bridge

package
v0.6.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultMaxTokenRecords          = 16_384
	DefaultMaxTokenRecordsPerPlugin = 2_048
	DefaultMaxTokenRevokeFloors     = 4_096
	DefaultMaxTokenTTL              = 15 * time.Minute
)
View Source 
const (
	DefaultAssetTicketTTL                   = 15 * time.Second
	MaxAssetTicketTTL                       = 60 * time.Second
	DefaultAssetSessionTTL                  = 10 * time.Minute
	MaxAssetSessionTTL                      = 15 * time.Minute
	DefaultGatewayTokenTTL                  = 10 * time.Minute
	MaxGatewayTokenTTL                      = 15 * time.Minute
	DefaultMaxActiveSurfaceSessions         = 4096
	DefaultMaxActiveSurfaceSessionsPerOwner = 64
	DefaultConfirmationTTL                  = 2 * time.Minute
	MaxConfirmationTTL                      = 5 * time.Minute
	MaxStreamTicketTTL                      = 5 * time.Minute
	DefaultRuntimeLeaseTTL                  = 30 * time.Second
	MaxRuntimeLeaseTTL                      = 5 * time.Minute
	DefaultHandleGrantTTL                   = 30 * time.Second
	MaxHandleGrantTTL                       = 60 * time.Second
	RouteRoleTrustedParent                  = "trusted_parent"
	RouteRoleTrustedIntent                  = "trusted_intent"
)

Variables

View Source 
var (
	ErrTokenInvalid             = errors.New("token is invalid")
	ErrTokenExpired             = errors.New("token is expired")
	ErrTokenReplay              = errors.New("token has already been consumed")
	ErrTokenAudience            = errors.New("token audience mismatch")
	ErrTokenKind                = errors.New("token kind mismatch")
	ErrTokenRevoked             = errors.New("token has been revoked")
	ErrTokenAlreadyBound        = errors.New("token is already bound to a different channel")
	ErrMissingTokenAudience     = errors.New("token audience is incomplete")
	ErrTokenCapacity            = errors.New("token manager capacity is exhausted")
	ErrTokenPluginCapacity      = errors.New("plugin token capacity is exhausted")
	ErrTokenTTLExceeded         = errors.New("token TTL exceeds the configured maximum")
	ErrTokenRevokeFloorCapacity = errors.New("token revoke-floor capacity is exhausted")
	ErrTokenRevision            = errors.New("token revision binding is invalid")
	ErrTokenLimits              = errors.New("token limits are invalid")
)
View Source 
var (
	ErrSurfaceSessionNotFound      = errors.New("surface session not found")
	ErrSurfaceSessionExpired       = errors.New("surface session expired")
	ErrSurfaceSessionAlreadyExists = errors.New("surface session already exists")
	ErrSurfaceSessionLimitReached  = errors.New("surface session limit reached")
	ErrHandshakeMismatch           = errors.New("bridge handshake mismatch")
	ErrAssetSessionRequired        = errors.New("asset session is required before bridge token mint")
)

Functions

func HandshakeTranscriptSHA256 

func HandshakeTranscriptSHA256(handshake Handshake, bridgeChannelID string) string

Types

type AssetSessionResult 

type AssetSessionResult struct {
	AssetSession       string    `json:"asset_session"`
	AssetSessionID     string    `json:"asset_session_id"`
	AssetSessionNonce  string    `json:"asset_session_nonce"`
	EntryPath          string    `json:"entry_path"`
	EntrySHA256        string    `json:"entry_sha256"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	IssuedAt           time.Time `json:"issued_at"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type AssetSessionValidation 

type AssetSessionValidation struct {
	Session SurfaceSession `json:"session"`
	TokenID string         `json:"token_id"`
}

type AssetTicket 

type AssetTicket struct {
	TicketID           string    `json:"ticket_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	OwnerEnvHash       string    `json:"owner_env_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type Audience 

type Audience struct {
	PluginID               string                   `json:"plugin_id,omitempty"`
	PluginInstanceID       string                   `json:"plugin_instance_id"`
	PluginVersion          string                   `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                   `json:"active_fingerprint"`
	SurfaceID              string                   `json:"surface_id,omitempty"`
	SurfaceInstanceID      string                   `json:"surface_instance_id,omitempty"`
	EntryPath              string                   `json:"entry_path,omitempty"`
	EntrySHA256            string                   `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string                   `json:"asset_session_nonce,omitempty"`
	RouteRole              string                   `json:"route_role,omitempty"`
	OwnerSessionHash       string                   `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                   `json:"owner_user_hash,omitempty"`
	OwnerEnvHash           string                   `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash   string                   `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                   `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                   `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                   `json:"runtime_generation_id,omitempty"`
	RuntimeShardID         string                   `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                   `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                   `json:"connection_nonce,omitempty"`
	StreamID               string                   `json:"stream_id,omitempty"`
	StreamDirection        string                   `json:"stream_direction,omitempty"`
	OperationID            string                   `json:"operation_id,omitempty"`
	AuditCorrelationID     string                   `json:"audit_correlation_id,omitempty"`
	HandleID               string                   `json:"handle_id,omitempty"`
	ConfirmationID         string                   `json:"confirmation_id,omitempty"`
	Method                 string                   `json:"method,omitempty"`
	RequestHash            string                   `json:"request_hash,omitempty"`
	PlanHash               string                   `json:"plan_hash,omitempty"`
	TargetDescriptorSHA256 string                   `json:"target_descriptor_sha256,omitempty"`
	ResourceScope          sessionctx.ResourceScope `json:"resource_scope,omitzero"`
}

type BridgeHandshakeValidation 

type BridgeHandshakeValidation struct {
	Session SurfaceSession `json:"session"`
}

type CallRequest 

type CallRequest struct {
	ID     string `json:"id"`
	Method string `json:"method"`
	Params any    `json:"params,omitempty"`
}

type ChannelBinding 

type ChannelBinding struct {
	BridgeChannelID string `json:"bridge_channel_id,omitempty"`
}

type ConfirmationTokenResult 

type ConfirmationTokenResult struct {
	ConfirmationToken   string    `json:"confirmation_token"`
	ConfirmationTokenID string    `json:"confirmation_token_id"`
	RequestHash         string    `json:"request_hash"`
	PlanHash            string    `json:"plan_hash"`
	IssuedAt            time.Time `json:"issued_at"`
	ExpiresAt           time.Time `json:"expires_at"`
}

type DisposeSurfaceRequest 

type DisposeSurfaceRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type ExchangeAssetTicketRequest 

type ExchangeAssetTicketRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetTicket          string    `json:"asset_ticket"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type GatewayToken 

type GatewayToken struct {
	TokenID            string    `json:"token_id"`
	PluginInstanceID   string    `json:"plugin_instance_id"`
	SurfaceInstanceID  string    `json:"surface_instance_id"`
	BridgeChannelID    string    `json:"bridge_channel_id"`
	ActiveFingerprint  string    `json:"active_fingerprint"`
	OwnerSessionHash   string    `json:"owner_session_hash,omitempty"`
	OwnerEnvHash       string    `json:"owner_env_hash,omitempty"`
	PolicyRevision     uint64    `json:"policy_revision"`
	ManagementRevision uint64    `json:"management_revision"`
	RevokeEpoch        uint64    `json:"revoke_epoch"`
	ExpiresAt          time.Time `json:"expires_at"`
}

type GatewayTokenResult 

type GatewayTokenResult struct {
	GatewayToken   string    `json:"plugin_gateway_token"`
	GatewayTokenID string    `json:"plugin_gateway_token_id"`
	AssetSession   string    `json:"asset_session"`
	AssetSessionID string    `json:"asset_session_id"`
	IssuedAt       time.Time `json:"issued_at"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type HandleGrantResult 

type HandleGrantResult struct {
	HandleGrantToken    string                   `json:"handle_grant_token"`
	HandleGrantID       string                   `json:"handle_grant_id"`
	RuntimeGenerationID string                   `json:"runtime_generation_id"`
	HandleID            string                   `json:"handle_id"`
	ResourceScope       sessionctx.ResourceScope `json:"resource_scope"`
	Limits              Limits                   `json:"limits,omitempty"`
	IssuedAt            time.Time                `json:"issued_at"`
	ExpiresAt           time.Time                `json:"expires_at"`
}

type Handshake 

type Handshake struct {
	PluginID           string `json:"plugin_id"`
	SurfaceID          string `json:"surface_id"`
	SurfaceInstanceID  string `json:"surface_instance_id"`
	ActiveFingerprint  string `json:"active_fingerprint"`
	BridgeNonce        string `json:"bridge_nonce"`
	AssetSessionNonce  string `json:"asset_session_nonce"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
	UIProtocolVersion  string `json:"ui_protocol_version"`
}

type InspectRequest 

type InspectRequest struct {
	Kind  TokenKind `json:"kind"`
	Token string    `json:"token"`
	Now   time.Time `json:"-"`
}

type Limits 

type Limits struct {
	MaxBytesPerSecond int64 `json:"max_bytes_per_second,omitempty"`
	MaxTotalBytes     int64 `json:"max_total_bytes,omitempty"`
}

type MarkSurfacePreparedRequest 

type MarkSurfacePreparedRequest struct {
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	AssetSessionID       string    `json:"asset_session_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type MintConfirmationTokenRequest 

type MintConfirmationTokenRequest struct {
	PluginID               string          `json:"plugin_id,omitempty"`
	PluginInstanceID       string          `json:"plugin_instance_id"`
	PluginVersion          string          `json:"plugin_version,omitempty"`
	ActiveFingerprint      string          `json:"active_fingerprint"`
	SurfaceID              string          `json:"surface_id,omitempty"`
	SurfaceInstanceID      string          `json:"surface_instance_id"`
	EntryPath              string          `json:"entry_path,omitempty"`
	EntrySHA256            string          `json:"entry_sha256,omitempty"`
	AssetSessionNonce      string          `json:"asset_session_nonce,omitempty"`
	RouteRole              string          `json:"route_role,omitempty"`
	ConfirmationID         string          `json:"confirmation_id"`
	OwnerSessionHash       string          `json:"-"`
	OwnerUserHash          string          `json:"-"`
	OwnerEnvHash           string          `json:"-"`
	SessionChannelIDHash   string          `json:"-"`
	BridgeChannelID        string          `json:"bridge_channel_id"`
	RuntimeGenerationID    string          `json:"runtime_generation_id,omitempty"`
	Method                 string          `json:"method"`
	RequestHash            string          `json:"request_hash"`
	PlanHash               string          `json:"plan_hash"`
	TargetDescriptorSHA256 string          `json:"target_descriptor_sha256"`
	Revision               RevisionBinding `json:"revision"`
	Now                    time.Time       `json:"-"`
	ExpiresAt              time.Time       `json:"expires_at,omitempty"`
}

type MintGatewayTokenRequest 

type MintGatewayTokenRequest struct {
	Handshake                 Handshake `json:"handshake"`
	BridgeChannelID           string    `json:"bridge_channel_id"`
	HandshakeTranscriptSHA256 string    `json:"handshake_transcript_sha256"`
	PreviousGatewayToken      string    `json:"previous_plugin_gateway_token,omitempty"`
	Now                       time.Time `json:"-"`
}

type MintHandleGrantRequest 

type MintHandleGrantRequest struct {
	PluginInstanceID     string                   `json:"plugin_instance_id"`
	ActiveFingerprint    string                   `json:"active_fingerprint"`
	RuntimeInstanceID    string                   `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID  string                   `json:"runtime_generation_id"`
	RuntimeShardID       string                   `json:"runtime_shard_id,omitempty"`
	OwnerSessionHash     string                   `json:"-"`
	OwnerUserHash        string                   `json:"-"`
	OwnerEnvHash         string                   `json:"-"`
	SessionChannelIDHash string                   `json:"-"`
	HandleID             string                   `json:"handle_id"`
	Method               string                   `json:"method"`
	ResourceScope        sessionctx.ResourceScope `json:"-"`
	Revision             RevisionBinding          `json:"revision"`
	Limits               Limits                   `json:"limits,omitempty"`
	Now                  time.Time                `json:"-"`
	ExpiresAt            time.Time                `json:"expires_at,omitempty"`
}

type MintRequest 

type MintRequest struct {
	Kind      TokenKind       `json:"kind"`
	Use       TokenUse        `json:"use,omitempty"`
	Audience  Audience        `json:"-"`
	Revision  RevisionBinding `json:"revision"`
	ExpiresAt time.Time       `json:"expires_at"`
	Now       time.Time       `json:"-"`
	Limits    Limits          `json:"limits,omitzero"`
}

type MintRuntimeExecutionLeaseRequest 

type MintRuntimeExecutionLeaseRequest struct {
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"-"`
	OwnerUserHash          string                      `json:"-"`
	OwnerEnvHash           string                      `json:"-"`
	SessionChannelIDHash   string                      `json:"-"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	OperationID            string                      `json:"operation_id,omitempty"`
	StreamID               string                      `json:"stream_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	Revision               RevisionBinding             `json:"revision"`
	Now                    time.Time                   `json:"-"`
	ExpiresAt              time.Time                   `json:"expires_at,omitempty"`
}

type MintStreamTicketRequest 

type MintStreamTicketRequest struct {
	PluginID             string          `json:"plugin_id,omitempty"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version,omitempty"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	SurfaceID            string          `json:"surface_id,omitempty"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	EntryPath            string          `json:"entry_path,omitempty"`
	EntrySHA256          string          `json:"entry_sha256,omitempty"`
	AssetSessionNonce    string          `json:"asset_session_nonce,omitempty"`
	RouteRole            string          `json:"route_role,omitempty"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	BridgeChannelID      string          `json:"bridge_channel_id"`
	RuntimeGenerationID  string          `json:"runtime_generation_id,omitempty"`
	StreamID             string          `json:"stream_id"`
	OperationID          string          `json:"operation_id"`
	StreamDirection      string          `json:"stream_direction"`
	Method               string          `json:"method"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
	ExpiresAt            time.Time       `json:"expires_at,omitempty"`
}

type MintedToken 

type MintedToken struct {
	Kind      TokenKind       `json:"token_kind"`
	TokenID   string          `json:"token_id"`
	Token     string          `json:"token"`
	Audience  Audience        `json:"audience"`
	Revision  RevisionBinding `json:"revision"`
	IssuedAt  time.Time       `json:"issued_at"`
	ExpiresAt time.Time       `json:"expires_at"`
	Nonce     string          `json:"nonce"`
	Use       TokenUse        `json:"use"`
	Limits    Limits          `json:"limits,omitzero"`
}

type OpenSurfaceRequest 

type OpenSurfaceRequest struct {
	PluginID             string          `json:"plugin_id"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version"`
	SurfaceID            string          `json:"surface_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	EntryPath            string          `json:"entry_path"`
	EntrySHA256          string          `json:"entry_sha256"`
	RouteRole            string          `json:"route_role"`
	RuntimeGenerationID  string          `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
}

type RevisionBinding 

type RevisionBinding struct {
	PolicyRevision     uint64 `json:"policy_revision"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
}

type RevokeSessionScopeRequest added in v0.6.0 

type RevokeSessionScopeRequest struct {
	SessionScope sessionctx.SessionScope `json:"-"`
	Now          time.Time               `json:"-"`
}

type RuntimeExecutionLeaseLimits 

type RuntimeExecutionLeaseLimits struct {
	TimeoutMillis           int64 `json:"timeout_ms,omitempty"`
	MemoryBytes             int64 `json:"memory_bytes,omitempty"`
	MaxPayloadBytes         int64 `json:"max_payload_bytes,omitempty"`
	MaxStreamBytesPerSecond int64 `json:"max_stream_bytes_per_sec,omitempty"`
}

type RuntimeExecutionLeaseResult 

type RuntimeExecutionLeaseResult struct {
	TokenID                string                      `json:"token_id"`
	LeaseID                string                      `json:"lease_id"`
	LeaseNonce             string                      `json:"lease_nonce"`
	PluginInstanceID       string                      `json:"plugin_instance_id"`
	PluginID               string                      `json:"plugin_id,omitempty"`
	PluginVersion          string                      `json:"plugin_version,omitempty"`
	ActiveFingerprint      string                      `json:"active_fingerprint"`
	SurfaceInstanceID      string                      `json:"surface_instance_id,omitempty"`
	OwnerSessionHash       string                      `json:"owner_session_hash,omitempty"`
	OwnerUserHash          string                      `json:"owner_user_hash,omitempty"`
	OwnerEnvHash           string                      `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash   string                      `json:"session_channel_id_hash,omitempty"`
	BridgeChannelID        string                      `json:"bridge_channel_id,omitempty"`
	RuntimeInstanceID      string                      `json:"runtime_instance_id,omitempty"`
	RuntimeGenerationID    string                      `json:"runtime_generation_id"`
	RuntimeShardID         string                      `json:"runtime_shard_id,omitempty"`
	IPCChannelID           string                      `json:"ipc_channel_id,omitempty"`
	ConnectionNonce        string                      `json:"connection_nonce,omitempty"`
	Method                 string                      `json:"method"`
	Effect                 string                      `json:"effect,omitempty"`
	Execution              string                      `json:"execution,omitempty"`
	OperationID            string                      `json:"operation_id,omitempty"`
	StreamID               string                      `json:"stream_id,omitempty"`
	AuditCorrelationID     string                      `json:"audit_correlation_id"`
	TargetDescriptorHashes []string                    `json:"target_descriptor_hashes,omitempty"`
	Limits                 RuntimeExecutionLeaseLimits `json:"limits,omitempty"`
	PolicyRevision         uint64                      `json:"policy_revision"`
	ManagementRevision     uint64                      `json:"management_revision"`
	RevokeEpoch            uint64                      `json:"revoke_epoch"`
	IssuedAt               time.Time                   `json:"issued_at"`
	IssuedAtUnixMillis     int64                       `json:"issued_at_unix_ms"`
	ExpiresAt              time.Time                   `json:"expires_at"`
	ExpiresAtUnixMillis    int64                       `json:"expires_at_unix_ms"`
}

type SessionScopeRevocation added in v0.6.0 

type SessionScopeRevocation struct {
	Surfaces uint64                       `json:"surfaces"`
	Tokens   SessionTokenRevocationCounts `json:"tokens"`
}

type SessionTokenRevocationCounts added in v0.6.0 

type SessionTokenRevocationCounts struct {
	AssetTickets        uint64 `json:"asset_tickets"`
	AssetSessions       uint64 `json:"asset_sessions"`
	PluginGatewayTokens uint64 `json:"plugin_gateway_tokens"`
	ConfirmationTokens  uint64 `json:"confirmation_tokens"`
	HandleGrants        uint64 `json:"handle_grants"`
	StreamTickets       uint64 `json:"stream_tickets"`
}

type StreamTicketResult 

type StreamTicketResult struct {
	StreamTicket   string    `json:"stream_ticket"`
	StreamTicketID string    `json:"stream_ticket_id"`
	StreamID       string    `json:"stream_id"`
	OperationID    string    `json:"operation_id"`
	Direction      string    `json:"stream_direction"`
	IssuedAt       time.Time `json:"issued_at"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type SurfaceBootstrap 

type SurfaceBootstrap struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceID            string    `json:"surface_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	AssetTicket          string    `json:"asset_ticket"`
	AssetTicketID        string    `json:"asset_ticket_id"`
	BridgeNonce          string    `json:"bridge_nonce"`
	IssuedAt             time.Time `json:"issued_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceSession 

type SurfaceSession struct {
	PluginID             string    `json:"plugin_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	PluginVersion        string    `json:"plugin_version"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	SurfaceID            string    `json:"surface_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	EntryPath            string    `json:"entry_path"`
	EntrySHA256          string    `json:"entry_sha256"`
	AssetSessionNonce    string    `json:"asset_session_nonce"`
	RouteRole            string    `json:"route_role"`
	RuntimeGenerationID  string    `json:"runtime_generation_id,omitempty"`
	OwnerSessionHash     string    `json:"owner_session_hash,omitempty"`
	OwnerUserHash        string    `json:"owner_user_hash,omitempty"`
	OwnerEnvHash         string    `json:"owner_env_hash,omitempty"`
	SessionChannelIDHash string    `json:"session_channel_id_hash,omitempty"`
	BridgeNonce          string    `json:"bridge_nonce"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	CreatedAt            time.Time `json:"created_at"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type SurfaceTokenOptions 

type SurfaceTokenOptions struct {
	AssetTicketTTL            time.Duration `json:"asset_ticket_ttl,omitempty"`
	AssetSessionTTL           time.Duration `json:"asset_session_ttl,omitempty"`
	GatewayTokenTTL           time.Duration `json:"gateway_token_ttl,omitempty"`
	MaxActiveSessions         int           `json:"max_active_sessions,omitempty"`
	MaxActiveSessionsPerOwner int           `json:"max_active_sessions_per_owner,omitempty"`
}

type SurfaceTokenService 

type SurfaceTokenService struct {
	// contains filtered or unexported fields
}

func NewSurfaceTokenService 

func NewSurfaceTokenService(tokens *TokenManager, options SurfaceTokenOptions) *SurfaceTokenService

func (*SurfaceTokenService) DisposeAssetSession 

func (s *SurfaceTokenService) DisposeAssetSession(req ValidateAssetSessionRequest) error

func (*SurfaceTokenService) DisposeBoundSurface 

func (s *SurfaceTokenService) DisposeBoundSurface(req DisposeSurfaceRequest) error

func (*SurfaceTokenService) DisposeSurface 

func (s *SurfaceTokenService) DisposeSurface(surfaceInstanceID string, now time.Time) bool

func (*SurfaceTokenService) ExchangeAssetTicket 

func (s *SurfaceTokenService) ExchangeAssetTicket(req ExchangeAssetTicketRequest) (AssetSessionResult, error)

func (*SurfaceTokenService) InspectBoundStreamTicket added in v0.3.0 

func (s *SurfaceTokenService) InspectBoundStreamTicket(req ValidateBoundStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) MarkSurfacePrepared 

func (s *SurfaceTokenService) MarkSurfacePrepared(req MarkSurfacePreparedRequest) error

func (*SurfaceTokenService) MintConfirmationToken 

func (s *SurfaceTokenService) MintConfirmationToken(req MintConfirmationTokenRequest) (ConfirmationTokenResult, error)

func (*SurfaceTokenService) MintGatewayToken 

func (s *SurfaceTokenService) MintGatewayToken(req MintGatewayTokenRequest) (GatewayTokenResult, error)

func (*SurfaceTokenService) MintHandleGrant 

func (s *SurfaceTokenService) MintHandleGrant(req MintHandleGrantRequest) (HandleGrantResult, error)

func (*SurfaceTokenService) MintRuntimeExecutionLease 

func (s *SurfaceTokenService) MintRuntimeExecutionLease(req MintRuntimeExecutionLeaseRequest) (RuntimeExecutionLeaseResult, error)

func (*SurfaceTokenService) MintStreamTicket 

func (s *SurfaceTokenService) MintStreamTicket(req MintStreamTicketRequest) (StreamTicketResult, error)

func (*SurfaceTokenService) OpenSurface 

func (s *SurfaceTokenService) OpenSurface(req OpenSurfaceRequest) (SurfaceBootstrap, error)

func (*SurfaceTokenService) PreviewSessionScopeRevocation added in v0.6.0 

func (s *SurfaceTokenService) PreviewSessionScopeRevocation(scope sessionctx.SessionScope) (SessionScopeRevocation, error)

func (*SurfaceTokenService) RevokeAllSurfaces 

func (s *SurfaceTokenService) RevokeAllSurfaces(now time.Time) int

func (*SurfaceTokenService) RevokePlugin 

func (s *SurfaceTokenService) RevokePlugin(ownerEnvHash string, pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*SurfaceTokenService) RevokeSessionScope added in v0.6.0 

func (s *SurfaceTokenService) RevokeSessionScope(req RevokeSessionScopeRequest) (SessionScopeRevocation, error)

func (*SurfaceTokenService) RevokeStreamTicketID added in v0.3.0 

func (s *SurfaceTokenService) RevokeStreamTicketID(tokenID string, now time.Time) bool

func (*SurfaceTokenService) RevokeSurfacesExceptGeneration added in v0.5.0 

func (s *SurfaceTokenService) RevokeSurfacesExceptGeneration(preservedGenerationID string, now time.Time) int

RevokeSurfacesExceptGeneration revokes sessions bound to runtime generations other than the explicitly preserved Host generation.

func (*SurfaceTokenService) ValidateAssetSession 

func (s *SurfaceTokenService) ValidateAssetSession(req ValidateAssetSessionRequest) (AssetSessionValidation, error)

func (*SurfaceTokenService) ValidateBoundStreamTicket 

func (s *SurfaceTokenService) ValidateBoundStreamTicket(req ValidateBoundStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateBridgeHandshake 

func (s *SurfaceTokenService) ValidateBridgeHandshake(req MintGatewayTokenRequest) (BridgeHandshakeValidation, error)

func (*SurfaceTokenService) ValidateConfirmationToken 

func (s *SurfaceTokenService) ValidateConfirmationToken(req ValidateConfirmationTokenRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateConfirmationTokenID 

func (s *SurfaceTokenService) ValidateConfirmationTokenID(req ValidateConfirmationTokenIDRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateGatewayToken 

func (s *SurfaceTokenService) ValidateGatewayToken(token string, audience Audience, revision RevisionBinding, now time.Time) (TokenRecord, error)

func (*SurfaceTokenService) ValidateHandleGrant 

func (s *SurfaceTokenService) ValidateHandleGrant(req ValidateHandleGrantRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateStreamTicket 

func (s *SurfaceTokenService) ValidateStreamTicket(req ValidateStreamTicketRequest) (TokenRecord, error)

func (*SurfaceTokenService) ValidateSurfaceGatewayToken 

func (s *SurfaceTokenService) ValidateSurfaceGatewayToken(req ValidateSurfaceGatewayTokenRequest) (TokenRecord, error)

type TokenKind 

type TokenKind string
const (
	TokenKindAssetTicket        TokenKind = "asset_ticket"
	TokenKindAssetSession       TokenKind = "asset_session"
	TokenKindPluginGatewayToken TokenKind = "plugin_gateway_token"
	TokenKindConfirmationToken  TokenKind = "confirmation_token"
	TokenKindHandleGrant        TokenKind = "handle_grant"
	TokenKindStreamTicket       TokenKind = "stream_ticket"
)

type TokenManager 

type TokenManager struct {
	// contains filtered or unexported fields
}

func NewTokenManager 

func NewTokenManager(options ...TokenManagerOptions) *TokenManager

func (*TokenManager) Inspect 

func (m *TokenManager) Inspect(req InspectRequest) (TokenRecord, error)

func (*TokenManager) Mint 

func (m *TokenManager) Mint(req MintRequest) (MintedToken, error)

func (*TokenManager) PreviewSessionScopeRevocation added in v0.6.0 

func (m *TokenManager) PreviewSessionScopeRevocation(scope sessionctx.SessionScope) (SessionTokenRevocationCounts, error)

func (*TokenManager) RevokePlugin 

func (m *TokenManager) RevokePlugin(ownerEnvHash string, pluginInstanceID string, minimumRevokeEpoch uint64, now time.Time) (int, error)

func (*TokenManager) RevokeSessionScope added in v0.6.0 

func (m *TokenManager) RevokeSessionScope(scope sessionctx.SessionScope, now time.Time) (SessionTokenRevocationCounts, error)

func (*TokenManager) RevokeSurface 

func (m *TokenManager) RevokeSurface(ownerEnvHash string, pluginInstanceID string, surfaceInstanceID string, now time.Time) int

func (*TokenManager) RevokeTokenID 

func (m *TokenManager) RevokeTokenID(kind TokenKind, tokenID string, now time.Time) bool

func (*TokenManager) Snapshot 

func (m *TokenManager) Snapshot() []TokenRecord

func (*TokenManager) Validate 

func (m *TokenManager) Validate(req ValidateRequest) (TokenRecord, error)

func (*TokenManager) ValidateID 

func (m *TokenManager) ValidateID(req ValidateTokenIDRequest) (TokenRecord, error)

type TokenManagerOptions 

type TokenManagerOptions struct {
	MaxRecords          int
	MaxRecordsPerPlugin int
	MaxRevokeFloors     int
	MaxTTL              time.Duration
}

type TokenRecord 

type TokenRecord struct {
	Kind                 TokenKind       `json:"token_kind"`
	TokenID              string          `json:"token_id"`
	TokenHash            string          `json:"token_hash"`
	Audience             Audience        `json:"audience"`
	Revision             RevisionBinding `json:"revision"`
	IssuedAt             time.Time       `json:"issued_at"`
	ExpiresAt            time.Time       `json:"expires_at"`
	Nonce                string          `json:"nonce"`
	Use                  TokenUse        `json:"use"`
	Limits               Limits          `json:"limits,omitzero"`
	Consumed             bool            `json:"consumed"`
	ConsumedAt           *time.Time      `json:"consumed_at,omitempty"`
	Revoked              bool            `json:"revoked"`
	RevokedAt            *time.Time      `json:"revoked_at,omitempty"`
	BoundBridgeChannelID string          `json:"bound_bridge_channel_id,omitempty"`
}

type TokenUse 

type TokenUse string
const (
	TokenUseSingleUse TokenUse = "single_use"
	TokenUseReusable  TokenUse = "reusable"
)

type ValidateAssetSessionRequest 

type ValidateAssetSessionRequest struct {
	AssetSession         string    `json:"asset_session"`
	AssetSessionID       string    `json:"asset_session_id,omitempty"`
	OwnerSessionHash     string    `json:"-"`
	OwnerUserHash        string    `json:"-"`
	OwnerEnvHash         string    `json:"-"`
	SessionChannelIDHash string    `json:"-"`
	Now                  time.Time `json:"-"`
}

type ValidateBoundStreamTicketRequest 

type ValidateBoundStreamTicketRequest struct {
	StreamTicket         string          `json:"stream_ticket"`
	PluginID             string          `json:"plugin_id"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	PluginVersion        string          `json:"plugin_version"`
	ActiveFingerprint    string          `json:"active_fingerprint"`
	SurfaceID            string          `json:"surface_id,omitempty"`
	SurfaceInstanceID    string          `json:"surface_instance_id,omitempty"`
	EntryPath            string          `json:"entry_path,omitempty"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	BridgeChannelID      string          `json:"bridge_channel_id,omitempty"`
	StreamID             string          `json:"stream_id"`
	OperationID          string          `json:"operation_id"`
	StreamDirection      string          `json:"stream_direction"`
	Method               string          `json:"method"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
}

type ValidateConfirmationTokenIDRequest 

type ValidateConfirmationTokenIDRequest struct {
	ConfirmationTokenID string          `json:"confirmation_token_id"`
	Audience            Audience        `json:"-"`
	Revision            RevisionBinding `json:"revision"`
	Now                 time.Time       `json:"-"`
}

type ValidateConfirmationTokenRequest 

type ValidateConfirmationTokenRequest struct {
	ConfirmationToken string          `json:"confirmation_token"`
	Audience          Audience        `json:"-"`
	Revision          RevisionBinding `json:"revision"`
	Now               time.Time       `json:"-"`
}

type ValidateHandleGrantRequest 

type ValidateHandleGrantRequest struct {
	HandleGrantToken string          `json:"handle_grant_token"`
	Audience         Audience        `json:"-"`
	Revision         RevisionBinding `json:"revision"`
	Now              time.Time       `json:"-"`
}

type ValidateRequest 

type ValidateRequest struct {
	Kind     TokenKind       `json:"kind"`
	Token    string          `json:"token"`
	Audience Audience        `json:"-"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"-"`
	Consume  bool            `json:"consume,omitempty"`
	Bind     *ChannelBinding `json:"bind,omitempty"`
}

type ValidateStreamTicketRequest 

type ValidateStreamTicketRequest struct {
	StreamTicket string          `json:"stream_ticket"`
	Audience     Audience        `json:"-"`
	Revision     RevisionBinding `json:"revision"`
	Now          time.Time       `json:"-"`
}

type ValidateSurfaceGatewayTokenRequest 

type ValidateSurfaceGatewayTokenRequest struct {
	GatewayToken         string          `json:"plugin_gateway_token"`
	PluginInstanceID     string          `json:"plugin_instance_id"`
	SurfaceInstanceID    string          `json:"surface_instance_id"`
	OwnerSessionHash     string          `json:"-"`
	OwnerUserHash        string          `json:"-"`
	OwnerEnvHash         string          `json:"-"`
	SessionChannelIDHash string          `json:"-"`
	BridgeChannelID      string          `json:"bridge_channel_id"`
	Revision             RevisionBinding `json:"revision"`
	Now                  time.Time       `json:"-"`
}

type ValidateTokenIDRequest 

type ValidateTokenIDRequest struct {
	Kind     TokenKind       `json:"kind"`
	TokenID  string          `json:"token_id"`
	Audience Audience        `json:"-"`
	Revision RevisionBinding `json:"revision"`
	Now      time.Time       `json:"-"`
	Consume  bool            `json:"consume,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.