Documentation
¶
Index ¶
- Constants
- Variables
- func ConvertCredentialOptions(ctx context.Context, clientSecret *jose.JSONWebKey, opts *v2.CredentialOptions, ...) (*v2.LocalCredentialOptions, error)
- func GeneratePassword(ctx context.Context, credentialOptions *v2.LocalCredentialOptions) (string, error)
- func GenerateRandomPassword(randomPassword *v2.LocalCredentialOptions_RandomPassword) (string, error)
- func ParseClientSecret(input []byte, setKeyID bool) (*jose.JSONWebKey, error)
- func ValidateCredentialOutputCardinality(ec []*v2.EncryptionConfig, count int) error
- func ValidateEncryptionConfigs(ec []*v2.EncryptionConfig) error
- type EncryptionManager
- type PlaintextCredential
Constants ¶
const (
ContextClientSecretKey = key("client-secret-key")
)
Variables ¶
var ErrInvalidClientSecret = errors.New("invalid client secret")
var ErrInvalidCredentialOptions = errors.New("unknown credential options")
var ErrInvalidPasswordLength = errors.New("invalid password length")
Functions ¶
func ConvertCredentialOptions ¶ added in v0.4.0
func ConvertCredentialOptions(ctx context.Context, clientSecret *jose.JSONWebKey, opts *v2.CredentialOptions, encryptionConfigs []*v2.EncryptionConfig) (*v2.LocalCredentialOptions, error)
func GeneratePassword ¶
func GenerateRandomPassword ¶
func GenerateRandomPassword(randomPassword *v2.LocalCredentialOptions_RandomPassword) (string, error)
func ParseClientSecret ¶ added in v0.4.0
func ParseClientSecret(input []byte, setKeyID bool) (*jose.JSONWebKey, error)
func ValidateCredentialOutputCardinality ¶ added in v0.33.0
func ValidateCredentialOutputCardinality(ec []*v2.EncryptionConfig, count int) error
func ValidateEncryptionConfigs ¶ added in v0.20.2
func ValidateEncryptionConfigs(ec []*v2.EncryptionConfig) error
ValidateEncryptionConfigs checks that every supplied encryption config names a recipient that can be encrypted to. IssueCredential calls it before the connector mints, because issuance always returns a plaintext value to encrypt. CreateAccount and RotateCredential call it only when the connector returned at least one plaintext value, so a zero-output operation is not failed by a config it never uses. An empty list is valid; a nil entry, an unknown provider, or a config the provider rejects is not.
Types ¶
type EncryptionManager ¶
type EncryptionManager struct {
// contains filtered or unexported fields
}
func NewEncryptionManager ¶ added in v0.1.19
func NewEncryptionManager(co *v2.CredentialOptions, ec []*v2.EncryptionConfig) (*EncryptionManager, error)
func (*EncryptionManager) Encrypt ¶
func (pkem *EncryptionManager) Encrypt(ctx context.Context, cred *v2.PlaintextData) ([]*v2.EncryptedData, error)
FIXME(morgabra) Be tolerant of failures here and return the encryptions that succeeded. We've likely already done things to generate the credentials we want to encrypt, so we should still return the created objects even if your encryption provider is misconfigured.
Source Files
Directories