Documentation
¶
Index ¶
- Variables
- func Decrypt(gcm cipher.AEAD, encoded string) ([]byte, error)
- func DeriveSharedKey(privateKey *ecdh.PrivateKey, peerPublicKeyB64, info string) (cipher.AEAD, error)
- func Encrypt(gcm cipher.AEAD, plaintext []byte) (string, error)
- func EnsureKeyPair(dir string) (string, error)
- func GenerateAuthToken() (string, error)
- func GenerateChallenge() ([]byte, error)
- func IsValidP256Point(raw []byte) bool
- func LoadPrivateKey(dir string) (*ecdh.PrivateKey, error)
- func SHA256Sum(data []byte) [32]byte
- func ValidateTokenRemote(baseURL, token string) error
- func VerifyPasskeyAssertion(allowedKey, challenge, authenticatorData, clientDataJSON, signature []byte, ...) error
- type AuthCache
- type ChallengeCache
- type DeviceCodeResponse
- type DeviceToken
- type PasskeyPolicy
- type TokenResponse
- type TokenStore
- type UserInfo
Constants ¶
This section is empty.
Variables ¶
var ErrAuthFailed = errors.New("authentication failed")
ErrAuthFailed is returned when the relay rejects a token with 401.
Functions ¶
func DeriveSharedKey ¶
func DeriveSharedKey(privateKey *ecdh.PrivateKey, peerPublicKeyB64, info string) (cipher.AEAD, error)
DeriveSharedKey performs X25519 ECDH + HKDF to produce an AES-256-GCM key. The info parameter differentiates key domains (e.g. "wt-pty" for PTY sessions, "wt-tunnel" for the encrypted tunnel).
func Encrypt ¶
Encrypt encrypts plaintext with AES-256-GCM and returns base64(iv || ciphertext || tag).
func EnsureKeyPair ¶
EnsureKeyPair loads or generates an X25519 keypair. Returns the base64-encoded public key. Private key is stored in dir/wing_key.
func GenerateAuthToken ¶ added in v0.34.0
GenerateAuthToken returns a random hex-encoded auth token (32 bytes).
func GenerateChallenge ¶ added in v0.34.0
GenerateChallenge returns 32 random bytes for a passkey challenge.
func IsValidP256Point ¶ added in v0.34.0
IsValidP256Point checks if 64 raw bytes (X||Y) represent a valid point on the P-256 curve.
func LoadPrivateKey ¶
func LoadPrivateKey(dir string) (*ecdh.PrivateKey, error)
LoadPrivateKey loads the X25519 private key from disk.
func ValidateTokenRemote ¶ added in v0.107.0
ValidateTokenRemote checks a device token against the relay's /auth/check endpoint. Returns nil on 200 (valid), ErrAuthFailed on 401, or a wrapped error for network failures.
func VerifyPasskeyAssertion ¶ added in v0.34.0
func VerifyPasskeyAssertion(allowedKey, challenge, authenticatorData, clientDataJSON, signature []byte, policy PasskeyPolicy) error
VerifyPasskeyAssertion verifies a WebAuthn assertion using a raw P-256 public key (64 bytes: X||Y). In addition to the signature and challenge it validates the relying-party hash, browser origin, ceremony type, user presence, and (when requested) user verification.
Types ¶
type AuthCache ¶ added in v0.34.0
type AuthCache struct {
// contains filtered or unexported fields
}
AuthCache caches passkey auth tokens in memory. Boot-scoped: tokens are valid until the wing process dies. Restart revokes everything. An optional TTL can further limit token lifetime (0 means no expiry).
func NewAuthCache ¶ added in v0.34.0
func NewAuthCache() *AuthCache
NewAuthCache creates a new boot-scoped in-memory auth cache.
type ChallengeCache ¶ added in v0.144.0
type ChallengeCache struct {
// contains filtered or unexported fields
}
ChallengeCache stores one-time, wing-generated WebAuthn challenges. Consume deletes a challenge even when the supplied subject is wrong, preventing an intercepted challenge identifier from becoming an authentication oracle.
func NewChallengeCache ¶ added in v0.144.0
func NewChallengeCache() *ChallengeCache
type DeviceCodeResponse ¶
type DeviceCodeResponse struct {
DeviceCode string `json:"device_code"`
UserCode string `json:"user_code"`
VerificationURL string `json:"verification_url"`
ExpiresIn int `json:"expires_in"`
Interval int `json:"interval"`
}
func RequestDeviceCode ¶
func RequestDeviceCode(baseURL, wingID string, publicKey ...string) (*DeviceCodeResponse, error)
type DeviceToken ¶
type DeviceToken struct {
Token string `json:"token" yaml:"device_token"`
ExpiresAt int64 `json:"expires_at" yaml:"expires_at"`
IssuedAt int64 `json:"issued_at" yaml:"issued_at"`
DeviceID string `json:"device_id" yaml:"device_id"`
PublicKey string `json:"public_key,omitempty" yaml:"public_key,omitempty"`
UserID string `json:"user_id,omitempty" yaml:"user_id,omitempty"`
}
type PasskeyPolicy ¶ added in v0.144.0
PasskeyPolicy defines the relying-party properties a wing requires from a WebAuthn assertion. These values are derived from the configured roost, not accepted from the browser or relay.
type TokenResponse ¶
type TokenResponse struct {
Token string `json:"token"`
ExpiresAt int64 `json:"expires_at"`
Error string `json:"error,omitempty"`
DisplayName string `json:"display_name,omitempty"`
Email string `json:"email,omitempty"`
Provider string `json:"provider,omitempty"`
}
func PollForToken ¶
func RefreshToken ¶
func RefreshToken(baseURL string, token DeviceToken) (*TokenResponse, error)
type TokenStore ¶
type TokenStore struct {
Dir string
// contains filtered or unexported fields
}
func NewLocalTokenStore ¶ added in v0.145.0
func NewLocalTokenStore(dir string) *TokenStore
NewLocalTokenStore keeps the credential minted by `wt serve --local` separate from the profile's ordinary hosted/private-roost login. Local serve is a second authority, not a reason to destroy the user's existing login.
func NewTokenStore ¶
func NewTokenStore(dir string) *TokenStore
func (*TokenStore) Delete ¶
func (s *TokenStore) Delete() error
func (*TokenStore) IsValid ¶
func (s *TokenStore) IsValid(token *DeviceToken) bool
func (*TokenStore) Load ¶
func (s *TokenStore) Load() (*DeviceToken, error)
func (*TokenStore) Save ¶
func (s *TokenStore) Save(token *DeviceToken) error
type UserInfo ¶ added in v0.114.0
type UserInfo struct {
UserID string `json:"user_id"`
DisplayName string `json:"display_name"`
Email string `json:"email"`
Provider string `json:"provider"`
}
UserInfo represents the authenticated user's identity from the relay.
func FetchUserInfo ¶ added in v0.114.0
FetchUserInfo calls /auth/check and returns the authenticated user's identity. Returns ErrAuthFailed on 401, or a wrapped error for network failures.
Source Files