Documentation
¶
Overview ¶
Package agentaccess is the shared-token access model of a local DataTug agent (`datatug serve`, and the daemon that runs it): loopback plus a token. The agent creates a random secret when it starts and keeps it in the state directory (mode 0600); everything the browser and the CLI need is derived from it:
- the session token, which every route but the preflight and the exchange requires;
- a one-time code, which `datatug daemon url` and `datatug serve` mint locally (no HTTP request, no daemon needed) and put in the fragment of a link, and which the web UI exchanges once for the session token.
A code is `v1.<expiry unix seconds>.<nonce>.<signature>`: signed with the secret, valid for CodeTTL, accepted once. The secret, the token and the codes are never logged.
Index ¶
- Constants
- Variables
- func Apply(req *http.Request)
- func ApplyIn(dir func() string, req *http.Request)
- func KeyPath(dir string, port int) string
- func MintCode(secret []byte, now time.Time) (string, error)
- func NewSecret() ([]byte, error)
- func ReadKey(dir string, port int) ([]byte, error)
- func RemoveKey(dir string, port int)
- func SessionToken(secret []byte) string
- func StateDir() string
- func WriteKey(dir string, port int, secret []byte) error
- type Access
Constants ¶
const ( // CodeTTL is how long a minted code can be exchanged. CodeTTL = 10 * time.Minute // DirEnv overrides the state directory (default ~/datatug/daemon); it is the daemon's own. DirEnv = "DATATUG_DAEMON_DIR" // ExchangePath is the route (under /datatug) that trades a code for the session token. ExchangePath = "/datatug/session/exchange" )
Variables ¶
var ErrBadCode = errors.New("the link code is not valid")
ErrBadCode is the one answer for a code that is malformed, tampered, expired or used.
Functions ¶
func Apply ¶
Apply adds the session token of the local agent that req addresses, when req is for a loopback address and that agent has left its key in the state directory. It is how the CLI's own HTTP clients (and the daemon's probe) talk to an agent that requires the token; any other request is left as it is, so the token never goes to another host.
func MintCode ¶
MintCode returns a one-time code valid for CodeTTL from now. It needs the secret only.
func SessionToken ¶
SessionToken is the token that every route requires, derived from secret.
func StateDir ¶
func StateDir() string
StateDir is the directory holding an agent's access key (and the daemon's record).
Types ¶
type Access ¶
type Access struct {
// contains filtered or unexported fields
}
Access holds the secret of a running agent and the codes it has accepted.
func (*Access) Authorized ¶
Authorized reports whether r carries the session token as `Authorization: Bearer <token>`.
Source Files