Help us shape the future of Go! Take the 2026 Go Developer Survey

bridge

package
v3.0.24 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultMaxTokenRecords          = 16_384
	DefaultMaxTokenRecordsPerPlugin = 2_048
	DefaultMaxTokenRevokeFloors     = 4_096
	DefaultMaxTokenTTL              = 15 * time.Minute
)
View Source 
const (
	DefaultAssetTicketTTL                   = 15 * time.Second
	MaxAssetTicketTTL                       = 60 * time.Second
	DefaultAssetSessionTTL                  = 10 * time.Minute
	MaxAssetSessionTTL                      = 15 * time.Minute
	DefaultGatewayTokenTTL                  = 10 * time.Minute
	MaxGatewayTokenTTL                      = 15 * time.Minute
	DefaultMaxActiveSurfaceSessions         = 4096
	DefaultMaxActiveSurfaceSessionsPerOwner = 64
	DefaultSurfaceClosureTTL                = 15 * time.Minute
	DefaultConfirmationTTL                  = 2 * time.Minute
	MaxConfirmationTTL                      = 5 * time.Minute
	DefaultRuntimeLeaseTTL                  = 30 * time.Second
	MaxRuntimeLeaseTTL                      = 5 * time.Minute
	DefaultHandleGrantTTL                   = 30 * time.Second
	MaxHandleGrantTTL                       = 60 * time.Second
	RouteRoleTrustedParent                  = "trusted_parent"
	RouteRoleTrustedIntent                  = "trusted_intent"
)

Variables

View Source 
var (
	ErrTokenInvalid             = errors.New("token is invalid")
	ErrTokenExpired             = errors.New("token is expired")
	ErrTokenReplay              = errors.New("token has already been consumed")
	ErrTokenAudience            = errors.New("token audience mismatch")
	ErrTokenKind                = errors.New("token kind mismatch")
	ErrTokenRevoked             = errors.New("token has been revoked")
	ErrTokenAlreadyBound        = errors.New("token is already bound to a different channel")
	ErrMissingTokenAudience     = errors.New("token audience is incomplete")
	ErrTokenCapacity            = errors.New("token manager capacity is exhausted")
	ErrTokenPluginCapacity      = errors.New("plugin token capacity is exhausted")
	ErrTokenTTLExceeded         = errors.New("token TTL exceeds the configured maximum")
	ErrTokenRevokeFloorCapacity = errors.New("token revoke-floor capacity is exhausted")
	ErrTokenRevision            = errors.New("token revision binding is invalid")
	ErrTokenLimits              = errors.New("token limits are invalid")
)
View Source 
var (
	ErrSurfaceSessionNotFound      = errors.New("surface session not found")
	ErrSurfaceSessionExpired       = errors.New("surface session expired")
	ErrSurfaceSessionAlreadyExists = errors.New("surface session already exists")
	ErrSurfaceSessionLimitReached  = errors.New("surface session limit reached")
	ErrHandshakeMismatch           = errors.New("bridge handshake mismatch")
	ErrAssetSessionRequired        = errors.New("asset session is required before bridge token mint")
)

Functions

func HandshakeTranscriptSHA256 

func HandshakeTranscriptSHA256(handshake Handshake, bridgeChannelID string) string

Types

type AssetSessionResult 

type AssetSessionResult struct {
	AssetSession       string    `json:"asset_session"`
	AssetSessionID     string    `json:"asset_session_id"`
	AssetSessionNonce  string    `json:"asset_session_nonce"`
	EntryPath          string    `json:"entry_path"`
	EntrySHA256        string    `json:"entry_sha256"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	IssuedAt           time.Time `json:"issued_at"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type AssetSessionValidation 

type AssetSessionValidation struct {
	Session SurfaceSession `json:"session"`
	TokenID string         `json:"token_id"`
}

type AssetTicket 

type AssetTicket struct {
	TicketID           string    `json:"ticket_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	OwnerEnvHash       string    `json:"owner_env_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type Audience 

type Audience struct {
	PluginID               string                   `json:"plugin_id,omitempty"`
	PluginInstanceID       string                   `json:"plugin_instance_id"`
	PluginVersion          string                   `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                   `json:"active_fingerprint"`
	SurfaceID              string                   `json:"surface_id,omitempty"`
	SurfaceInstanceID      string                   `json:"surface_instance_id,omitempty"`
	EntryPath              string                   `json:"entry_path,omitempty"`
	EntrySHA256            string                   `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string                   `json:"asset_session_nonce,omitempty"`
	RouteRole              string                   `json:"route_role,omitempty"`
	OwnerSessionHash       string                   `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                   `json:"owner_user_hash,omitempty"`
	OwnerEnvHash           string                   `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash   string                   `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                   `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                   `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                   `json:"runtime_generation_id,omitempty"`
	RuntimeShardID         string                   `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                   `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                   `json:"connection_nonce,omitempty"`
	AuditCorrelationID     string                   `json:"audit_correlation_id,omitempty"`
	HandleID               string                   `json:"handle_id,omitempty"`
	ConfirmationID         string                   `json:"confirmation_id,omitempty"`
	Method                 string                   `json:"method,omitempty"`
	RequestHash            string                   `json:"request_hash,omitempty"`
	PlanHash               string                   `json:"plan_hash,omitempty"`
	TargetDescriptorSHA256 string                   `json:"target_descriptor_sha256,omitempty"`
	ResourceScope          sessionctx.ResourceScope `json:"resource_scope,omitzero"`
}

type BoundSurfaceSession 

type BoundSurfaceSession struct {
	PluginInstanceID  string `json:"plugin_instance_id"`
	PluginVersion     string `json:"plugin_version"`
	ActiveFingerprint string `json:"active_fingerprint"`
}

type BridgeHandshakeValidation 

type BridgeHandshakeValidation struct {
	Session SurfaceSession `json:"session"`
}

type CallRequest 

type CallRequest struct {
	ID     string `json:"id"`
	Method string `json:"method"`
	Params any    `json:"params,omitempty"`
}

type ChannelBinding 

type ChannelBinding struct {
	BridgeChannelID string `json:"bridge_channel_id,omitempty"`
}

type ConfirmationTokenResult 

type ConfirmationTokenResult struct {
	ConfirmationToken   string    `json:"confirmation_token"`
	ConfirmationTokenID string    `json:"confirmation_token_id"`
	RequestHash         string    `json:"request_hash"`
	PlanHash            string    `json:"plan_hash"`
	IssuedAt            time.Time `json:"issued_at"`
	ExpiresAt           time.Time `json:"expires_at"`
}

type DisposeSurfaceRequest 

type DisposeSurfaceRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type ExchangeAssetTicketRequest 

type ExchangeAssetTicketRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetTicket          string    `json:"asset_ticket"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type GatewayToken 

type GatewayToken struct {
	TokenID            string    `json:"token_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	BridgeChannelID    string    `json:"bridge_channel_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	OwnerEnvHash       string    `json:"owner_env_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type GatewayTokenResult 

type GatewayTokenResult struct {
	GatewayToken   string    `json:"plugin_gateway_token"`
	GatewayTokenID string    `json:"plugin_gateway_token_id"`
	AssetSession   string    `json:"asset_session"`
	AssetSessionID string    `json:"asset_session_id"`
	IssuedAt       time.Time `json:"issued_at"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type HandleGrantResult 

type HandleGrantResult struct {
	HandleGrantToken    string                   `json:"handle_grant_token"`
	HandleGrantID       string                   `json:"handle_grant_id"`
	RuntimeGenerationID string                   `json:"runtime_generation_id"`
	HandleID            string                   `json:"handle_id"`
	ResourceScope       sessionctx.ResourceScope `json:"resource_scope"`
	Limits              Limits                   `json:"limits,omitempty"`
	IssuedAt            time.Time                `json:"issued_at"`
	ExpiresAt           time.Time                `json:"expires_at"`
}

type Handshake 

type Handshake struct {
	PluginID           string `json:"plugin_id"`
	SurfaceID          string `json:"surface_id"`
	SurfaceInstanceID  string `json:"surface_instance_id"`
	ActiveFingerprint  string `json:"active_fingerprint"`
	BridgeNonce        string `json:"bridge_nonce"`
	AssetSessionNonce  string `json:"asset_session_nonce"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
}

type InspectBoundSurfaceRequest 

type InspectBoundSurfaceRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeChannelID      string    `json:"bridge_channel_id"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type InspectRequest 

type InspectRequest struct {
	Kind  TokenKind `json:"kind"`
	Token string    `json:"token"`
	Now   time.Time `json:"-"`
}

type Limits 

type Limits struct {
	MaxBytesPerSecond int64 `json:"max_bytes_per_second,omitempty"`
	MaxTotalBytes     int64 `json:"max_total_bytes,omitempty"`
}

type MarkSurfacePreparedRequest 

type MarkSurfacePreparedRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetSessionID       string    `json:"asset_session_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type MintConfirmationTokenRequest 

type MintConfirmationTokenRequest struct {
	PluginID               string          `json:"plugin_id,omitempty"`
	PluginInstanceID       string          `json:"plugin_instance_id"`
	PluginVersion          string          `json:"plugin_version,omitempty"`
	ActiveFingerprint      string          `json:"active_fingerprint"`
	SurfaceID              string          `json:"surface_id,omitempty"`
	SurfaceInstanceID      string          `json:"surface_instance_id"`
	EntryPath              string          `json:"entry_path,omitempty"`
	EntrySHA256            string          `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string          `json:"asset_session_nonce,omitempty"`
	RouteRole              string          `json:"route_role,omitempty"`
	ConfirmationID         string          `json:"confirmation_id"`
	OwnerSessionHash       string          `json:"-"`
	OwnerUserHash          string          `json:"-"`
	OwnerEnvHash           string          `json:"-"`
	SessionChannelIDHash   string          `json:"-"`
	BridgeChannelID        string          `json:"bridge_channel_id"`
	RuntimeGenerationID    string          `json:"runtime_generation_id,omitempty"`
	Method                 string          `json:"method"`
	RequestHash            string          `json:"request_hash"`
	PlanHash               string          `json:"plan_hash"`
	TargetDescriptorSHA256 string          `json:"target_descriptor_sha256"`
	Revision               RevisionBinding `json:"revision"`
	Now                    time.Time       `json:"-"`
	ExpiresAt              time.Time       `json:"expires_at,omitempty"`
}

type MintGatewayTokenRequest 

type MintGatewayTokenRequest struct {
	Handshake                 Handshake `json:"handshake"`
	BridgeChannelID           string    `json:"bridge_channel_id"`
	HandshakeTranscriptSHA256 string    `json:"handshake_transcript_sha256"`
	PreviousGatewayToken      string    `json:"previous_plugin_gateway_token,omitempty"`
	Now                       time.Time `json:"-"`
}

type MintHandleGrantRequest 

type MintHandleGrantRequest struct {
	PluginInstanceID     string                   `json:"plugin_instance_id"`
	ActiveFingerprint    string                   `json:"active_fingerprint"`
	RuntimeInstanceID    string                   `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID  string                   `json:"runtime_generation_id"`
	RuntimeShardID       string                   `json:"runtime_shard_id,omitempty"`
	OwnerSessionHash     string                   `json:"-"`
	OwnerUserHash        string                   `json:"-"`
	OwnerEnvHash         string                   `json:"-"`
	SessionChannelIDHash string                   `json:"-"`
	HandleID             string                   `json:"handle_id"`
	Method               string                   `json:"method"`
	ResourceScope        sessionctx.ResourceScope `json:"-"`
	Revision             RevisionBinding          `json:"revision"`
	Limits               Limits                   `json:"limits,omitempty"`
	Now                  time.Time                `json:"-"`
	ExpiresAt            time.Time                `json:"expires_at,omitempty"`
}

type MintRequest 

type MintRequest struct {
	Kind      TokenKind       `json:"kind"`
	Use       TokenUse        `json:"use,omitempty"`
	Audience  Audience        `json:"-"`
	Revision  RevisionBinding `json:"revision"`
	ExpiresAt time.Time       `json:"expires_at"`
	Now       time.Time       `json:"-"`
	Limits    Limits          `json:"limits,omitzero"`
}

type MintRuntimeExecutionLeaseRequest 

type MintRuntimeExecutionLeaseRequest struct {
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"-"`
	OwnerUserHash          string                      `json:"-"`
	OwnerEnvHash           string                      `json:"-"`
	SessionChannelIDHash   string                      `json:"-"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	ExecutionID            string                      `json:"execution_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	Revision               RevisionBinding             `json:"revision"`
	Now                    time.Time                   `json:"-"`
	ExpiresAt              time.Time                   `json:"expires_at,omitempty"`
}

type MintedToken 

type MintedToken struct {
	Kind      TokenKind       `json:"token_kind"`
	TokenID   string          `json:"token_id"`
	Token     string          `json:"token"`
	Audience  Audience        `json:"audience"`
	Revision  RevisionBinding `json:"revision"`
	IssuedAt  time.Time       `json:"issued_at"`
	ExpiresAt time.Time       `json:"expires_at"`
	Nonce     string          `json:"nonce"`
	Use       TokenUse        `json:"use"`
	Limits    Limits          `json:"limits,omitzero"`
}

type OpenSurfaceRequest 

type OpenSurfaceRequest struct {
	PluginID             string          `json:"plugin_id"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version"`
	SurfaceID            string          `json:"surface_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	EntryPath            string          `json:"entry_path"`
	EntrySHA256          string          `json:"entry_sha256"`
	RouteRole            string          `json:"route_role"`
	RuntimeGenerationID  string          `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
}

type ReconcileSurfaceRevocationResult 

type ReconcileSurfaceRevocationResult struct {
	State         SurfaceRevocationState `json:"state"`
	PreviousState SurfaceRevocationState `json:"previous_state"`
	Revoked       bool                   `json:"revoked"`
}

type RevisionBinding 

type RevisionBinding struct {
	PolicyRevision     uint64 `json:"policy_revision"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
}

type RevokeSessionScopeRequest 

type RevokeSessionScopeRequest struct {
	SessionScope sessionctx.SessionScope `json:"-"`
	Now          time.Time               `json:"-"`
}

type RuntimeExecutionLeaseLimits 

type RuntimeExecutionLeaseLimits struct {
	TimeoutMillis           int64 `json:"timeout_ms,omitempty"`
	MemoryBytes             int64 `json:"memory_bytes,omitempty"`
	MaxPayloadBytes         int64 `json:"max_payload_bytes,omitempty"`
	MaxStreamBytesPerSecond int64 `json:"max_stream_bytes_per_sec,omitempty"`
}

type RuntimeExecutionLeaseResult 

type RuntimeExecutionLeaseResult struct {
	TokenID                string                      `json:"token_id"`
	LeaseID                string                      `json:"lease_id"`
	LeaseNonce             string                      `json:"lease_nonce"`
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                      `json:"owner_user_hash,omitempty"`
	OwnerEnvHash           string                      `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash   string                      `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	ExecutionID            string                      `json:"execution_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	PolicyRevision         uint64                      `json:"policy_revision"`
	ManagementRevision     uint64                      `json:"management_revision"`
	RevokeEpoch            uint64                      `json:"revoke_epoch"`
	IssuedAt               time.Time                   `json:"issued_at"`
	IssuedAtUnixMillis     int64                       `json:"issued_at_unix_ms"`
	ExpiresAt              time.Time                   `json:"expires_at"`
	ExpiresAtUnixMillis    int64                       `json:"expires_at_unix_ms"`
}

type SessionScopeRevocation 

type SessionScopeRevocation struct {
	Surfaces uint64                       `json:"surfaces"`
	Tokens   SessionTokenRevocationCounts `json:"tokens"`
}

type SessionTokenRevocationCounts 

type SessionTokenRevocationCounts struct {
	AssetTickets        uint64 `json:"asset_tickets"`
	AssetSessions       uint64 `json:"asset_sessions"`
	PluginGatewayTokens uint64 `json:"plugin_gateway_tokens"`
	ConfirmationTokens  uint64 `json:"confirmation_tokens"`
	HandleGrants        uint64 `json:"handle_grants"`
}

type SurfaceBootstrap 

type SurfaceBootstrap struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceID            string    `json:"surface_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	AssetTicket          string    `json:"asset_ticket"`
	AssetTicketID        string    `json:"asset_ticket_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	IssuedAt             time.Time `json:"issued_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceRevocationState 

type SurfaceRevocationState string
const (
	SurfaceRevocationStateActive SurfaceRevocationState = "active"
	SurfaceRevocationStateClosed SurfaceRevocationState = "closed"
	SurfaceRevocationStateAbsent SurfaceRevocationState = "absent"
)

type SurfaceSession 

type SurfaceSession struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	SurfaceID            string    `json:"surface_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	RouteRole            string    `json:"route_role"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	OwnerEnvHash         string    `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	BridgeNonce          string    `json:"bridge_nonce"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	CreatedAt            time.Time `json:"created_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceTokenOptions 

type SurfaceTokenOptions struct {
	AssetTicketTTL            time.Duration `json:"asset_ticket_ttl,omitempty"`
	AssetSessionTTL           time.Duration `json:"asset_session_ttl,omitempty"`
	GatewayTokenTTL           time.Duration `json:"gateway_token_ttl,omitempty"`
	MaxActiveSessions         int           `json:"max_active_sessions,omitempty"`
	MaxActiveSessionsPerOwner int           `json:"max_active_sessions_per_owner,omitempty"`
}

type SurfaceTokenService 

type SurfaceTokenService struct {
	// contains filtered or unexported fields
}

func NewSurfaceTokenService 

func NewSurfaceTokenService(tokens *TokenManager, options SurfaceTokenOptions) *SurfaceTokenService

func (*SurfaceTokenService) DisposeAssetSession 

func (s *SurfaceTokenService) DisposeAssetSession(req ValidateAssetSessionRequest) error

func (*SurfaceTokenService) DisposeBoundSurface 

func (s *SurfaceTokenService) DisposeBoundSurface(req DisposeSurfaceRequest) error

func (*SurfaceTokenService) DisposeSurface 

func (s *SurfaceTokenService) DisposeSurface(surfaceInstanceID string, now time.Time) bool

func (*SurfaceTokenService) ExchangeAssetTicket 

func (s *SurfaceTokenService) ExchangeAssetTicket(req ExchangeAssetTicketRequest) (AssetSessionResult, error)

func (*SurfaceTokenService) InspectBoundSurface 

func (s *SurfaceTokenService) InspectBoundSurface(req InspectBoundSurfaceRequest) (BoundSurfaceSession, error)

func (*SurfaceTokenService) MarkSurfacePrepared 

func (s *SurfaceTokenService) MarkSurfacePrepared(req MarkSurfacePreparedRequest) error

func (*SurfaceTokenService) MintConfirmationToken 

func (s *SurfaceTokenService) MintConfirmationToken(req MintConfirmationTokenRequest) (ConfirmationTokenResult, error)

func (*SurfaceTokenService) MintGatewayToken 

func (s *SurfaceTokenService) MintGatewayToken(req MintGatewayTokenRequest) (GatewayTokenResult, error)

func (*SurfaceTokenService) MintHandleGrant 

func (s *SurfaceTokenService) MintHandleGrant(req MintHandleGrantRequest) (HandleGrantResult, error)

func (*SurfaceTokenService) MintRuntimeExecutionLease 

func (s *SurfaceTokenService) MintRuntimeExecutionLease(req MintRuntimeExecutionLeaseRequest) (RuntimeExecutionLeaseResult, error)

func (*SurfaceTokenService) OpenSurface 

func (s *SurfaceTokenService) OpenSurface(req OpenSurfaceRequest) (SurfaceBootstrap, error)

func (*SurfaceTokenService) PreviewSessionScopeRevocation 

func (s *SurfaceTokenService) PreviewSessionScopeRevocation(scope sessionctx.SessionScope) (SessionScopeRevocation, error)

func (*SurfaceTokenService) ReconcileSurfaceRevocation 

func (s *SurfaceTokenService) ReconcileSurfaceRevocation(req DisposeSurfaceRequest) (ReconcileSurfaceRevocationResult, error)

ReconcileSurfaceRevocation atomically observes and revokes one bound surface. A retained closure makes retries after a lost response deterministic without widening the operation to the caller's session scope.

func (*SurfaceTokenService) RevokeAllSurfaces 

func (s *SurfaceTokenService) RevokeAllSurfaces(now time.Time) int

func (*SurfaceTokenService) RevokePlugin 

func (s *SurfaceTokenService) RevokePlugin(ownerEnvHash string, pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*SurfaceTokenService) RevokeSessionScope 

func (s *SurfaceTokenService) RevokeSessionScope(req RevokeSessionScopeRequest) (SessionScopeRevocation, error)

func (*SurfaceTokenService) RevokeSurfacesExceptGeneration 

func (s *SurfaceTokenService) RevokeSurfacesExceptGeneration(preservedGenerationID string, now time.Time) int

RevokeSurfacesExceptGeneration revokes sessions bound to runtime generations other than the explicitly preserved Host generation.

func (*SurfaceTokenService) ValidateAssetSession 

func (s *SurfaceTokenService) ValidateAssetSession(req ValidateAssetSessionRequest) (AssetSessionValidation, error)

func (*SurfaceTokenService) ValidateBridgeHandshake 

func (s *SurfaceTokenService) ValidateBridgeHandshake(req MintGatewayTokenRequest) (BridgeHandshakeValidation, error)

func (*SurfaceTokenService) ValidateConfirmationToken 

func (s *SurfaceTokenService) ValidateConfirmationToken(req ValidateConfirmationTokenRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateConfirmationTokenID 

func (s *SurfaceTokenService) ValidateConfirmationTokenID(req ValidateConfirmationTokenIDRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateGatewayToken 

func (s *SurfaceTokenService) ValidateGatewayToken(token string, audience Audience, revision RevisionBinding, now time.Time) (TokenRecord, error)

func (*SurfaceTokenService) ValidateHandleGrant 

func (s *SurfaceTokenService) ValidateHandleGrant(req ValidateHandleGrantRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateSurfaceGatewayToken 

func (s *SurfaceTokenService) ValidateSurfaceGatewayToken(req ValidateSurfaceGatewayTokenRequest) (TokenRecord, error)

type TokenKind 

type TokenKind string
const (
	TokenKindAssetTicket        TokenKind = "asset_ticket"
	TokenKindAssetSession       TokenKind = "asset_session"
	TokenKindPluginGatewayToken TokenKind = "plugin_gateway_token"
	TokenKindConfirmationToken  TokenKind = "confirmation_token"
	TokenKindHandleGrant        TokenKind = "handle_grant"
)

type TokenManager 

type TokenManager struct {
	// contains filtered or unexported fields
}

func NewTokenManager 

func NewTokenManager(options ...TokenManagerOptions) *TokenManager

func (*TokenManager) Inspect 

func (m *TokenManager) Inspect(req InspectRequest) (TokenRecord, error)

func (*TokenManager) Mint 

func (m *TokenManager) Mint(req MintRequest) (MintedToken, error)

func (*TokenManager) PreviewSessionScopeRevocation 

func (m *TokenManager) PreviewSessionScopeRevocation(scope sessionctx.SessionScope) (SessionTokenRevocationCounts, error)

func (*TokenManager) RevokePlugin 

func (m *TokenManager) RevokePlugin(ownerEnvHash string, pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*TokenManager) RevokeSessionScope 

func (m *TokenManager) RevokeSessionScope(scope sessionctx.SessionScope, now time.Time) (SessionTokenRevocationCounts, error)

func (*TokenManager) RevokeSurface 

func (m *TokenManager) RevokeSurface(ownerEnvHash string, pluginInstanceID string, surfaceInstanceID string, now time.Time) int

func (*TokenManager) RevokeSurfaceGeneration 

func (m *TokenManager) RevokeSurfaceGeneration(session SurfaceSession, now time.Time) int

RevokeSurfaceGeneration revokes only tokens minted for the exact surface generation. A replacement may intentionally reuse its surface instance ID, so that identifier alone is not a sufficient revocation boundary.

func (*TokenManager) RevokeTokenID 

func (m *TokenManager) RevokeTokenID(kind TokenKind, tokenID string, now time.Time) bool

func (*TokenManager) Snapshot 

func (m *TokenManager) Snapshot() []TokenRecord

func (*TokenManager) Validate 

func (m *TokenManager) Validate(req ValidateRequest) (TokenRecord, error)

func (*TokenManager) ValidateID 

func (m *TokenManager) ValidateID(req ValidateTokenIDRequest) (TokenRecord, error)

type TokenManagerOptions 

type TokenManagerOptions struct {
	MaxRecords          int
	MaxRecordsPerPlugin int
	MaxRevokeFloors     int
	MaxTTL              time.Duration
}

type TokenRecord 

type TokenRecord struct {
	Kind                 TokenKind       `json:"token_kind"`
	TokenID              string          `json:"token_id"`
	TokenHash            string          `json:"token_hash"`
	Audience             Audience        `json:"audience"`
	Revision             RevisionBinding `json:"revision"`
	IssuedAt             time.Time       `json:"issued_at"`
	ExpiresAt            time.Time       `json:"expires_at"`
	Nonce                string          `json:"nonce"`
	Use                  TokenUse        `json:"use"`
	Limits               Limits          `json:"limits,omitzero"`
	Consumed             bool            `json:"consumed"`
	ConsumedAt           *time.Time      `json:"consumed_at,omitempty"`
	Revoked              bool            `json:"revoked"`
	RevokedAt            *time.Time      `json:"revoked_at,omitempty"`
	BoundBridgeChannelID string          `json:"bound_bridge_channel_id,omitempty"`
}

type TokenUse 

type TokenUse string
const (
	TokenUseSingleUse TokenUse = "single_use"
	TokenUseReusable  TokenUse = "reusable"
)

type ValidateAssetSessionRequest 

type ValidateAssetSessionRequest struct {
	AssetSession         string    `json:"asset_session"`
	AssetSessionID       string    `json:"asset_session_id,omitempty"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type ValidateConfirmationTokenIDRequest 

type ValidateConfirmationTokenIDRequest struct {
	ConfirmationTokenID string          `json:"confirmation_token_id"`
	Audience            Audience        `json:"-"`
	Revision            RevisionBinding `json:"revision"`
	Now                 time.Time       `json:"-"`
}

type ValidateConfirmationTokenRequest 

type ValidateConfirmationTokenRequest struct {
	ConfirmationToken string          `json:"confirmation_token"`
	Audience          Audience        `json:"-"`
	Revision          RevisionBinding `json:"revision"`
	Now               time.Time       `json:"-"`
}

type ValidateHandleGrantRequest 

type ValidateHandleGrantRequest struct {
	HandleGrantToken string          `json:"handle_grant_token"`
	Audience         Audience        `json:"-"`
	Revision         RevisionBinding `json:"revision"`
	Now              time.Time       `json:"-"`
}

type ValidateRequest 

type ValidateRequest struct {
	Kind     TokenKind       `json:"kind"`
	Token    string          `json:"token"`
	Audience Audience        `json:"-"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"-"`
	Consume  bool            `json:"consume,omitempty"`
	Bind     *ChannelBinding `json:"bind,omitempty"`
}

type ValidateSurfaceGatewayTokenRequest 

type ValidateSurfaceGatewayTokenRequest struct {
	GatewayToken         string          `json:"plugin_gateway_token"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	BridgeChannelID      string          `json:"bridge_channel_id"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
}

type ValidateTokenIDRequest 

type ValidateTokenIDRequest struct {
	Kind     TokenKind       `json:"kind"`
	TokenID  string          `json:"token_id"`
	Audience Audience        `json:"-"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"-"`
	Consume  bool            `json:"consume,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.