Documentation
¶
Index ¶
- Constants
- func AuthorizerOptions(timeout time.Duration) []biscuit.AuthorizerOption
- func EnforceExpiration(authorizer biscuit.Authorizer)
- func ExpirationOf(authorizer biscuit.Authorizer) (time.Time, error)
- func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, ...) ([]byte, []string, error)
- func MintBootstrapBiscuitToken(signingKey ed25519.PrivateKey, remotePeer peer.ID, role string, ...) ([]byte, error)
- func RequireAuthorityBinding(b *biscuit.Biscuit, expectedPeer peer.ID) error
- func VerifyAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, ...) (peer.ID, error)
- func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, ...) (*biscuit.Biscuit, error)
- func VerifyBiscuitAndGetKey(biscuitData []byte, expectedPeer peer.ID, ...) (*biscuit.Biscuit, ed25519.PublicKey, error)
- func VerifyBiscuitRole(biscuitData []byte, controlPlanePubKey ed25519.PublicKey, expectedRole string, ...) error
- func VerifyExpiredAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, ...) (peer.ID, error)
- func VerifyJWT(ctx context.Context, jwtStr string, allowedAudiences []string, ...) (jwt.MapClaims, *oidc.IDToken, error)
Constants ¶
const DefaultAuthorizerTimeout = 1 * time.Second
DefaultAuthorizerTimeout bounds Datalog evaluation when no timeout is configured. biscuit-go defaults to 2ms of wall-clock time, of which a single authorization of a realistic token already spends ~0.14ms (~1.1ms under -race), so ordinary scheduling noise turns into a spurious denial. The amount of work is bounded by the fact and iteration limits; this deadline only caps how long the caller waits.
Variables ¶
This section is empty.
Functions ¶
func AuthorizerOptions ¶
func AuthorizerOptions(timeout time.Duration) []biscuit.AuthorizerOption
AuthorizerOptions returns the authorizer options enforcing a Datalog evaluation budget. A non-positive timeout falls back to DefaultAuthorizerTimeout.
func EnforceExpiration ¶
func EnforceExpiration(authorizer biscuit.Authorizer)
EnforceExpiration injects the current time and the expiration check into an authorizer. Every path that admits a biscuit must call this: expiry is a Datalog check over a time fact, so an authorizer built without the fact silently accepts expired tokens (see #296). A token carrying no expiration() fact fails the check, so this is fail-closed.
func ExpirationOf ¶
func ExpirationOf(authorizer biscuit.Authorizer) (time.Time, error)
ExpirationOf reports the expiration() fact of an already-authorized token, for callers that cache an admission decision and must later know when it lapses.
func MintBiscuitToken ¶
func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, remotePeer peer.ID, biscuitExpiry time.Time, roles []string, policyRoles []*api.PolicyRole, labels map[string]string) ([]byte, []string, error)
MintBiscuitToken generates a signed Biscuit token for a peer with policy rules based on JWT claims. labels are control-plane-attested key=value claims (canonical, pre-validated); empty means no claims.
func MintBootstrapBiscuitToken ¶
func MintBootstrapBiscuitToken(signingKey ed25519.PrivateKey, remotePeer peer.ID, role string, expiration time.Time, policyRoles []*api.PolicyRole, labels map[string]string) ([]byte, error)
MintBootstrapBiscuitToken generates a signed Biscuit token for a peer using a bootstrap role. labels are control-plane-attested key=value claims (canonical, pre-validated); empty means no claims.
func RequireAuthorityBinding ¶
RequireAuthorityBinding checks that the token is bound to expectedPeer by an api.FactNode fact in the authority block.
The block matters. biscuit-go's GetBlockID searches appended attenuation blocks too, and appending needs no root key, so a holder of anyone's token can append node(<their own peer id>) offline and satisfy a binding that only tests the error. Those facts are invisible to the Datalog authorizer (see TestAttenuationBlockFactsAreInvisibleToTheAuthorizer), so this lookup is the only place the distinction has to be made by hand.
func VerifyAndExtractPeerID ¶
func VerifyAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, timeout time.Duration) (peer.ID, error)
VerifyAndExtractPeerID checks that the biscuit is signed by one of the trusted keys and is unexpired, and returns the peer ID.
func VerifyBiscuit ¶
func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (*biscuit.Biscuit, error)
VerifyBiscuit verifies the validity of a Biscuit token. It ensures that: 1. The token is cryptographically signed by one of the trustedPublicKeys. 2. The token is not expired. 3. The token is securely bound to the expected remotePeer.
func VerifyBiscuitAndGetKey ¶
func VerifyBiscuitRole ¶
func VerifyBiscuitRole(biscuitData []byte, controlPlanePubKey ed25519.PublicKey, expectedRole string, timeout time.Duration) error
VerifyBiscuitRole checks that the biscuit is signed by the control plane's public key and contains the specified role fact. It deliberately does NOT enforce expiry: its callers either hold a token the control plane minted moments ago, or are deciding whether an identity loaded from disk is worth starting with, where a lapsed token should trigger a refresh rather than refuse to boot. Do not use it to admit a token received from a peer.
func VerifyExpiredAndExtractPeerID ¶
func VerifyExpiredAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, timeout time.Duration) (peer.ID, error)
VerifyExpiredAndExtractPeerID checks that the biscuit is signed by one of the trusted keys and returns the peer ID, deliberately WITHOUT enforcing expiry. Only the refresh flow may use it: a node refreshes precisely because its token lapsed, so it has nothing unexpired to present. Callers must bound the request some other way (the refresh handler gates on the session record and a signed challenge). Everywhere else, use VerifyAndExtractPeerID.
Types ¶
This section is empty.
Source Files