Documentation
¶
Index ¶
- Constants
- Variables
- func AuthorizerOptions(timeout time.Duration) []biscuit.AuthorizerOption
- func EnforceExpiration(authorizer biscuit.Authorizer)
- func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, ...) ([]byte, []string, error)
- func MintBootstrapBiscuitToken(signingKey ed25519.PrivateKey, remotePeer peer.ID, role string, ...) ([]byte, error)
- func RequireAuthorityBinding(b *biscuit.Biscuit, expectedPeer peer.ID) error
- func RequireRole(b *biscuit.Biscuit, key ed25519.PublicKey, expectedRole string, ...) error
- func UnmarshalInbound(biscuitData []byte) (*biscuit.Biscuit, error)
- func VerifyAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, ...) (peer.ID, error)
- func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, ...) (*biscuit.Biscuit, error)
- func VerifyBiscuitAndGetExpiry(biscuitData []byte, expectedPeer peer.ID, ...) (time.Time, error)
- func VerifyBiscuitAndGetKey(biscuitData []byte, expectedPeer peer.ID, ...) (*biscuit.Biscuit, ed25519.PublicKey, error)
- func VerifyBiscuitRole(biscuitData []byte, controlPlanePubKey ed25519.PublicKey, expectedRole string, ...) error
- func VerifyExpiredAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, ...) (peer.ID, error)
- func VerifyJWT(ctx context.Context, jwtStr string, allowedAudiences []string, ...) (jwt.MapClaims, *oidc.IDToken, error)
Constants ¶
const DefaultAuthorizerTimeout = 1 * time.Second
DefaultAuthorizerTimeout bounds Datalog evaluation when no timeout is configured. biscuit-go defaults to 2ms of wall-clock time, of which a single authorization of a realistic token already spends ~0.14ms (~1.1ms under -race), so ordinary scheduling noise turns into a spurious denial.
Variables ¶
var ErrAppendedBlocks = errors.New("biscuit carries appended blocks; SAM tokens are authority-block only")
ErrAppendedBlocks is returned for a token that carries attenuation blocks.
Functions ¶
func AuthorizerOptions ¶
func AuthorizerOptions(timeout time.Duration) []biscuit.AuthorizerOption
AuthorizerOptions returns the authorizer options enforcing a Datalog evaluation budget. A non-positive timeout falls back to DefaultAuthorizerTimeout.
func EnforceExpiration ¶
func EnforceExpiration(authorizer biscuit.Authorizer)
EnforceExpiration injects the current time and the expiration check into an authorizer. Every path that admits a biscuit must call this: expiry is a Datalog check over a time fact, so an authorizer built without the fact silently accepts expired tokens (see #296). A token carrying no expiration() fact fails the check, so this is fail-closed.
func MintBiscuitToken ¶
func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, remotePeer peer.ID, biscuitExpiry time.Time, roles []string, policyRoles []*api.PolicyRole, labels map[string]string) ([]byte, []string, error)
MintBiscuitToken generates a signed Biscuit token for a peer with policy rules based on JWT claims. labels are control-plane-attested key=value claims (canonical, pre-validated); empty means no claims.
func MintBootstrapBiscuitToken ¶
func MintBootstrapBiscuitToken(signingKey ed25519.PrivateKey, remotePeer peer.ID, role string, expiration time.Time, policyRoles []*api.PolicyRole, labels map[string]string) ([]byte, error)
MintBootstrapBiscuitToken generates a signed Biscuit token for a peer using a bootstrap role. labels are control-plane-attested key=value claims (canonical, pre-validated); empty means no claims.
func RequireAuthorityBinding ¶
RequireAuthorityBinding checks that the token is bound to expectedPeer by an api.FactNode fact in the authority block.
The block matters. biscuit-go's GetBlockID searches appended attenuation blocks too, and appending needs no root key, so a holder of anyone's token can append node(<their own peer id>) offline and satisfy a binding that only tests the error. Those facts are invisible to the Datalog authorizer (see TestAttenuationBlockFactsAreInvisibleToTheAuthorizer), so this lookup is the only place the distinction has to be made by hand.
func RequireRole ¶
func RequireRole(b *biscuit.Biscuit, key ed25519.PublicKey, expectedRole string, timeout time.Duration) error
RequireRole checks that the token carries role(expectedRole) under the given key. It checks nothing else: a token received from a peer must already have passed VerifyBiscuitAndGetKey, which is where expiry and the peer binding are enforced, and key must be the key that verified it.
func UnmarshalInbound ¶
UnmarshalInbound parses a token received from a peer or a client and refuses one with appended blocks.
Appending needs no root key, so appended blocks are the one place a token holder can put Datalog of their own. SAM reads nothing from them: facts there are invisible to the authorizer and RequireAuthorityBinding ignores them. What they can still do is cost CPU: a block with a self-join rule over a few hundred facts pins a core for the whole evaluation budget on every verifier that evaluates it, and leaks the worker goroutine (see the limits above). The control plane never mints such blocks, so a token that has any is not one SAM issued in its current form.
func VerifyAndExtractPeerID ¶
func VerifyAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, timeout time.Duration) (peer.ID, error)
VerifyAndExtractPeerID checks that the biscuit is signed by one of the trusted keys and is unexpired, and returns the peer ID.
func VerifyBiscuit ¶
func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (*biscuit.Biscuit, error)
VerifyBiscuit verifies the validity of a Biscuit token. It ensures that: 1. The token is cryptographically signed by one of the trustedPublicKeys. 2. The token is not expired. 3. The token is securely bound to the expected remotePeer.
func VerifyBiscuitAndGetExpiry ¶
func VerifyBiscuitAndGetExpiry(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (time.Time, error)
VerifyBiscuitAndGetExpiry is VerifyBiscuit that also reports when the token lapses, for callers that cache the admission and must drop it on time.
func VerifyBiscuitAndGetKey ¶
func VerifyBiscuitAndGetKey(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (*biscuit.Biscuit, ed25519.PublicKey, error)
VerifyBiscuitAndGetKey is VerifyBiscuit that also reports which trusted key verified the token, for callers that go on to evaluate it under that key.
func VerifyBiscuitRole ¶
func VerifyBiscuitRole(biscuitData []byte, controlPlanePubKey ed25519.PublicKey, expectedRole string, timeout time.Duration) error
VerifyBiscuitRole checks that the biscuit is signed by the control plane's public key and contains the specified role fact. It deliberately does NOT enforce expiry: its callers either hold a token the control plane minted moments ago, or are deciding whether an identity loaded from disk is worth starting with, where a lapsed token should trigger a refresh rather than refuse to boot. Do not use it to admit a token received from a peer.
func VerifyExpiredAndExtractPeerID ¶
func VerifyExpiredAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData []byte, timeout time.Duration) (peer.ID, error)
VerifyExpiredAndExtractPeerID checks that the biscuit is signed by one of the trusted keys and returns the peer ID, deliberately WITHOUT enforcing expiry. Only the refresh flow may use it: a node refreshes precisely because its token lapsed, so it has nothing unexpired to present. Callers must bound the request some other way (the refresh handler gates on the session record and a signed challenge). Everywhere else, use VerifyAndExtractPeerID.
Types ¶
This section is empty.
Source Files