postgres

package module
v0.0.0-...-4801d79 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 24, 2026 License: MIT Imports: 23 Imported by: 0

README

PostgreSQL WebAuthn adapter

This optional module implements the root WebAuthn store using the public identity coordinator, existing protocol migrations and native audit/outbox contributors. The caller owns pool lifetime and migration installation.

Native passkey owners can borrow protocol persistence inside their existing Work through registration participation and identified assertion participation. These explicit opaque participants do not independently commit, authenticate an identity or replace the parent's current authority and session workflow. Standalone store APIs retain their existing behavior.

All native registration/signup, identified/preauthentication, discovery, update, session-enrollment and removal-assertion participants accept the root verifier's ES256 or Ed25519 profiles, including an explicit ordered allowlist containing both. Nil remains the legacy ES256-only profile; empty lists, duplicates, RSA and unknown algorithms deny. The root still owns COSE/key/signature verification; the participant requires the verified credential's algorithm to belong to the original ceremony and never changes its algorithm during assertion finalization. Profile order and nil/explicit representation remain part of the original intent, command digest and recovery identity. Changing the root's selected profile cannot reinterpret an in-flight ceremony. These additive selections require no schema migration and grant no parent identity/session authority.

Session-bound additional enrollment explicitly selects three profiles, all self-human, owner passkey, schema version 1 and required record:

Selector Canonical operation / schema suffix Lifecycle (0 to 1, index 0)
EnrollmentAssertionCreation identity.passkey.register-options.session-assertion-options-v1 passkey.reauthentication.started.v1
EnrollmentAuthorization identity.passkey.register-options.session-registration-options-v1 passkey.registration.started.v1
SessionRegistrationFinalization identity.passkey.register-verify.session-registration-v1 identity.passkey.create_credential

The first two share canonical operation identity.passkey.register-options but require distinct original request identities. The last uses canonical single-use identity.passkey.register-verify. No sign-in participant is admitted. For each participant append Fields, call Validate during plan preparation, then Apply and final Check with the actual parent and its existing Work. Generate options once after acknowledged reservation, before opening Work; defer Discard. Return Result only from the actual acknowledged parent receipt.

Inside the real root Store.FinalizeAssertion callback, call the same root service's BeginRegistration. Its Store.CreateCeremony callback supplies the genuine opaque assertion transition and genuine opaque creation together to EnrollmentAuthorization. Both must share the exact current invocation context, user handle, RP/version and origin. The original assertion ceremony remains A; the new registration ceremony belongs to B's command. The compound stages source consumption, counter/version changes, registration creation and one recoverable protocol effect inside the parent's sole Work. Its Result returns the original registration record/challenge and assertion credential together, never a newly constructed verifier result or a separately committed proof.

EnrollmentAuthorization.AuthorizationExpiresAt is the genuine original A expiry, not the later registration TTL. Migration 5 stores that ceiling and exact source/effect linkage separately from immutable root ceremony JSON. Finalization and final precommit enforce it even while the registration ceremony itself is still live. Legacy password/signup/standalone finalization cannot consume a ceiling-bound ceremony; the session selector cannot consume a legacy ceremony. RecoverEnrollment runs only inside the original parent's recovery Work; pending journals with any effect remain unknown. Recovery/retry must use the parent coordinator's original metadata and never regenerate or reveal options. The parent still owns original session/action commitment, CSRF, current directory/passkey/MFA/policy/risk admission, mappings, labels and lifecycle.

Store.UpdateAssertionCreation and Store.UpdateAssertionFinalization explicitly select the self-human identified ES256/Ed25519 UV assertion participant for passkey rename. Both phases use the protected identity.passkey.update action. Options require schema identity.passkey.update.options-v1 and lifecycle passkey.reauthentication.started.v1 from 0 to 1. Finalization requires identity.passkey.update with schema identity.passkey.update.assertion-v1, both version 1 with a required record, and lifecycle identity.passkey.rename_credential from metadata version N>0 to N+1. Both use event index 0. These metadata versions are independent of protocol counter versions. Existing sign-in participants and recovery reject these selected profiles; RecoverUpdateAssertion accepts only their original parent's recovery Work. Append Fields, invoke Validate, Apply and final Check, then release Result only from the actual acknowledged parent commit, as for sign-in. The parent must bind the original passkey session, target reference/version/name, CSRF, current session/MFA/passkey/directory/policy and risk, and perform the metadata mutation in that same Work. This protocol seam grants none of that authority and creates no new proof, journal, store or schema migration.

The parent must preserve original-command binding, final precommit checks, acknowledged-result ordering and original recovery. Unknown outcomes and replays return no new challenge or verification. Install the identity, audit, outbox and complete protocol histories before selecting composition. This adapter revision requires forward migration 5 before use, including retained enrollment/discovery; older binaries remain compatible with the populated forward schema.

Store.SignupRegistrationCreation(creation, originalFlowID) and Store.SignupRegistrationFinalization(transition, originalFlowID) lend the existing registration participant types to the exact anonymous identity.passkey.register-options.signup-v1 and identity.passkey.register-verify.signup-v1 parents. The root protocol context keeps a trusted preallocated prospective user ID, configured service actor and empty anonymous-flow field. The parent instead has empty UserID, the original anonymous flow, service-account actor, and a text registration.user field equal to that prospective ID. Append the participant's Fields as well; its domain-separated digest fixes the original flow and complete opaque protocol input. This is not authentication or permission to create an account.

Options retain only the bounded protocol ceremony and parent effects, without creating an identity, stable user handle, credential or session. For verified registration, the native parent must create the actual active identity in the same Work before participant Apply. The participant consumes only the exact stored original flow/prospective ID and immutable root ceremony, promotes its pending association once to the existing FK-backed user association, and binds the RP-wide stable handle and credential. Final Check repeats the stored-flow, consumption, current-active-user and original-expiry fences. Any error must abort the complete Work. Parent risk, pre-auth consumption, identity/MFA/authorization initialization, session issuance, remember policy and signup authorization remain required; the protocol participant supplies none of those effects.

RecoverRegistration accepts either the retained exact self-user enrollment or the exact anonymous signup parent inside its original recovery invocation. Unknown outcomes and historical committed recovery do not reveal a challenge, reissue verification or authenticate a user. Existing RegistrationCreation / RegistrationFinalization methods continue to select only .native-v1 self-user enrollment.

Store.CredentialRemoval(RemovalRequest) lends the exact self-user native identity.passkey.delete command a serial-use protocol participant. Append its Fields to the original command, invoke Validate during plan admission, and invoke Apply and final Check with the actual registered parent and sole Work. The parent owns authorization, explicit fresh proof, passkey metadata, credential/reference and authority version changes, and affected sessions; this seam alone is not an authenticated deletion workflow. Its canonical lifecycle is identity.passkey.remove_credential; the parent reference version and the request's optimistic protocol version are independent. Every participant error must propagate and abort the complete parent Work.

Removal increments the protocol version and erases the stored public key, retaining the credential row and RP-wide credential/handle reservations. This terminal record is not returned as a usable credential. Old verifier queries also receive no usable key, and their existing version/record comparisons fence previously loaded assertions. Current identified/discoverable lookups additionally deny retained assertion snapshots after removal. Authenticators may retain their local passkey; server removal does not erase an authenticator.

Restart recovery uses Store.RecoverRemoval inside the original parent's RecoveryWork, alongside every other owner. The existing command-linked protocol effect is atomic with removal and must be retained for at least the kernel journal's lifetime. No marker proves only this original command did not remove; a marker beside a pending journal remains unknown. Only an actual committed kernel receipt establishes historical success, never today's row. Recovery does not renew proof or authorize reexecution. No migration is added; installed migration history remains unchanged.

Current-passkey-session removal participation

Install additive migration 6 before selecting RemovalAssertionCreation or RemovalAssertionFinalization. Migrations 1–5 and existing password-proof CredentialRemoval participation are unchanged. Removal options select canonical identity.passkey.delete with schema identity.passkey.delete.options-v1 and passkey.reauthentication.started.v1 lifecycle 0-to-1. Completion selects the same operation with schema identity.passkey.delete.assertion-v1 and canonical identity.passkey.remove_credential reference N-to-N+1 lifecycle. Signin, rename, enrollment and password-proof profiles cannot substitute for these.

Store.RemovalAssertionCreation(CeremonyCreation) returns the existing serial-use AssertionCreation contract. Store.RemovalAssertionFinalization( AssertionTransition, RemovalRequest) accepts only a genuine root-verified identified self-user assertion and the original target protocol version. Append its Fields, admit Validate, then call Apply and final Check with the actual native parent and sole Work. It consumes the original removal ceremony, advances the source counter/backup/version, and erases the target key atomically. If source and target match, the verified V-to-V+1 successor alone supplies the removal CAS, yielding a terminal V+2 record. Otherwise the source remains the exact live verified successor and the target has an independent terminal CAS. Both paths preserve RP-wide credential and user-handle reservations. The single original-parent effect row retains both bounded snapshots; all final checks retain the source assertion's original absolute expiry, never a renewed lease.

After the actual acknowledged parent commit, Result returns exactly the root verifier's original After once, not the terminal target. That output is historical protocol evidence, not current credential admission or a session. Unknown, failed and replayed invocations release no verification. Use RecoverRemovalAssertion only inside the original parent's RecoveryWork; effect absence is noncommit evidence, while any effect beneath a pending journal remains unknown. Retain these effects at least as long as the parent journal. A deleted source must not be resurrected from retained snapshots for reverification; the parent recovers the original command instead.

The native parent still owns original session/action/target binding, current session, CSRF, policy, risk, MFA/directory admission, remaining usable key, credential-reference/mapping/generation changes and lifecycle finalization. This participant supplies none of those permissions or effects and never opens, commits, retains or replaces the parent's Work.

For a native-selected remaining key, call the compound participant's CheckRemainingCredential(ctx, work, owner, command, credentialID) after Apply and again during final precommit. It derives scope and handle from the genuine source, rejects the removed target, and locks the current credential plus its RP/handle and retained original resident-required registration provenance through Work completion. Only immutable registered ID/key/algorithm/handle may match; current counters and versions may advance. Erased/exhausted credentials deny, including a maximum non-backup counter that cannot advance. A completed registration ceremony's expiry is historical, not a credential expiry. Signup and self-user registration retain their different original subject namespaces. The returned snapshot is public protocol metadata, not recovery permission: the native owner still checks its selected algorithms, original candidate binding, active mapping/reference and current kernel authority. Retain original registration effects and consumed ceremony records for as long as their credentials can serve this selected remaining-key profile. Missing provenance fails closed; browser-reported credProps alone grants no residency.

Documentation

Overview

Package postgres supplies the real PostgreSQL participant for the selected WebAuthn ceremony profile. identity/postgres remains the sole coordinator.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AssertionCreation 

type AssertionCreation struct {
	// contains filtered or unexported fields
}

AssertionCreation is one serial-use protocol participant for the native passkey signin-options owner or explicitly selected update-options profile. Copies share generation/reveal custody and must not run concurrently. It never reserves, opens, commits or retains Work. Parent current-authority, risk, mapping and session admission remain required. Zero values deny and no goroutine or pool lifetime is owned.

func (*AssertionCreation) Apply 

func (p *AssertionCreation) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply stages protocol creation and original parent-bound native effects in this exact parent's active Work. Existing native helpers own RP/handle and current-user constraints. Errors must abort every parent and protocol effect.

func (*AssertionCreation) Check 

func (p *AssertionCreation) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats current-user and absolute-expiry fences in the parent's final precommit invocation. Parent identity/factor/risk/session checks remain owned by that parent and original validity must not be renewed.

func (*AssertionCreation) Discard 

func (p *AssertionCreation) Discard()

Discard clears all unreleased challenge aliases and is idempotent. The parent must defer it across abandonment, cancellation, errors and panics.

func (*AssertionCreation) Fields 

func (p *AssertionCreation) Fields() ([]identity.FeatureField, error)

Fields binds the complete original command/tenant/user/actor, RP/version, origin, handle, allowed credentials and selected algorithm intent. The owned digest belongs in the parent's original command; it is not authorization.

func (AssertionCreation) Format 

func (AssertionCreation) Format(s fmt.State, _ rune)

Format redacts all retained ceremony, original command and challenge state.

func (*AssertionCreation) Generate 

func (p *AssertionCreation) Generate(ctx context.Context, now time.Time) error

Generate runs once after acknowledged new parent reservation and before Work opens, using the original primary database clock sample. Replay/recovery must not call it. Challenge custody remains unavailable until acknowledged Result.

func (AssertionCreation) MarshalJSON 

func (AssertionCreation) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of invocation and challenge custody.

func (*AssertionCreation) Result 

func (p *AssertionCreation) Result(r identity.CommandResult) (webauthn.CeremonyRecord, webauthn.Challenge, error)

Result transfers challenge custody only once for this newly applied, acknowledged final parent commit. Unknown/failure/replay release nothing and permanently discard unreleased entropy. The native parent must pass its actual coordinator receipt after commit, never a caller-created projection.

func (*AssertionCreation) Validate 

func (p *AssertionCreation) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate is bounded pure original-intent validation for the parent's actual ValidateFeatureCommand. It generates no entropy and admits no authority.

type AssertionFinalization 

type AssertionFinalization struct {
	// contains filtered or unexported fields
}

AssertionFinalization retains one genuine root verifier-issued identified assertion transition for the native signin-verify or selected update owner. It cannot construct VerifiedAssertion or authenticate an identity. The root verifier may report protocol success only after the parent's actual final commit is acknowledged. Copies share serial-use result custody; zero values deny.

func (*AssertionFinalization) Apply 

func (p *AssertionFinalization) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply consumes the exact verified ceremony and stages its counter/backup/ version CAS with the parent's metadata/session effects. It never starts or commits a second transaction or reports provisional verification.

func (*AssertionFinalization) Check 

func (p *AssertionFinalization) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check preserves original verified ceremony limits in final precommit. It cannot be invoked through foreign, returned, closed or expired Work handles.

func (*AssertionFinalization) Fields 

func (p *AssertionFinalization) Fields() ([]identity.FeatureField, error)

Fields additionally binds the exact verified response and original optimistic counter/backup/version transition, without retaining browser response bytes in the parent command. The returned owned digest must not be logged.

func (AssertionFinalization) Format 

func (AssertionFinalization) Format(s fmt.State, _ rune)

Format redacts provisional verification and correlated original command state.

func (AssertionFinalization) MarshalJSON 

func (AssertionFinalization) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of provisional verifier custody.

func (*AssertionFinalization) Result 

func (p *AssertionFinalization) Result(r identity.CommandResult) (webauthn.Credential, error)

Result returns finalized protocol credential state only once to the real root verifier. It is not identity authentication. Unknown/replay never issue verification, and the parent must supply its actual final committed receipt.

func (*AssertionFinalization) Validate 

func (p *AssertionFinalization) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate requires the exact selected parent and immutable original verified transition. It does no IO, mutation or authentication.

type Config 

type Config struct {
	Coordinator   kernel.CoordinatorConfig
	PolicyID      string
	PolicyVersion uint64
}

Config freezes the existing journal's key, lease, query authorization and operation policy. QueryPolicy is mandatory for original-command recovery. This first native profile owns schema webauthn and rejects shared RP tenancy.

func (Config) Format 

func (Config) Format(s fmt.State, _ rune)

type CredentialRemoval 

type CredentialRemoval struct {
	// contains filtered or unexported fields
}

CredentialRemoval is a serial-use protocol participant in the native delete parent's sole Work. Copies share invocation state. It owns no transaction, goroutine, proof, ceremony, session or passkey authority. The parent must admit those actual owners, apply this participant, and call Check before committing. Every returned error must propagate and abort the parent's complete Work. Zero values deny; no credential or authentication result is released.

func (*CredentialRemoval) Apply 

func (p *CredentialRemoval) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply locks the exact active protocol row and replaces only its key/version with a terminal denied successor. RP-wide ID and handle reservations remain. All protocol effects and parent effects roll back through the sole Work.

func (*CredentialRemoval) Check 

func (p *CredentialRemoval) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats exact successor and active-subject/mapping fences in the parent's final precommit invocation. Another staged mutation cannot replace this denied successor while leaving a successful removal receipt.

func (*CredentialRemoval) Fields 

func (p *CredentialRemoval) Fields() ([]identity.FeatureField, error)

Fields binds every original protocol input into the parent's canonical command. The owned digest is neither authorization nor authentication proof.

func (CredentialRemoval) Format 

func (CredentialRemoval) Format(s fmt.State, _ rune)

Format hides original input and invocation state.

func (CredentialRemoval) MarshalJSON 

func (CredentialRemoval) MarshalJSON() ([]byte, error)

MarshalJSON prevents accidental export of provisional invocation state.

func (*CredentialRemoval) Recover 

func (p *CredentialRemoval) Recover(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

Recover delegates to retained original-command evidence; it cannot execute removal, fabricate a committed receipt or renew proof/current authority.

func (*CredentialRemoval) Validate 

func (p *CredentialRemoval) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate checks exact native operation, original self-user binding and the canonical removal lifecycle. It performs no IO or current-authority admission.

type EnrollmentAssertionCreation 

type EnrollmentAssertionCreation struct {
	// contains filtered or unexported fields
}

EnrollmentAssertionCreation selects session-bound, self-human enrollment reauthentication options, never signin or password-proof enrollment. Copies share serial invocation and challenge custody. The parent owns current session, CSRF, risk and policy admission and must defer Discard.

func (*EnrollmentAssertionCreation) Apply 

func (p *EnrollmentAssertionCreation) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply stages A options only in its actual parent's Work; errors must abort it.

func (*EnrollmentAssertionCreation) Check 

func (p *EnrollmentAssertionCreation) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats A's current identity and absolute expiry at final precommit.

func (*EnrollmentAssertionCreation) Discard 

func (p *EnrollmentAssertionCreation) Discard()

Discard idempotently clears every unreleased A challenge alias.

func (*EnrollmentAssertionCreation) Fields 

func (p *EnrollmentAssertionCreation) Fields() ([]identity.FeatureField, error)

Fields binds only the original A intent and grants no enrollment authority.

func (EnrollmentAssertionCreation) Format 

func (EnrollmentAssertionCreation) Format(s fmt.State, _ rune)

Format prevents retained protocol inputs and result custody from escaping.

func (*EnrollmentAssertionCreation) Generate 

func (p *EnrollmentAssertionCreation) Generate(ctx context.Context, now time.Time) error

Generate creates original A entropy once after acknowledged reservation and before the parent's Work opens. Recovery and retry must never call it.

func (EnrollmentAssertionCreation) MarshalJSON 

func (EnrollmentAssertionCreation) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of retained protocol and command state.

func (*EnrollmentAssertionCreation) Result 

func (p *EnrollmentAssertionCreation) Result(r identity.CommandResult) (webauthn.CeremonyRecord, webauthn.Challenge, error)

Result transfers original A options exactly once, only after acknowledged parent commit. Unknown, failed and replayed commands never reveal a challenge.

func (*EnrollmentAssertionCreation) Validate 

func (p *EnrollmentAssertionCreation) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate checks the exact A profile and original input without IO.

type EnrollmentAuthorization 

type EnrollmentAuthorization struct {
	// contains filtered or unexported fields
}

EnrollmentAuthorization consumes one genuine verified enrollment assertion and creates its registration ceremony in the same parent Work. It owns no transaction, proof store or session. Copies share serial generation/reveal custody; zero values deny. The parent must defer Discard on every path.

func (*EnrollmentAuthorization) Apply 

func (p *EnrollmentAuthorization) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply stages both B effects only in its actual parent's Work; errors abort it.

func (*EnrollmentAuthorization) AuthorizationExpiresAt 

func (p *EnrollmentAuthorization) AuthorizationExpiresAt() time.Time

AuthorizationExpiresAt returns only the genuine source assertion's original expiry, never the new registration TTL. Zero means invalid custody.

func (*EnrollmentAuthorization) Check 

func (p *EnrollmentAuthorization) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats B's current credential and original source expiry at precommit.

func (*EnrollmentAuthorization) Discard 

func (p *EnrollmentAuthorization) Discard()

Discard idempotently clears every unreleased B registration challenge alias.

func (*EnrollmentAuthorization) Fields 

func (p *EnrollmentAuthorization) Fields() ([]identity.FeatureField, error)

Fields binds both genuine opaque B inputs as one original command intent.

func (EnrollmentAuthorization) Format 

func (EnrollmentAuthorization) Format(s fmt.State, _ rune)

Format prevents retained protocol inputs and result custody from escaping.

func (*EnrollmentAuthorization) Generate 

func (p *EnrollmentAuthorization) Generate(ctx context.Context, now time.Time) error

Generate creates original B registration entropy once without renewing the genuine source assertion expiry, after reservation and outside parent Work.

func (EnrollmentAuthorization) MarshalJSON 

func (EnrollmentAuthorization) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of retained protocol and command state.

func (*EnrollmentAuthorization) Result 

func (p *EnrollmentAuthorization) Result(r identity.CommandResult) (webauthn.CeremonyRecord, webauthn.Challenge, webauthn.Credential, error)

Result transfers the original registration ceremony/challenge and finalized assertion credential together exactly once. Neither output is provisional; the real root callbacks must receive the actual parent coordinator receipt.

func (*EnrollmentAuthorization) Validate 

func (p *EnrollmentAuthorization) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate checks the exact B profile and combined original input without IO.

type MigrationSource 

type MigrationSource struct{}

MigrationSource is this adapter's forward-only immutable history. Install the public identity kernel, audit and outbox histories first through their owners. Load performs no IO or mutation. The zero value is usable concurrently.

func (MigrationSource) Load 

func (MigrationSource) Load(ctx context.Context) ([]migrations.Migration, error)

type RegistrationCreation 

type RegistrationCreation struct {
	// contains filtered or unexported fields
}

RegistrationCreation is one serial-use native protocol participant borrowed by the selected passkey register-options owner. Copies must not be used concurrently. It never reserves, begins, commits or retains Work. The parent must independently admit current session/fresh proof for enrollment, or the original pre-auth/signup authority for signup, plus applicable factor/risk policy and identity mapping in that same Work. Zero values deny; no goroutine is owned.

func (*RegistrationCreation) Apply 

func (p *RegistrationCreation) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply stages the actual protocol ceremony, RP-wide stable-handle binding and original protocol effects in the parent's Work. There is no nested transaction or callback. Errors must abort Work, including every parent-owned effect.

func (*RegistrationCreation) Check 

func (p *RegistrationCreation) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats the selected protocol current-user or original pending-signup scope and absolute-expiry fences in the parent's final precommit invocation. Parent session/proof/pre-auth/risk fences remain required as applicable.

func (*RegistrationCreation) Discard 

func (p *RegistrationCreation) Discard()

Discard clears all unreleased challenge aliases. It is idempotent and must run when reservation/apply/commit/delivery is abandoned, including panics.

func (*RegistrationCreation) Fields 

func (p *RegistrationCreation) Fields() ([]identity.FeatureField, error)

Fields binds every original protocol input, including RP/origin/UV profile, exclusions and user handle, into the parent's existing canonical command. The returned owned digest is not proof or permission and must not be logged.

func (RegistrationCreation) Format 

func (RegistrationCreation) Format(s fmt.State, _ rune)

Format redacts all participant, ceremony and correlated command state.

func (*RegistrationCreation) Generate 

func (p *RegistrationCreation) Generate(ctx context.Context, now time.Time) error

Generate must run after acknowledged parent reservation and before Work opens. now is the original primary database sample. It generates once; retries and recovery must not call it. Challenge custody stays unavailable until Result.

func (RegistrationCreation) MarshalJSON 

func (RegistrationCreation) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of invocation and challenge custody.

func (*RegistrationCreation) Result 

func (p *RegistrationCreation) Result(r identity.CommandResult) (webauthn.CeremonyRecord, webauthn.Challenge, error)

Result transfers challenge custody only for this newly applied acknowledged parent commit. Unknown, failure and replay return no output; failure discards entropy permanently. The parent must pass its actual coordinator receipt.

func (*RegistrationCreation) Validate 

func (p *RegistrationCreation) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate is pure bounded original-intent validation for the parent's native ValidateFeatureCommand. It admits no authority and does not generate entropy.

type RegistrationFinalization 

type RegistrationFinalization struct {
	// contains filtered or unexported fields
}

RegistrationFinalization retains only a real verifier-issued transition for one serial-use register-verify invocation. It cannot mint VerifiedRegistration or authenticate an identity. The root verifier may return its result only after the parent's Store reports acknowledged final commit. Zero values deny.

func (*RegistrationFinalization) Apply 

func (p *RegistrationFinalization) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply atomically consumes the original ceremony and inserts the actual verified credential alongside the parent's identity mapping and proof use. It never reports authentication or a finalized credential before SQL commit.

func (*RegistrationFinalization) Check 

func (p *RegistrationFinalization) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check preserves original verified ceremony limits without refreshing them.

func (*RegistrationFinalization) Fields 

func (p *RegistrationFinalization) Fields() ([]identity.FeatureField, error)

Fields fixes the verified ceremony, credential and response identity without retaining raw browser responses in the parent command or native effect record.

func (RegistrationFinalization) Format 

func (RegistrationFinalization) Format(s fmt.State, _ rune)

Format redacts the retained verified transition and command state.

func (RegistrationFinalization) MarshalJSON 

func (RegistrationFinalization) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of provisional verification custody.

func (*RegistrationFinalization) Result 

func (p *RegistrationFinalization) Result(r identity.CommandResult) (webauthn.Credential, error)

Result returns an owned finalized credential for the real root verifier, not an identity grant. Replay and unknown commit never reissue verification.

func (*RegistrationFinalization) Validate 

func (p *RegistrationFinalization) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate requires the exact selected parent, immutable verifier transition and original command. It performs no IO or durable mutation.

type RemovalAssertionFinalization 

type RemovalAssertionFinalization struct {
	// contains filtered or unexported fields
}

RemovalAssertionFinalization consumes one genuine identified root transition and erases an exact owned protocol credential inside the native parent's Work. It owns neither a coordinator nor authentication/session/recovery authority. Copies share serial-use custody, including the one acknowledged Result. The parent owns current session, target/reference/mapping, remaining usable key, MFA, directory, policy and risk admission and must propagate every error. Zero values deny; no goroutine or borrowed-pool lifetime is owned.

func (*RemovalAssertionFinalization) Apply 

func (p *RemovalAssertionFinalization) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply consumes the original removal ceremony, advances its verified source, erases the target and retains both snapshots in one parent-linked effect row. Every step uses the existing Work; any rejection must abort the whole parent.

func (*RemovalAssertionFinalization) Check 

func (p *RemovalAssertionFinalization) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats original absolute expiry/current-subject/ceremony and exact successor/effect fences during final precommit. The same-key terminal version replaces only this profile's source live-key fence; all other profiles retain checkAssertionCredential unchanged. A distinct source must remain exact/live.

func (*RemovalAssertionFinalization) CheckRemainingCredential 

func (p *RemovalAssertionFinalization) CheckRemainingCredential(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, command identity.Command, credentialID []byte) (webauthn.Credential, error)

CheckRemainingCredential reads and fences one current protocol credential inside this applied removal participant's original Work. The native parent selects and binds the candidate mapping/reference and current kernel authority, calls this during Apply and final precommit, and applies its algorithm policy. This method cannot establish last-key/recovery permission or authenticate.

Scope and handle derive only from the genuine verified source. The removed target, erased keys, exhausted versions and non-resident registration histories deny. Original resident-required registration provenance must retain the same immutable ID/key/algorithm/handle. Its historical ceremony expiry is not a credential expiry. Credential, RP/handle and provenance row locks survive until this sole Work ends; the query returns at most two bounded rows under its deadline. No pool read, transaction, cache, goroutine or new state is created.

func (*RemovalAssertionFinalization) Fields 

func (p *RemovalAssertionFinalization) Fields() ([]identity.FeatureField, error)

Fields fixes the genuine source response/ceremony/before/after and original target scope/version in one owned digest. It is not authorization or proof.

func (RemovalAssertionFinalization) Format 

func (RemovalAssertionFinalization) Format(s fmt.State, _ rune)

Format redacts retained cryptographic and original-command custody.

func (RemovalAssertionFinalization) MarshalJSON 

func (RemovalAssertionFinalization) MarshalJSON() ([]byte, error)

MarshalJSON prevents accidental export of provisional participant state.

func (*RemovalAssertionFinalization) Result 

func (p *RemovalAssertionFinalization) Result(r identity.CommandResult) (webauthn.Credential, error)

Result releases exactly the root verifier's After once, only following the actual acknowledged final parent commit. It is historical protocol evidence, not a usable credential admission: the same-key target is already terminal. Unknown, aborted and replayed commands never reconstruct verification.

func (*RemovalAssertionFinalization) Validate 

func (p *RemovalAssertionFinalization) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate requires the exact self-user delete-assertion schema, native owner, original input digest and canonical positive reference N-to-N+1 lifecycle. It performs bounded pure admission, not IO or current authority evaluation.

type RemovalRequest 

type RemovalRequest struct {
	Context      webauthn.CeremonyContext
	RPID         string
	CredentialID []byte
	Version      uint64
}

RemovalRequest fixes the original trusted self-user scope, RP, raw credential ID and optimistic protocol version. Version is independent of the parent's passkey-reference and metadata versions. CredentialID is copied on admission. This input is not fresh proof or authorization to delete a passkey.

func (RemovalRequest) Format 

func (RemovalRequest) Format(s fmt.State, _ rune)

Format hides correlated scope and credential identifiers.

type SessionRegistrationFinalization 

type SessionRegistrationFinalization struct {
	// contains filtered or unexported fields
}

SessionRegistrationFinalization accepts a genuine registration only when its ceremony was created by EnrollmentAuthorization. Its source assertion's original absolute expiry remains an enforced ceiling through final precommit. The parent owns identity mapping, metadata and all current session authority.

func (*SessionRegistrationFinalization) Apply 

func (p *SessionRegistrationFinalization) Apply(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Apply consumes authorized C only in its actual parent's Work; errors abort it.

func (*SessionRegistrationFinalization) Check 

func (p *SessionRegistrationFinalization) Check(ctx context.Context, w kernel.Work, owner kernel.FeatureExecutionContributor, c identity.Command) error

Check repeats C's exact persisted source authority and expiry at precommit.

func (SessionRegistrationFinalization) Discard 

func (p SessionRegistrationFinalization) Discard()

Discard clears all unreleased challenge aliases, including after cancellation and panic. It is idempotent and owns no goroutine or database lifetime.

func (*SessionRegistrationFinalization) Fields 

func (p *SessionRegistrationFinalization) Fields() ([]identity.FeatureField, error)

Fields binds the genuine original C registration transition.

func (SessionRegistrationFinalization) Format 

func (SessionRegistrationFinalization) Format(s fmt.State, _ rune)

Format prevents retained protocol inputs and result custody from escaping.

func (SessionRegistrationFinalization) MarshalJSON 

func (SessionRegistrationFinalization) MarshalJSON() ([]byte, error)

MarshalJSON rejects accidental export of retained protocol and command state.

func (*SessionRegistrationFinalization) Result 

func (p *SessionRegistrationFinalization) Result(r identity.CommandResult) (webauthn.Credential, error)

Result returns one finalized registration credential to the genuine root verifier after acknowledged C commit, never on replay or ambiguous commit.

func (*SessionRegistrationFinalization) Validate 

func (p *SessionRegistrationFinalization) Validate(c identity.Command, plan kernel.CommandPlan) error

Validate checks the exact C profile and original verified input without IO.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store owns no connection/goroutine lifetime. Concurrent methods use separate immutable native invocation phases and the sole public identity coordinator. Never supply replicas. The caller owns pool shutdown and migration sequencing.

func New 

func New(pool *database.Pool, c Config) (*Store, error)

New validates the concrete durable composition without IO. Constructors retain no Work, transaction or foreign coordinator. Each execution freezes the same public native participants before reservation, following the owning kernel.

func (*Store) AssertionCreation 

func (s *Store) AssertionCreation(input webauthn.CeremonyCreation) (*AssertionCreation, error)

AssertionCreation borrows the native store and the real root service's opaque identified ES256/Ed25519 creation. No caller-assembled ceremony is accepted. The parent owns primary/pool lifetime and must Discard every abandoned call.

func (*Store) AssertionFinalization 

func (s *Store) AssertionFinalization(input webauthn.AssertionTransition) (*AssertionFinalization, error)

AssertionFinalization accepts only an opaque cryptographically verified transition, never a Credential, AssertionMutation or boolean authentication. Exact protocol before/after versions remain independent of the parent's command-record 0-to-1 lifecycle. No independent commit or provisional result is exposed by this constructor.

func (*Store) CreateCeremony 

func (s *Store) CreateCeremony(ctx context.Context, c webauthn.CeremonyCreation) (webauthn.CeremonyRecord, webauthn.Challenge, identity.CommitOutcome, error)

func (*Store) CredentialRemoval 

func (s *Store) CredentialRemoval(input RemovalRequest) (*CredentialRemoval, error)

CredentialRemoval admits one bounded immutable removal input without IO. The pool is borrowed; the caller retains its lifetime and all parent policy.

func (*Store) DiscoverableAssertionCreation 

func (s *Store) DiscoverableAssertionCreation(input webauthn.CeremonyCreation) (*AssertionCreation, error)

DiscoverableAssertionCreation selects account-independent resident discovery inside the native passkey parent's one Work. The parent must bind its original trusted service actor and genuine anonymous session flow, with no target user. No credential allowlist, user handle or account admission is accepted here; original browser, risk, identifier and session policy remain parent-owned. Custody, Generate/Discard and final-commit Result rules match AssertionCreation.

func (*Store) DiscoverableAssertionFinalization 

func (s *Store) DiscoverableAssertionFinalization(input webauthn.AssertionTransition) (*AssertionFinalization, error)

DiscoverableAssertionFinalization accepts only the root verifier's opaque signed resident assertion. Its verified Before.UserID, never a caller-selected target, binds the final self-human parent. The original anonymous protocol context, service actor and flow stay unchanged in the transition and digest. This participant does not match an identifier, admit risk, authenticate an identity or issue a session; the native parent owns those current decisions.

func (*Store) EnrollmentAssertionCreation 

func (s *Store) EnrollmentAssertionCreation(input webauthn.CeremonyCreation) (*EnrollmentAssertionCreation, error)

EnrollmentAssertionCreation borrows the real root service's opaque identified ES256/Ed25519 creation. Caller-assembled ceremonies and boolean freshness deny.

func (*Store) EnrollmentAuthorization 

func (s *Store) EnrollmentAuthorization(assertion webauthn.AssertionTransition, creation webauthn.CeremonyCreation) (*EnrollmentAuthorization, error)

EnrollmentAuthorization accepts only real root-verifier assertion output and real root-service registration creation from that same invocation Context. The original assertion ceremony belongs to A, not the new B command. Both effects are staged together; neither result is exposed before acknowledged B.

func (*Store) FinalizeAssertion 

func (s *Store) FinalizeAssertion(ctx context.Context, t webauthn.AssertionTransition) (webauthn.Credential, identity.CommitOutcome, error)

func (*Store) FinalizeRegistration 

func (s *Store) FinalizeRegistration(ctx context.Context, t webauthn.RegistrationTransition) (webauthn.Credential, identity.CommitOutcome, error)

func (Store) Format 

func (Store) Format(s fmt.State, _ rune)

func (*Store) LoadCeremony 

func (s *Store) LoadCeremony(ctx context.Context, q webauthn.Lookup) (webauthn.CeremonyRecord, error)

func (*Store) LoadCredential 

func (s *Store) LoadCredential(ctx context.Context, q webauthn.Lookup, id []byte) (webauthn.Credential, error)

func (*Store) LoadDiscoverableCredential 

func (s *Store) LoadDiscoverableCredential(ctx context.Context, q webauthn.Lookup, id, handle []byte) (webauthn.Credential, error)

LoadDiscoverableCredential resolves a mandatory RP-wide credential/handle mapping within a trusted tenant and pre-auth ceremony. It grants no authority; the participant rechecks active subject and mapping at finalization.

func (*Store) PreauthAssertionCreation 

func (s *Store) PreauthAssertionCreation(input webauthn.CeremonyCreation) (*AssertionCreation, error)

PreauthAssertionCreation selects identified preauthentication participation. The original parent must attribute options to its trusted SubjectServiceAccount, distinct from the identified target. This grants no authority over that target; the parent still owns ingress, risk and current-account admission. The original service actor must remain unchanged through root assertion verification.

func (*Store) PreauthAssertionFinalization 

func (s *Store) PreauthAssertionFinalization(input webauthn.AssertionTransition) (*AssertionFinalization, error)

PreauthAssertionFinalization accepts only a genuine root-verified assertion made under the original service actor. Its final parent must be attributed to the verified target as SubjectUser. Only parent attribution is bridged: the immutable protocol mutation, ceremony and digest retain their service actor. The parent separately owns current ingress/browser/risk and session authority; this participant alone never authenticates an identity or issues a session.

func (*Store) Recover 

func (s *Store) Recover(ctx context.Context, r webauthn.RecoveryRequest) (identity.CommitOutcome, error)

Recover reconciles only the original exact scope through the sole kernel owner. It cannot execute a new command or recover missing challenge bytes.

func (*Store) RecoverAssertion 

func (s *Store) RecoverAssertion(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverAssertion runs only in the original parent's genuine recovery invocation. The parent combines this with its metadata/session/effect owners. Absence is noncommit evidence; any effect under a still-pending journal is unknown, never reconstructed authentication or permission to replay effects.

func (*Store) RecoverEnrollment 

func (s *Store) RecoverEnrollment(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverEnrollment participates only in the original selected parent recovery. Any effect beneath a pending journal is unknown; absence proves noncommit. It never generates options or reconstructs a verified result. The parent must reconcile all its own metadata effects through its existing coordinator.

func (*Store) RecoverRegistration 

func (s *Store) RecoverRegistration(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverRegistration participates only in the original parent journal's recovery invocation. Absence is not-committed evidence; any protocol effect with a pending journal remains unknown, never reconstructed authentication. The parent combines this with all its own proof/mapping/effect participants.

func (*Store) RecoverRemoval 

func (s *Store) RecoverRemoval(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverRemoval participates only in the parent's original journal recovery. Effects are inseparable from removal and must be retained for at least the parent journal's lifetime. Absence proves this command did not remove; any retained effect beside a pending journal remains Unknown. Today's credential state never establishes historical commit or grants reexecution authority.

func (*Store) RecoverRemovalAssertion 

func (s *Store) RecoverRemovalAssertion(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverRemovalAssertion admits only the original removal-options/completion parent recovery invocation. Missing protocol evidence proves noncommit; any effect beneath a pending journal remains unknown. The parent must combine its other owners. Recovery never consumes a ceremony, renews expiry or reissues a credential, challenge or verification result.

func (*Store) RecoverUpdateAssertion 

func (s *Store) RecoverUpdateAssertion(ctx context.Context, w kernel.RecoveryWork, owner kernel.FeatureExecutionContributor) (kernel.RecoveryStatus, error)

RecoverUpdateAssertion participates only in the selected original update parent's recovery invocation. It neither accepts sign-in profiles nor renews authority, reconstructs verification, or permits replay of metadata effects.

func (*Store) RegistrationCreation 

func (s *Store) RegistrationCreation(input webauthn.CeremonyCreation) (*RegistrationCreation, error)

RegistrationCreation borrows the existing protocol store and opaque creation. Only authenticated resident-required ES256/Ed25519 enrollment is selected. Creation must come from the real root service configured with that profile. The caller owns pool lifetime and must Discard on all abandoned/failure paths.

func (*Store) RegistrationFinalization 

func (s *Store) RegistrationFinalization(input webauthn.RegistrationTransition) (*RegistrationFinalization, error)

RegistrationFinalization accepts only opaque cryptographically verified registration, never caller-assembled Credential or RegistrationMutation. It does not commit independently or expose a provisional verified result.

func (*Store) RemovalAssertionCreation 

func (s *Store) RemovalAssertionCreation(input webauthn.CeremonyCreation) (*AssertionCreation, error)

RemovalAssertionCreation selects identified self-human UV options for the native delete owner. It grants no session, target, recovery or policy authority. The parent must bind those original inputs, defer Discard and finalize its sole Work before returning the participant's Result to the genuine root service.

func (*Store) RemovalAssertionFinalization 

func (s *Store) RemovalAssertionFinalization(input webauthn.AssertionTransition, target RemovalRequest) (*RemovalAssertionFinalization, error)

RemovalAssertionFinalization accepts only verifier-issued transition custody. RemovalRequest.Version is the original target version, not a caller-rebased successor. For the same credential, only the verified source After supplies the removal CAS version. Parent lifecycle versions are entirely independent.

func (*Store) SessionRegistrationFinalization 

func (s *Store) SessionRegistrationFinalization(input webauthn.RegistrationTransition) (*SessionRegistrationFinalization, error)

SessionRegistrationFinalization selects the matching native C profile. The genuine source authorization is checked in the parent's Work, not trusted from application metadata or reconstructed from a fresh ceremony expiry.

func (*Store) SignupRegistrationCreation 

func (s *Store) SignupRegistrationCreation(input webauthn.CeremonyCreation, flow string) (*RegistrationCreation, error)

SignupRegistrationCreation borrows real root-issued resident-required ES256/Ed25519 creation for the exact anonymous register-options .signup-v1 parent. flow is the original trusted session pre-auth flow, not a new authenticated subject. The root context holds the preallocated prospective user and configured service actor; parent UserID must stay empty and registration.user must bind that prospective ID. The parent owns risk, expiry, remember and signup policy. Options create no identity, stable user handle, credential or session. Custody, serial use, Generate, Discard and Result match RegistrationCreation.

func (*Store) SignupRegistrationFinalization 

func (s *Store) SignupRegistrationFinalization(input webauthn.RegistrationTransition, flow string) (*RegistrationFinalization, error)

SignupRegistrationFinalization accepts only the root verifier's opaque UV registration transition for the exact original anonymous .signup-v1 parent. The parent must create the prospective active identity in the same Work before Apply; this participant creates neither that identity nor MFA/session effects. Apply consumes only the ceremony stored with this original flow/prospective ID, promotes its association once, then binds the existing RP-wide handle and credential. Any failure must abort all parent effects. Check repeats the exact stored-flow and current-active-user fences; Result requires acknowledged commit and never exposes provisional authentication or signup authority.

func (*Store) UpdateAssertionCreation 

func (s *Store) UpdateAssertionCreation(input webauthn.CeremonyCreation) (*AssertionCreation, error)

UpdateAssertionCreation selects identified self-human assertion options for the native passkey update owner, never sign-in or preauthentication. The parent owns original-session, target/name/version, CSRF and current authority; this participant grants none of those permissions and owns no metadata.

func (*Store) UpdateAssertionFinalization 

func (s *Store) UpdateAssertionFinalization(input webauthn.AssertionTransition) (*AssertionFinalization, error)

UpdateAssertionFinalization selects a genuine self-human verified assertion for the native rename command's metadata N-to-N+1 lifecycle. Protocol counter versions remain independent. The parent must still admit its original session, action-bound target/name/version, current MFA/passkey/directory/policy and risk.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.