Documentation
¶
Overview ¶
Package embedded implements the default, SPIFFE-shaped JWT-SVID identity provider satisfying identity.Provider. It mints short-lived ES256 JWTs whose subject path is spiffe://<trust-domain>/agent-run/<run-id>, carrying the full delegation chain (human sub, agent-run act, sponsor) for attribution.
INVARIANT (Confinement gating): this provider REFUSES to mint identities for runs whose grants include types.GrantCloudSTS — cloud STS federation hard-requires the spire provider. Callers MUST invoke CheckGrants before mint; ErrRequiresSPIRE is the typed refusal.
All security decisions fail closed: signature, expiry, audience, and revocation are each independently verified, and any RevocationStore error is treated as revoked.
Index ¶
- Constants
- Variables
- type MemRevocationStore
- type Provider
- func (p *Provider) CheckGrants(grants []types.GrantSpec) error
- func (p *Provider) MintRunIdentity(ctx context.Context, runID uuid.UUID, humanSub, sponsor, audience string) (identity.RunIdentity, error)
- func (p *Provider) Name() string
- func (p *Provider) RevokeRun(ctx context.Context, runID uuid.UUID) error
- func (p *Provider) Verify(ctx context.Context, token, expectedAudience string) (*identity.Claims, error)
- type RevocationStore
Constants ¶
const (
// DefaultTrustDomain is used when New is given an empty trust domain.
DefaultTrustDomain = "wardyn.local"
)
Variables ¶
var ErrRequiresSPIRE = errors.New("embedded identity: cloud_sts grant requires the spire identity provider")
ErrRequiresSPIRE is the typed refusal returned by CheckGrants (and MintRunIdentity) when a run's grants include types.GrantCloudSTS. cloud_sts hard-requires the spire provider; the embedded provider must never mint for it.
Functions ¶
This section is empty.
Types ¶
type MemRevocationStore ¶
type MemRevocationStore struct {
// contains filtered or unexported fields
}
MemRevocationStore is an in-memory RevocationStore for tests.
func NewMemRevocationStore ¶
func NewMemRevocationStore() *MemRevocationStore
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is the embedded JWT-SVID identity.Provider.
func New ¶
func New(signKey *ecdsa.PrivateKey, trustDomain string, revocations RevocationStore, rec audit.Recorder) (*Provider, error)
New constructs the embedded provider. If signKey is nil a fresh ECDSA P-256 key is generated. trustDomain may be empty (defaults to DefaultTrustDomain). The RevocationStore and audit.Recorder are required.
func (*Provider) CheckGrants ¶
CheckGrants returns ErrRequiresSPIRE if any grant requires the spire provider (currently: cloud_sts). The broker/API MUST call this before mint.
func (*Provider) MintRunIdentity ¶
func (p *Provider) MintRunIdentity(ctx context.Context, runID uuid.UUID, humanSub, sponsor, audience string) (identity.RunIdentity, error)
MintRunIdentity issues a 1h ES256 JWT-SVID for runID. humanSub is the human principal; sponsor is the accountable owner (defaults to humanSub when empty); audience binds the token (RFC 8707). It emits an identity.mint audit event (actor_type system).
func (*Provider) RevokeRun ¶
RevokeRun invalidates ALL identities for a run (kill-switch cascade) and emits an identity.revoke audit event (actor_type system).
func (*Provider) Verify ¶
func (p *Provider) Verify(ctx context.Context, token, expectedAudience string) (*identity.Claims, error)
Verify authenticates a presented token and returns its claims. It validates, independently and failing closed: ES256 signature, expiry/nbf, audience, and revocation. A RevocationStore error is treated as revoked.
type RevocationStore ¶
type RevocationStore = identity.RevocationStore
RevocationStore is the embedded provider's revocation contract. It aliases identity.RevocationStore (the generic kill-switch denylist) so the identity seam's Deps can carry it without importing this package. The pg-backed implementation lives in the control plane; MemRevocationStore (below) is the in-memory one for tests. All reads fail closed at the call site (Verify treats any IsRevoked error as revoked).
Source Files