Documentation
¶
Overview ¶
Package auth holds the relay's own credentials: the teacher's admin token, a class's join code, and the session tokens the relay signs for students.
A session token is
"v1." + base64url(claims) + "." + base64url(Ed25519 signature over "v1." + base64url(claims))
where claims is a fixed binary layout (no JSON, no algorithm field: there is exactly one algorithm, so there is nothing to confuse):
u8 key id i64 expiry, unix seconds, big endian u8 len, class id u8 len, session id
The token is checked against the relay's clock only.
Index ¶
Constants ¶
const CodeLen = 10
CodeLen is a join code's length: 10 symbols of 5 bits, 50 bits.
const MaxTokenLen = 512
MaxTokenLen bounds what ParseToken will look at.
Variables ¶
var ( ErrMalformed = errors.New("auth: malformed token") ErrSignature = errors.New("auth: bad signature") ErrExpired = errors.New("auth: token expired") ErrKey = errors.New("auth: unknown key id") )
Errors from Verify. A client is told only "unauthenticated"; these are for the relay's log.
Functions ¶
func CleanDisplayName ¶
CleanDisplayName bounds and strips a display name: at most 40 runes, no control or format characters, trimmed. It is data, escaped wherever shown.
func Label ¶
Label derives a DNS label from a display name: lower-case ASCII letters and digits, hyphens between words, at most 20 bytes, never empty (it falls back to "student"). Collisions are the caller's to resolve.
func NormalizeJoinCode ¶
NormalizeJoinCode reads a typed code: case-insensitive, spaces and dashes ignored, and the look-alikes Crockford maps (O->0, I/L->1).
func RandomToken ¶
RandomToken is 32 random bytes, base64url: the admin token.
Types ¶
type Keys ¶
type Keys struct {
Current uint8
Private map[uint8]ed25519.PrivateKey
}
Keys signs and verifies session tokens. Keys are identified by a one-byte id so they can be rotated (the replicated store, later, distributes them).
Source Files