token

package

v0.5.0 Latest Latest Go to latest Published: Oct 18, 2026 License: AGPL-3.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/amalychev/devopus-server

Links

Open Source Insights

Documentation ¶

Overview ¶

Package token signs and checks Devopus access tokens: JWTs signed with Ed25519 (alg EdDSA) whose public keys Auth publishes as JWKS. Workspace servers check tokens with a Remote key set, without calling Auth on every request.

Index ¶

Constants
Variables
func Sign(k Key, c Claims) (string, error)
type Claims
- func Verify(tok string, keys KeyFunc, want Expect) (Claims, error)
- func (c Claims) ExpiresAt() time.Time
type Expect
type JWK
- func PublicJWK(k Key) JWK
type JWKS
- func (s JWKS) Find(kid string) (ed25519.PublicKey, error)
type Key
type KeyFunc
type Remote
- func (r *Remote) Key(kid string) (ed25519.PublicKey, error)

Constants ¶

View Source

const DefaultAudience = "devopus"

DefaultAudience is the audience of tokens for Devopus itself rather than one workspace.

Variables ¶

View Source

var (
	ErrMalformed = errors.New("malformed token")
	ErrSignature = errors.New("bad token signature")
	ErrExpired   = errors.New("token expired")
	ErrClaims    = errors.New("token is not for this service")
)

Errors of Verify.

Functions ¶

func Sign ¶

func Sign(k Key, c Claims) (string, error)

Sign makes a signed token.

Types ¶

type Claims ¶

type Claims struct {
	Issuer  string `json:"iss"`
	Subject string `json:"sub"`
	Session string `json:"sid"`
	// Email is the user's email: workspace servers match invites by it.
	Email    string `json:"email,omitempty"`
	Audience string `json:"aud"`
	IssuedAt int64  `json:"iat"`
	Expiry   int64  `json:"exp"`
}

Claims are what an access token says: the user (sub) and the session (sid).

func Verify ¶

func Verify(tok string, keys KeyFunc, want Expect) (Claims, error)

Verify checks a token's signature and claims.

func (Claims) ExpiresAt ¶

func (c Claims) ExpiresAt() time.Time

ExpiresAt is the expiry as a time.

type Expect ¶

type Expect struct {
	Issuer   string
	Audience string
	Now      time.Time
}

Expect is what Verify requires of the claims.

type JWK ¶

type JWK struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	X   string `json:"x"`
	Kid string `json:"kid"`
	Use string `json:"use"`
	Alg string `json:"alg"`
}

JWK is a public Ed25519 key (RFC 8037).

func PublicJWK ¶

func PublicJWK(k Key) JWK

PublicJWK describes the public half of a key.

type JWKS ¶

type JWKS struct {
	Keys []JWK `json:"keys"`
}

JWKS is a key set as Auth publishes it.

func (JWKS) Find ¶

func (s JWKS) Find(kid string) (ed25519.PublicKey, error)

Find returns the key with an id.

type Key ¶

type Key struct {
	ID      string
	Private ed25519.PrivateKey
}

Key is a signing key.

type KeyFunc ¶

type KeyFunc func(kid string) (ed25519.PublicKey, error)

KeyFunc returns the public key with an id.

type Remote ¶

type Remote struct {
	URL    string
	Client *http.Client
	// contains filtered or unexported fields
}

Remote is a key set fetched from Auth's JWKS URL and cached. An unknown key id refetches the set, at most once a minute: that is how new keys after a rotation are picked up.

func (*Remote) Key ¶

func (r *Remote) Key(kid string) (ed25519.PublicKey, error)

Key is a KeyFunc for Verify.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL