Documentation
¶
Overview ¶
Package security provides the SecretRotator, a port of Etherpad's src/node/security/SecretRotator.ts. It maintains an array of secrets across one or more Etherpad instances sharing the same database, periodically rotating in a new secret and removing the oldest secret.
The secrets are generated using a key derivation function (HKDF) with input keying material coming from a long-lived secret stored in the database (generated if missing). The first secret in the array is the one that should be used to generate new MACs/signatures; every secret in the array should be accepted when validating an existing MAC/signature.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type SecretRotator ¶
type SecretRotator struct {
// contains filtered or unexported fields
}
SecretRotator maintains a rotating array of secrets persisted in the database.
func NewSecretRotator ¶
func NewSecretRotator(store SecretStore, prefix string, interval, lifetime time.Duration, legacyStaticSecret *string, logger *zap.SugaredLogger) *SecretRotator
NewSecretRotator creates a rotator. interval is how often a new secret is rotated in; lifetime is how long after the end of an interval a secret stays usable. legacyStaticSecret, if non-nil, covers the period before the first rotated secret to ease migration from a previously static secret.
func (*SecretRotator) OnRotate ¶
func (r *SecretRotator) OnRotate(fn func())
OnRotate registers a callback invoked after every successful update (initial and each rotation). Must be set before Start.
func (*SecretRotator) Secrets ¶
func (r *SecretRotator) Secrets() [][]byte
Secrets returns a snapshot of the active secrets. The first entry is the one to use for generating new MACs/signatures; all entries are valid for verification.
func (*SecretRotator) Start ¶
func (r *SecretRotator) Start() error
Start performs the first update synchronously (so Secrets is populated before use) and schedules subsequent rotations.
type SecretStore ¶
type SecretStore interface {
SaveSecretParams(id string, prefix string, payload string) error
ListSecretParams(prefix string) (map[string]string, error)
DeleteSecretParams(id string) error
}
SecretStore is the persistence contract backing the rotator. *db.DataStore satisfies it through the dedicated secret_rotation table.
Source Files