL string, headers map[string]string, body []byte, domain string) (VerificationSuccess, error)

VerifyRequest resolves the sender DID and verifies the request.

func (*DidWbaVerifier) VerifyRequestWithDidDocument 

func (v *DidWbaVerifier) VerifyRequestWithDidDocument(method string, requestURL string, headers map[string]string, body []byte, domain string, didDocument map[string]any) (VerificationSuccess, error)

VerifyRequestWithDidDocument verifies a request against an already resolved DID document.

type DidWbaVerifierConfig 

type DidWbaVerifierConfig struct {
	JWTPrivateKey                 string
	JWTPublicKey                  string
	JWTAlgorithm                  string
	AccessTokenExpireMinutes      int
	NonceExpirationMinutes        int
	TimestampExpirationMinutes    int
	AllowedDomains                []string
	AllowHTTPSignatures           *bool
	AllowLegacyDidWba             *bool
	EmitAuthenticationInfoHeader  *bool
	EmitLegacyAuthorizationHeader *bool
	RequireNonceForHTTPSignatures *bool
	DidResolutionOptions          DidResolutionOptions
	ExternalNonceValidator        func(did string, nonce string) bool
}

DidWbaVerifierConfig configures the request verifier.

type DidWbaVerifierError 

type DidWbaVerifierError struct {
	Message    string
	StatusCode int
	Headers    map[string]string
}

DidWbaVerifierError reports request verification failures.

func (*DidWbaVerifierError) Error 

func (e *DidWbaVerifierError) Error() string

Error implements error.

type FederatedVerificationOptions 

type FederatedVerificationOptions struct {
	SenderDidDocument     map[string]any
	ServiceDidDocument    map[string]any
	ServiceID             string
	ServiceEndpoint       string
	VerifySenderDidProof  bool
	VerifyServiceDidProof bool
	DidResolutionOptions  DidResolutionOptions
}

FederatedVerificationOptions configures federated request verification.

type FederatedVerificationResult 

type FederatedVerificationResult struct {
	SenderDID         string            `json:"sender_did"`
	ServiceDID        string            `json:"service_did"`
	ServiceID         string            `json:"service_id"`
	SignatureMetadata SignatureMetadata `json:"signature_metadata"`
}

FederatedVerificationResult describes a verified federated ANP request.

func VerifyFederatedHTTPRequest 

func VerifyFederatedHTTPRequest(ctx context.Context, senderDID string, requestMethod string, requestURL string, headers map[string]string, body []byte, options FederatedVerificationOptions) (FederatedVerificationResult, error)

VerifyFederatedHTTPRequest verifies a service-signed ANP request on behalf of a sender DID.

type HttpSignatureOptions 

type HttpSignatureOptions struct {
	KeyID             string
	Nonce             string
	Created           *int64
	Expires           *int64
	CoveredComponents []string
}

HttpSignatureOptions configures HTTP message signature generation.

type ParsedAuthHeader 

type ParsedAuthHeader struct {
	DID                string `json:"did"`
	Nonce              string `json:"nonce"`
	Timestamp          string `json:"timestamp"`
	VerificationMethod string `json:"verification_method"`
	Signature          string `json:"signature"`
	Version            string `json:"version"`
}

ParsedAuthHeader is the parsed legacy DIDWba authorization header.

func ExtractAuthHeaderParts 

func ExtractAuthHeaderParts(authHeader string) (ParsedAuthHeader, error)

ExtractAuthHeaderParts parses a legacy DIDWba Authorization header.

type SignatureMetadata 

type SignatureMetadata struct {
	Label      string   `json:"label"`
	Components []string `json:"components"`
	KeyID      string   `json:"keyid"`
	Nonce      string   `json:"nonce,omitempty"`
	Created    int64    `json:"created"`
	Expires    *int64   `json:"expires,omitempty"`
}

SignatureMetadata is extracted from Signature-Input and Signature headers.

func ExtractSignatureMetadata 

func ExtractSignatureMetadata(headers map[string]string) (SignatureMetadata, error)

ExtractSignatureMetadata parses signature headers and returns their structured metadata.

func VerifyHTTPMessageSignature 

func VerifyHTTPMessageSignature(didDocument map[string]any, requestMethod string, requestURL string, headers map[string]string, body []byte) (SignatureMetadata, error)

VerifyHTTPMessageSignature verifies HTTP Message Signatures for a DID document.

type VerificationMethod 

type VerificationMethod = vm.VerificationMethod

VerificationMethod re-exports parsed verification methods.

func CreateVerificationMethod 

func CreateVerificationMethod(method map[string]any) (VerificationMethod, error)

CreateVerificationMethod parses a DID verification method entry.

type VerificationMethodError 

type VerificationMethodError = vm.Error

VerificationMethodError re-exports verification method parsing errors.

type VerificationSuccess 

type VerificationSuccess struct {
	DID             string            `json:"did"`
	AuthScheme      string            `json:"auth_scheme"`
	ResponseHeaders map[string]string `json:"response_headers"`
	AccessToken     string            `json:"access_token,omitempty"`
	TokenType       string            `json:"token_type,omitempty"`
}

VerificationSuccess describes a verified inbound request.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.