token

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: AGPL-3.0 Imports: 10 Imported by: 0

Documentation

Overview

Package token signs and checks Devopus access tokens: JWTs signed with Ed25519 (alg EdDSA) whose public keys Auth publishes as JWKS. Workspace servers check tokens with a Remote key set, without calling Auth on every request.

Index

Constants

View Source 
const DefaultAudience = "devopus"

DefaultAudience is the audience of tokens for Devopus itself rather than one workspace.

Variables

View Source 
var (
	ErrMalformed = errors.New("malformed token")
	ErrSignature = errors.New("bad token signature")
	ErrExpired   = errors.New("token expired")
	ErrClaims    = errors.New("token is not for this service")
)

Errors of Verify.

Functions

func Sign 

func Sign(k Key, c Claims) (string, error)

Sign makes a signed token.

Types

type Claims 

type Claims struct {
	Issuer  string `json:"iss"`
	Subject string `json:"sub"`
	Session string `json:"sid"`
	// Email is the user's email: workspace servers match invites by it.
	Email    string `json:"email,omitempty"`
	Audience string `json:"aud"`
	IssuedAt int64  `json:"iat"`
	Expiry   int64  `json:"exp"`
}

Claims are what an access token says: the user (sub) and the session (sid).

func Verify 

func Verify(tok string, keys KeyFunc, want Expect) (Claims, error)

Verify checks a token's signature and claims.

func (Claims) ExpiresAt 

func (c Claims) ExpiresAt() time.Time

ExpiresAt is the expiry as a time.

type Expect 

type Expect struct {
	Issuer   string
	Audience string
	Now      time.Time
}

Expect is what Verify requires of the claims.

type JWK 

type JWK struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	X   string `json:"x"`
	Kid string `json:"kid"`
	Use string `json:"use"`
	Alg string `json:"alg"`
}

JWK is a public Ed25519 key (RFC 8037).

func PublicJWK 

func PublicJWK(k Key) JWK

PublicJWK describes the public half of a key.

type JWKS 

type JWKS struct {
	Keys []JWK `json:"keys"`
}

JWKS is a key set as Auth publishes it.

func (JWKS) Find 

func (s JWKS) Find(kid string) (ed25519.PublicKey, error)

Find returns the key with an id.

type Key 

type Key struct {
	ID      string
	Private ed25519.PrivateKey
}

Key is a signing key.

type KeyFunc 

type KeyFunc func(kid string) (ed25519.PublicKey, error)

KeyFunc returns the public key with an id.

type Remote 

type Remote struct {
	URL    string
	Client *http.Client
	// contains filtered or unexported fields
}

Remote is a key set fetched from Auth's JWKS URL and cached. An unknown key id refetches the set, at most once a minute: that is how new keys after a rotation are picked up.

func (*Remote) Key 

func (r *Remote) Key(kid string) (ed25519.PublicKey, error)

Key is a KeyFunc for Verify.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.