Documentation
¶
Overview ¶
package: macaroon / authn type: adapter job: authenticate a macaroon, translating its caveats into attenuated grants limits: verification only — this server never mints or attenuates one (-> auth.New)
Tokens are untrusted external input; this backend verifies, never mints. Each first-party caveat is one "RIGHTS glob" grant and one attenuation step, ALL of which must hold; an unparseable or third-party caveat refuses the whole token.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Auth ¶
type Auth struct {
// contains filtered or unexported fields
}
Auth is the macaroon backend: the root key its signature chains verify against. The key is symmetric — holding it can mint tokens too, not just verify them, so a leaked config is a forging key living in two places.
func New ¶
New builds the backend from the section's "root_key" — the symmetric secret shared with whatever external system mints macaroons for this server.
func (*Auth) Authenticate ¶
Authenticate decodes and verifies token against the root key, parsing each first-party caveat as a Grant (see the package doc) — id becomes Account.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
package: macaroontest / authn type: test-support job: the macaroon backend's conformance setup hook, and a minting helper for fixtures limits: a test helper; only tests import it — this server never mints a macaroon itself
|
package: macaroontest / authn type: test-support job: the macaroon backend's conformance setup hook, and a minting helper for fixtures limits: a test helper; only tests import it — this server never mints a macaroon itself |