Documentation
¶
Overview ¶
Package keys provides RSA key management for the Transaction Token Service. It handles key generation, rotation, and serving public keys via a JWKS endpoint.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type JWKSet ¶
type JWKSet struct {
Keys []PublicKey `json:"keys"`
}
JWKSet is a JSON Web Key Set (RFC 7517).
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager handles RSA key lifecycle: generation, rotation, and public key serving. It maintains a current signing key and optionally a previous key for graceful rotation.
func NewManager ¶
NewManager creates a new key manager with an initial RSA key pair.
func (*Manager) JWKSHandler ¶
JWKSHandler returns an HTTP handler that serves the JWKS endpoint.
func (*Manager) PublicKeys ¶
PublicKeys returns the public keys (current + previous if present) for JWKS serving.
func (*Manager) Rotate ¶
Rotate generates a new key pair, making the current key the previous one. The previous key is kept for one rotation cycle to allow in-flight token verification.
func (*Manager) SigningKey ¶
func (m *Manager) SigningKey() (*rsa.PrivateKey, string)
SigningKey returns the current RSA private key and its key ID.
Source Files