Documentation
¶
Overview ¶
Package client is the holder's side of an API key: the assertion it signs with the private half of a key its account registered, wherever that half is kept -- a file, a key manager, a TPM, anything a crypto.Signer reaches -- and the exchange of the assertion for a session token at the login service's token endpoint.
The assertion is the one package assertion verifies: RFC 7523's shape, typed "api-key+jwt", naming the key by its RFC 7638 thumbprint in "iss" and "sub", bound to the login service by "aud", good for a minute, and new every time by its "jti".
Index ¶
Constants ¶
const AssertionLifetime = time.Minute
AssertionLifetime is how long an assertion is good for: one request's worth, well inside what the service accepts.
const TokenPath = "/api/token"
TokenPath is where the login service exchanges an assertion for a token.
Variables ¶
var ErrRefused = errors.New("the login service refused the assertion")
ErrRefused is the login service's refusal of an assertion, or an answer with no token in it.
Functions ¶
Types ¶
type Source ¶
type Source struct {
Signer crypto.Signer
Service *url.URL
HttpClient *http.Client
// Margin is how long before its end a token is no longer handed out; a minute if not given.
Margin time.Duration
// Now is the clock; time.Now if not given.
Now func() time.Time
// contains filtered or unexported fields
}
Source is a token kept until near its end and minted again then: what a job that calls a service now and again holds rather than minting for every call.
Source Files