confirmation

May 12, 2026

Changes in this version

+ const DefaultTTL

+ const EnvVarTokenSecret

+ const EnvVarTokenTTL

+ const EnvVarTokensEnabled

+ const MaxTokenTTL

+ const MinSecretBytes

+ const MinTokenTTL

+ const TokenVersion

+ var ErrHostedSecretRequired = errors.New(...)

+ var ErrSecretTooShort = errors.New("confirmation token secret too short")

+ var ErrTokenBindingMismatch = errors.New("confirmation token binding mismatch")

+ var ErrTokenExpired = errors.New("confirmation token expired")

+ var ErrTokenMalformed = errors.New("confirmation token malformed")

+ var ErrTokenSignatureMismatch = errors.New("confirmation token signature mismatch")

+ var ErrTokenVersionUnsupported = errors.New("confirmation token version unsupported")

+ var FingerprintExcludedKeys = []string

+ func BuildArgumentFingerprint(args map[string]any) string

+ func NewRandomSecret() ([]byte, error)

+ type Config struct

+ Enabled bool

+ Ephemeral bool

+ Secret []byte

+ TTL time.Duration

+ type LoadResult struct

+ Config Config

+ Notes []string

+ func ConfigFromEnv(hosted bool) (LoadResult, error)

+ type MintInput struct

+ ArgsHash string

+ RiskClass uint32

+ Session string

+ Subject string

+ Tenant string

+ Tool string

+ type Signer struct

+ func NewSigner(cfg Config) (*Signer, error)

+ func (s *Signer) Mint(in MintInput) (token string, expiresAt time.Time, err error)

+ func (s *Signer) TTL() time.Duration

+ func (s *Signer) Verify(in VerifyInput) (TokenClaims, error)

+ type TokenClaims struct

+ ArgsHash string

+ Expires int64

+ Nonce string

+ RiskClass uint32

+ Session string

+ Subject string

+ Tenant string

+ Tool string

+ Version int

+ type VerifyInput struct

+ ArgsHash string

+ RiskClass uint32

+ Session string

+ Subject string

+ Tenant string

+ Token string

+ Tool string