bridge

package
v0.4.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2026 License: MIT Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultMaxTokenRecords          = 16_384
	DefaultMaxTokenRecordsPerPlugin = 2_048
	DefaultMaxTokenRevokeFloors     = 4_096
	DefaultMaxTokenTTL              = 15 * time.Minute
)
View Source 
const (
	DefaultAssetTicketTTL                   = 15 * time.Second
	MaxAssetTicketTTL                       = 60 * time.Second
	DefaultAssetSessionTTL                  = 10 * time.Minute
	MaxAssetSessionTTL                      = 15 * time.Minute
	DefaultGatewayTokenTTL                  = 10 * time.Minute
	MaxGatewayTokenTTL                      = 15 * time.Minute
	DefaultMaxActiveSurfaceSessions         = 4096
	DefaultMaxActiveSurfaceSessionsPerOwner = 64
	DefaultConfirmationTTL                  = 2 * time.Minute
	MaxConfirmationTTL                      = 5 * time.Minute
	MaxStreamTicketTTL                      = 5 * time.Minute
	DefaultRuntimeLeaseTTL                  = 30 * time.Second
	MaxRuntimeLeaseTTL                      = 5 * time.Minute
	DefaultHandleGrantTTL                   = 30 * time.Second
	MaxHandleGrantTTL                       = 60 * time.Second
	RouteRoleTrustedParent                  = "trusted_parent"
	RouteRoleTrustedIntent                  = "trusted_intent"
)

Variables

View Source 
var (
	ErrTokenInvalid             = errors.New("token is invalid")
	ErrTokenExpired             = errors.New("token is expired")
	ErrTokenReplay              = errors.New("token has already been consumed")
	ErrTokenAudience            = errors.New("token audience mismatch")
	ErrTokenKind                = errors.New("token kind mismatch")
	ErrTokenRevoked             = errors.New("token has been revoked")
	ErrTokenAlreadyBound        = errors.New("token is already bound to a different channel")
	ErrMissingTokenAudience     = errors.New("token audience is incomplete")
	ErrTokenCapacity            = errors.New("token manager capacity is exhausted")
	ErrTokenPluginCapacity      = errors.New("plugin token capacity is exhausted")
	ErrTokenTTLExceeded         = errors.New("token TTL exceeds the configured maximum")
	ErrTokenRevokeFloorCapacity = errors.New("token revoke-floor capacity is exhausted")
)
View Source 
var (
	ErrSurfaceSessionNotFound      = errors.New("surface session not found")
	ErrSurfaceSessionExpired       = errors.New("surface session expired")
	ErrSurfaceSessionAlreadyExists = errors.New("surface session already exists")
	ErrSurfaceSessionLimitReached  = errors.New("surface session limit reached")
	ErrHandshakeMismatch           = errors.New("bridge handshake mismatch")
	ErrAssetSessionRequired        = errors.New("asset session is required before bridge token mint")
)

Functions

func HandshakeTranscriptSHA256 

func HandshakeTranscriptSHA256(handshake Handshake, bridgeChannelID string) string

Types

type AssetSessionResult 

type AssetSessionResult struct {
	AssetSession       string    `json:"asset_session"`
	AssetSessionID     string    `json:"asset_session_id"`
	AssetSessionNonce  string    `json:"asset_session_nonce"`
	EntryPath          string    `json:"entry_path"`
	EntrySHA256        string    `json:"entry_sha256"`
	PluginStateVersion uint64    `json:"plugin_state_version"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	IssuedAt           time.Time `json:"issued_at"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type AssetSessionValidation 

type AssetSessionValidation struct {
	Session SurfaceSession `json:"session"`
	TokenID string         `json:"token_id"`
}

type AssetTicket 

type AssetTicket struct {
	TicketID           string    `json:"ticket_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type Audience 

type Audience struct {
	PluginID               string `json:"plugin_id,omitempty"`
	PluginInstanceID       string `json:"plugin_instance_id"`
	PluginVersion          string `json:"plugin_version,omitempty"`
	ActiveFingerprint      string `json:"active_fingerprint"`
	SurfaceID              string `json:"surface_id,omitempty"`
	SurfaceInstanceID      string `json:"surface_instance_id,omitempty"`
	EntryPath              string `json:"entry_path,omitempty"`
	EntrySHA256            string `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string `json:"asset_session_nonce,omitempty"`
	RouteRole              string `json:"route_role,omitempty"`
	OwnerSessionHash       string `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash   string `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string `json:"runtime_generation_id,omitempty"`
	RuntimeShardID         string `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string `json:"connection_nonce,omitempty"`
	StreamID               string `json:"stream_id,omitempty"`
	StreamDirection        string `json:"stream_direction,omitempty"`
	OperationID            string `json:"operation_id,omitempty"`
	AuditCorrelationID     string `json:"audit_correlation_id,omitempty"`
	HandleID               string `json:"handle_id,omitempty"`
	ConfirmationID         string `json:"confirmation_id,omitempty"`
	Method                 string `json:"method,omitempty"`
	RequestHash            string `json:"request_hash,omitempty"`
	PlanHash               string `json:"plan_hash,omitempty"`
	TargetDescriptorSHA256 string `json:"target_descriptor_sha256,omitempty"`
}

type BridgeHandshakeValidation 

type BridgeHandshakeValidation struct {
	Session SurfaceSession `json:"session"`
}

type CallRequest 

type CallRequest struct {
	ID     string `json:"id"`
	Method string `json:"method"`
	Params any    `json:"params,omitempty"`
}

type ChannelBinding 

type ChannelBinding struct {
	BridgeChannelID string `json:"bridge_channel_id,omitempty"`
}

type CommitSingleUseRequest added in v0.3.0 

type CommitSingleUseRequest struct {
	Kind     TokenKind
	Token    string
	Now      time.Time
	Validate func(TokenRecord) error
}

type ConfirmationTokenResult 

type ConfirmationTokenResult struct {
	ConfirmationToken   string    `json:"confirmation_token"`
	ConfirmationTokenID string    `json:"confirmation_token_id"`
	RequestHash         string    `json:"request_hash"`
	PlanHash            string    `json:"plan_hash"`
	IssuedAt            time.Time `json:"issued_at"`
	ExpiresAt           time.Time `json:"expires_at"`
}

type DisposeSurfaceRequest 

type DisposeSurfaceRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash"`
	Now                  time.Time `json:"now,omitempty"`
}

type ExchangeAssetTicketRequest 

type ExchangeAssetTicketRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetTicket          string    `json:"asset_ticket"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	Now                  time.Time `json:"now,omitempty"`
}

type GatewayToken 

type GatewayToken struct {
	TokenID            string    `json:"token_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	BridgeChannelID    string    `json:"bridge_channel_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type GatewayTokenResult 

type GatewayTokenResult struct {
	GatewayToken   string    `json:"plugin_gateway_token"`
	GatewayTokenID string    `json:"plugin_gateway_token_id"`
	AssetSession   string    `json:"asset_session"`
	AssetSessionID string    `json:"asset_session_id"`
	IssuedAt       time.Time `json:"issued_at"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type HandleGrantResult 

type HandleGrantResult struct {
	HandleGrantToken    string    `json:"handle_grant_token"`
	HandleGrantID       string    `json:"handle_grant_id"`
	RuntimeGenerationID string    `json:"runtime_generation_id"`
	HandleID            string    `json:"handle_id"`
	Limits              Limits    `json:"limits,omitempty"`
	IssuedAt            time.Time `json:"issued_at"`
	ExpiresAt           time.Time `json:"expires_at"`
}

type Handshake 

type Handshake struct {
	PluginID           string `json:"plugin_id"`
	SurfaceID          string `json:"surface_id"`
	SurfaceInstanceID  string `json:"surface_instance_id"`
	ActiveFingerprint  string `json:"active_fingerprint"`
	BridgeNonce        string `json:"bridge_nonce"`
	AssetSessionNonce  string `json:"asset_session_nonce"`
	PluginStateVersion uint64 `json:"plugin_state_version"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
	UIProtocolVersion  string `json:"ui_protocol_version"`
}

type InspectRequest 

type InspectRequest struct {
	Kind  TokenKind `json:"kind"`
	Token string    `json:"token"`
	Now   time.Time `json:"now,omitempty"`
}

type Limits 

type Limits struct {
	MaxBytesPerSecond int64 `json:"max_bytes_per_second,omitempty"`
	MaxTotalBytes     int64 `json:"max_total_bytes,omitempty"`
}

type MarkSurfacePreparedRequest 

type MarkSurfacePreparedRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetSessionID       string    `json:"asset_session_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash"`
	Now                  time.Time `json:"now,omitempty"`
}

type MintConfirmationTokenRequest 

type MintConfirmationTokenRequest struct {
	PluginID               string          `json:"plugin_id,omitempty"`
	PluginInstanceID       string          `json:"plugin_instance_id"`
	PluginVersion          string          `json:"plugin_version,omitempty"`
	ActiveFingerprint      string          `json:"active_fingerprint"`
	SurfaceID              string          `json:"surface_id,omitempty"`
	SurfaceInstanceID      string          `json:"surface_instance_id"`
	EntryPath              string          `json:"entry_path,omitempty"`
	EntrySHA256            string          `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string          `json:"asset_session_nonce,omitempty"`
	RouteRole              string          `json:"route_role,omitempty"`
	ConfirmationID         string          `json:"confirmation_id"`
	OwnerSessionHash       string          `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string          `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash   string          `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string          `json:"bridge_channel_id"`
	RuntimeGenerationID    string          `json:"runtime_generation_id,omitempty"`
	Method                 string          `json:"method"`
	RequestHash            string          `json:"request_hash"`
	PlanHash               string          `json:"plan_hash"`
	TargetDescriptorSHA256 string          `json:"target_descriptor_sha256"`
	Revision               RevisionBinding `json:"revision"`
	Now                    time.Time       `json:"now,omitempty"`
	ExpiresAt              time.Time       `json:"expires_at,omitempty"`
}

type MintGatewayTokenRequest 

type MintGatewayTokenRequest struct {
	Handshake                 Handshake `json:"handshake"`
	BridgeChannelID           string    `json:"bridge_channel_id"`
	HandshakeTranscriptSHA256 string    `json:"handshake_transcript_sha256"`
	PreviousGatewayToken      string    `json:"previous_plugin_gateway_token,omitempty"`
	Now                       time.Time `json:"now,omitempty"`
}

type MintHandleGrantRequest 

type MintHandleGrantRequest struct {
	PluginInstanceID    string          `json:"plugin_instance_id"`
	ActiveFingerprint   string          `json:"active_fingerprint"`
	RuntimeInstanceID   string          `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID string          `json:"runtime_generation_id"`
	RuntimeShardID      string          `json:"runtime_shard_id,omitempty"`
	HandleID            string          `json:"handle_id"`
	Method              string          `json:"method"`
	Revision            RevisionBinding `json:"revision"`
	Limits              Limits          `json:"limits,omitempty"`
	Now                 time.Time       `json:"now,omitempty"`
	ExpiresAt           time.Time       `json:"expires_at,omitempty"`
}

type MintRequest 

type MintRequest struct {
	Kind      TokenKind       `json:"kind"`
	Use       TokenUse        `json:"use,omitempty"`
	Audience  Audience        `json:"audience"`
	Revision  RevisionBinding `json:"revision"`
	ExpiresAt time.Time       `json:"expires_at"`
	Now       time.Time       `json:"now,omitempty"`
	Limits    Limits          `json:"limits,omitzero"`
}

type MintRuntimeExecutionLeaseRequest 

type MintRuntimeExecutionLeaseRequest struct {
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                      `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash   string                      `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	OperationID            string                      `json:"operation_id,omitempty"`
	StreamID               string                      `json:"stream_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	Revision               RevisionBinding             `json:"revision"`
	Now                    time.Time                   `json:"now,omitempty"`
	ExpiresAt              time.Time                   `json:"expires_at,omitempty"`
}

type MintStreamTicketRequest 

type MintStreamTicketRequest struct {
	PluginID             string          `json:"plugin_id,omitempty"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version,omitempty"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	SurfaceID            string          `json:"surface_id,omitempty"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	EntryPath            string          `json:"entry_path,omitempty"`
	EntrySHA256          string          `json:"entry_sha256,omitempty"`
	AssetSessionNonce    string          `json:"asset_session_nonce,omitempty"`
	RouteRole            string          `json:"route_role,omitempty"`
	OwnerSessionHash     string          `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string          `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string          `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID      string          `json:"bridge_channel_id"`
	RuntimeGenerationID  string          `json:"runtime_generation_id,omitempty"`
	StreamID             string          `json:"stream_id"`
	OperationID          string          `json:"operation_id"`
	StreamDirection      string          `json:"stream_direction"`
	Method               string          `json:"method"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"now,omitempty"`
	ExpiresAt            time.Time       `json:"expires_at,omitempty"`
}

type MintedToken 

type MintedToken struct {
	Kind      TokenKind       `json:"token_kind"`
	TokenID   string          `json:"token_id"`
	Token     string          `json:"token"`
	Audience  Audience        `json:"audience"`
	Revision  RevisionBinding `json:"revision"`
	IssuedAt  time.Time       `json:"issued_at"`
	ExpiresAt time.Time       `json:"expires_at"`
	Nonce     string          `json:"nonce"`
	Use       TokenUse        `json:"use"`
	Limits    Limits          `json:"limits,omitzero"`
}

type OpenSurfaceRequest 

type OpenSurfaceRequest struct {
	PluginID             string          `json:"plugin_id"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version"`
	SurfaceID            string          `json:"surface_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	EntryPath            string          `json:"entry_path"`
	EntrySHA256          string          `json:"entry_sha256"`
	RouteRole            string          `json:"route_role"`
	RuntimeGenerationID  string          `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string          `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string          `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string          `json:"session_channel_id_hash,omitempty"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"now,omitempty"`
}

type RevisionBinding 

type RevisionBinding struct {
	PolicyRevision     uint64 `json:"policy_revision"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
}

type RevokeSurfaceScopeRequest 

type RevokeSurfaceScopeRequest struct {
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	Now                  time.Time `json:"now,omitempty"`
}

type RotateBoundStreamTicketResult added in v0.3.0 

type RotateBoundStreamTicketResult struct {
	Current TokenRecord
	Next    *StreamTicketResult
}

type RotateSingleUseRequest added in v0.3.0 

type RotateSingleUseRequest struct {
	Kind          TokenKind
	Token         string
	Now           time.Time
	NextExpiresAt time.Time
	Validate      func(TokenRecord) error
}

type RotateSingleUseResult added in v0.3.0 

type RotateSingleUseResult struct {
	Current TokenRecord
	Next    *MintedToken
}

type RuntimeExecutionLeaseLimits 

type RuntimeExecutionLeaseLimits struct {
	TimeoutMillis           int64 `json:"timeout_ms,omitempty"`
	MemoryBytes             int64 `json:"memory_bytes,omitempty"`
	MaxPayloadBytes         int64 `json:"max_payload_bytes,omitempty"`
	MaxStreamBytesPerSecond int64 `json:"max_stream_bytes_per_sec,omitempty"`
}

type RuntimeExecutionLeaseResult 

type RuntimeExecutionLeaseResult struct {
	TokenKind              TokenKind                   `json:"token_kind"`
	TokenID                string                      `json:"token_id"`
	LeaseToken             string                      `json:"lease_token"`
	LeaseID                string                      `json:"lease_id"`
	LeaseNonce             string                      `json:"lease_nonce"`
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                      `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash   string                      `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	OperationID            string                      `json:"operation_id,omitempty"`
	StreamID               string                      `json:"stream_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	PolicyRevision         uint64                      `json:"policy_revision"`
	ManagementRevision     uint64                      `json:"management_revision"`
	RevokeEpoch            uint64                      `json:"revoke_epoch"`
	IssuedAt               time.Time                   `json:"issued_at"`
	IssuedAtUnixMillis     int64                       `json:"issued_at_unix_ms"`
	ExpiresAt              time.Time                   `json:"expires_at"`
	ExpiresAtUnixMillis    int64                       `json:"expires_at_unix_ms"`
}

type StreamTicketResult 

type StreamTicketResult struct {
	StreamTicket   string    `json:"stream_ticket"`
	StreamTicketID string    `json:"stream_ticket_id"`
	StreamID       string    `json:"stream_id"`
	OperationID    string    `json:"operation_id"`
	Direction      string    `json:"stream_direction"`
	IssuedAt       time.Time `json:"issued_at"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type SurfaceBootstrap 

type SurfaceBootstrap struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceID            string    `json:"surface_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	PluginStateVersion   uint64    `json:"plugin_state_version"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	AssetTicket          string    `json:"asset_ticket"`
	AssetTicketID        string    `json:"asset_ticket_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	IssuedAt             time.Time `json:"issued_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceSession 

type SurfaceSession struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	SurfaceID            string    `json:"surface_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	RouteRole            string    `json:"route_role"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	BridgeNonce          string    `json:"bridge_nonce"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	CreatedAt            time.Time `json:"created_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceTokenOptions 

type SurfaceTokenOptions struct {
	AssetTicketTTL            time.Duration `json:"asset_ticket_ttl,omitempty"`
	AssetSessionTTL           time.Duration `json:"asset_session_ttl,omitempty"`
	GatewayTokenTTL           time.Duration `json:"gateway_token_ttl,omitempty"`
	MaxActiveSessions         int           `json:"max_active_sessions,omitempty"`
	MaxActiveSessionsPerOwner int           `json:"max_active_sessions_per_owner,omitempty"`
}

type SurfaceTokenService 

type SurfaceTokenService struct {
	// contains filtered or unexported fields
}

func NewSurfaceTokenService 

func NewSurfaceTokenService(tokens *TokenManager, options SurfaceTokenOptions) *SurfaceTokenService

func (*SurfaceTokenService) CommitBoundStreamTicket added in v0.3.0 

func (s *SurfaceTokenService) CommitBoundStreamTicket(req ValidateBoundStreamTicketRequest, commit func() error) (TokenRecord, error)

CommitBoundStreamTicket serializes a terminal stream mutation with ticket consumption without reserving a replacement credential.

func (*SurfaceTokenService) DisposeAssetSession 

func (s *SurfaceTokenService) DisposeAssetSession(req ValidateAssetSessionRequest) error

func (*SurfaceTokenService) DisposeBoundSurface 

func (s *SurfaceTokenService) DisposeBoundSurface(req DisposeSurfaceRequest) error

func (*SurfaceTokenService) DisposeSurface 

func (s *SurfaceTokenService) DisposeSurface(surfaceInstanceID string, now time.Time) bool

func (*SurfaceTokenService) ExchangeAssetTicket 

func (s *SurfaceTokenService) ExchangeAssetTicket(req ExchangeAssetTicketRequest) (AssetSessionResult, error)

func (*SurfaceTokenService) InspectBoundStreamTicket added in v0.3.0 

func (s *SurfaceTokenService) InspectBoundStreamTicket(req ValidateBoundStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) MarkSurfacePrepared 

func (s *SurfaceTokenService) MarkSurfacePrepared(req MarkSurfacePreparedRequest) error

func (*SurfaceTokenService) MintConfirmationToken 

func (s *SurfaceTokenService) MintConfirmationToken(req MintConfirmationTokenRequest) (ConfirmationTokenResult, error)

func (*SurfaceTokenService) MintGatewayToken 

func (s *SurfaceTokenService) MintGatewayToken(req MintGatewayTokenRequest) (GatewayTokenResult, error)

func (*SurfaceTokenService) MintHandleGrant 

func (s *SurfaceTokenService) MintHandleGrant(req MintHandleGrantRequest) (HandleGrantResult, error)

func (*SurfaceTokenService) MintRuntimeExecutionLease 

func (s *SurfaceTokenService) MintRuntimeExecutionLease(req MintRuntimeExecutionLeaseRequest) (RuntimeExecutionLeaseResult, error)

func (*SurfaceTokenService) MintStreamTicket 

func (s *SurfaceTokenService) MintStreamTicket(req MintStreamTicketRequest) (StreamTicketResult, error)

func (*SurfaceTokenService) OpenSurface 

func (s *SurfaceTokenService) OpenSurface(req OpenSurfaceRequest) (SurfaceBootstrap, error)

func (*SurfaceTokenService) RevokeAllSurfaces 

func (s *SurfaceTokenService) RevokeAllSurfaces(now time.Time) int

func (*SurfaceTokenService) RevokePlugin 

func (s *SurfaceTokenService) RevokePlugin(pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*SurfaceTokenService) RevokeStreamTicketID added in v0.3.0 

func (s *SurfaceTokenService) RevokeStreamTicketID(tokenID string, now time.Time) bool

func (*SurfaceTokenService) RevokeSurfaceScope 

func (s *SurfaceTokenService) RevokeSurfaceScope(req RevokeSurfaceScopeRequest) (int, error)

func (*SurfaceTokenService) RotateBoundStreamTicket added in v0.3.0 

func (s *SurfaceTokenService) RotateBoundStreamTicket(req ValidateBoundStreamTicketRequest, commit func() (bool, error)) (RotateBoundStreamTicketResult, error)

RotateBoundStreamTicket serializes the final stream mutation with ticket consumption. A failed commit leaves the current ticket reusable.

func (*SurfaceTokenService) ValidateAssetSession 

func (s *SurfaceTokenService) ValidateAssetSession(req ValidateAssetSessionRequest) (AssetSessionValidation, error)

func (*SurfaceTokenService) ValidateBoundStreamTicket 

func (s *SurfaceTokenService) ValidateBoundStreamTicket(req ValidateBoundStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateBridgeHandshake 

func (s *SurfaceTokenService) ValidateBridgeHandshake(req MintGatewayTokenRequest) (BridgeHandshakeValidation, error)

func (*SurfaceTokenService) ValidateConfirmationToken 

func (s *SurfaceTokenService) ValidateConfirmationToken(req ValidateConfirmationTokenRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateConfirmationTokenID 

func (s *SurfaceTokenService) ValidateConfirmationTokenID(req ValidateConfirmationTokenIDRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateGatewayToken 

func (s *SurfaceTokenService) ValidateGatewayToken(token string, audience Audience, revision RevisionBinding, now time.Time) (TokenRecord, error)

func (*SurfaceTokenService) ValidateHandleGrant 

func (s *SurfaceTokenService) ValidateHandleGrant(req ValidateHandleGrantRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateStreamTicket 

func (s *SurfaceTokenService) ValidateStreamTicket(req ValidateStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateSurfaceGatewayToken 

func (s *SurfaceTokenService) ValidateSurfaceGatewayToken(req ValidateSurfaceGatewayTokenRequest) (TokenRecord, error)

type TokenKind 

type TokenKind string
const (
	TokenKindAssetTicket           TokenKind = "asset_ticket"
	TokenKindAssetSession          TokenKind = "asset_session"
	TokenKindPluginGatewayToken    TokenKind = "plugin_gateway_token"
	TokenKindConfirmationToken     TokenKind = "confirmation_token"
	TokenKindRuntimeExecutionLease TokenKind = "runtime_execution_lease"
	TokenKindHandleGrant           TokenKind = "handle_grant"
	TokenKindStreamTicket          TokenKind = "stream_ticket"
)

type TokenManager 

type TokenManager struct {
	// contains filtered or unexported fields
}

func NewTokenManager 

func NewTokenManager(options ...TokenManagerOptions) *TokenManager

func (*TokenManager) CommitSingleUse added in v0.3.0 

func (m *TokenManager) CommitSingleUse(req CommitSingleUseRequest, commit func() error) (TokenRecord, error)

CommitSingleUse consumes a single-use token only after the guarded mutation succeeds. It is the terminal counterpart to RotateSingleUse and never reserves capacity for a replacement token.

func (*TokenManager) Inspect 

func (m *TokenManager) Inspect(req InspectRequest) (TokenRecord, error)

func (*TokenManager) Mint 

func (m *TokenManager) Mint(req MintRequest) (MintedToken, error)

func (*TokenManager) RevokePlugin 

func (m *TokenManager) RevokePlugin(pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*TokenManager) RevokeSurface 

func (m *TokenManager) RevokeSurface(surfaceInstanceID string, now time.Time) int

func (*TokenManager) RevokeTokenID 

func (m *TokenManager) RevokeTokenID(kind TokenKind, tokenID string, now time.Time) bool

func (*TokenManager) RotateSingleUse added in v0.3.0 

func (m *TokenManager) RotateSingleUse(req RotateSingleUseRequest, commit func() (bool, error)) (RotateSingleUseResult, error)

RotateSingleUse keeps the current token usable unless commit succeeds. The callback must only perform the short, final mutation guarded by the token.

func (*TokenManager) Snapshot 

func (m *TokenManager) Snapshot() []TokenRecord

func (*TokenManager) Validate 

func (m *TokenManager) Validate(req ValidateRequest) (TokenRecord, error)

func (*TokenManager) ValidateID 

func (m *TokenManager) ValidateID(req ValidateTokenIDRequest) (TokenRecord, error)

type TokenManagerOptions 

type TokenManagerOptions struct {
	MaxRecords          int
	MaxRecordsPerPlugin int
	MaxRevokeFloors     int
	MaxTTL              time.Duration
}

type TokenRecord 

type TokenRecord struct {
	Kind                 TokenKind       `json:"token_kind"`
	TokenID              string          `json:"token_id"`
	TokenHash            string          `json:"token_hash"`
	Audience             Audience        `json:"audience"`
	Revision             RevisionBinding `json:"revision"`
	IssuedAt             time.Time       `json:"issued_at"`
	ExpiresAt            time.Time       `json:"expires_at"`
	Nonce                string          `json:"nonce"`
	Use                  TokenUse        `json:"use"`
	Limits               Limits          `json:"limits,omitzero"`
	Consumed             bool            `json:"consumed"`
	ConsumedAt           *time.Time      `json:"consumed_at,omitempty"`
	Revoked              bool            `json:"revoked"`
	RevokedAt            *time.Time      `json:"revoked_at,omitempty"`
	BoundBridgeChannelID string          `json:"bound_bridge_channel_id,omitempty"`
}

type TokenUse 

type TokenUse string
const (
	TokenUseSingleUse TokenUse = "single_use"
	TokenUseReusable  TokenUse = "reusable"
)

type ValidateAssetSessionRequest 

type ValidateAssetSessionRequest struct {
	AssetSession         string    `json:"asset_session"`
	AssetSessionID       string    `json:"asset_session_id,omitempty"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	Now                  time.Time `json:"now,omitempty"`
}

type ValidateBoundStreamTicketRequest 

type ValidateBoundStreamTicketRequest struct {
	StreamTicket         string          `json:"stream_ticket"`
	PluginID             string          `json:"plugin_id"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	SurfaceID            string          `json:"surface_id,omitempty"`
	SurfaceInstanceID    string          `json:"surface_instance_id,omitempty"`
	EntryPath            string          `json:"entry_path,omitempty"`
	OwnerSessionHash     string          `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string          `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string          `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID      string          `json:"bridge_channel_id,omitempty"`
	StreamID             string          `json:"stream_id"`
	OperationID          string          `json:"operation_id"`
	StreamDirection      string          `json:"stream_direction"`
	Method               string          `json:"method"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"now,omitempty"`
}

type ValidateConfirmationTokenIDRequest 

type ValidateConfirmationTokenIDRequest struct {
	ConfirmationTokenID string          `json:"confirmation_token_id"`
	Audience            Audience        `json:"audience"`
	Revision            RevisionBinding `json:"revision"`
	Now                 time.Time       `json:"now,omitempty"`
}

type ValidateConfirmationTokenRequest 

type ValidateConfirmationTokenRequest struct {
	ConfirmationToken string          `json:"confirmation_token"`
	Audience          Audience        `json:"audience"`
	Revision          RevisionBinding `json:"revision"`
	Now               time.Time       `json:"now,omitempty"`
}

type ValidateHandleGrantRequest 

type ValidateHandleGrantRequest struct {
	HandleGrantToken string          `json:"handle_grant_token"`
	Audience         Audience        `json:"audience"`
	Revision         RevisionBinding `json:"revision"`
	Now              time.Time       `json:"now,omitempty"`
}

type ValidateRequest 

type ValidateRequest struct {
	Kind     TokenKind       `json:"kind"`
	Token    string          `json:"token"`
	Audience Audience        `json:"audience"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"now,omitempty"`
	Consume  bool            `json:"consume,omitempty"`
	Bind     *ChannelBinding `json:"bind,omitempty"`
}

type ValidateStreamTicketRequest 

type ValidateStreamTicketRequest struct {
	StreamTicket string          `json:"stream_ticket"`
	Audience     Audience        `json:"audience"`
	Revision     RevisionBinding `json:"revision"`
	Now          time.Time       `json:"now,omitempty"`
}

type ValidateSurfaceGatewayTokenRequest 

type ValidateSurfaceGatewayTokenRequest struct {
	GatewayToken         string          `json:"plugin_gateway_token"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	OwnerSessionHash     string          `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string          `json:"owner_user_hash,omitempty"`
	SessionChannelIDHash string          `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID      string          `json:"bridge_channel_id"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"now,omitempty"`
}

type ValidateTokenIDRequest 

type ValidateTokenIDRequest struct {
	Kind     TokenKind       `json:"kind"`
	TokenID  string          `json:"token_id"`
	Audience Audience        `json:"audience"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"now,omitempty"`
	Consume  bool            `json:"consume,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.