space

package
v0.11.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Overview

Package space provides pure value types and cryptographic primitives for atproto Spaces.

Index

Constants

View Source 
const (
	DelegationTokenType        = "atproto-space-delegation+jwt"
	ClientAttestationTokenType = "atproto-client-attestation+jwt"
	CredentialTokenType        = "atproto-space-credential+jwt"
	SpaceHostAudienceSuffix    = "#atproto_space_host"
	DelegationSigningKeyID     = "#atproto"
	SpaceSigningKeyID          = "#atproto_space"
	FallbackSigningKeyID       = "#atproto"
	ClockSkew                  = 5 * time.Second
	DelegationLifetime         = 60 * time.Second
	ClientAttestationLifetime  = 60 * time.Second
	CredentialLifetime         = 2 * time.Hour
)
View Source 
const (
	// AlphaReferenceCommit is the immutable atproto reference snapshot targeted
	// by this experimental implementation.
	AlphaReferenceCommit = "89deb9faca20e56fa2a262fe9746ed52bc1095ba"
	// AlphaCompatibilityVersion changes whenever the pinned wire contract or
	// local persistence representation changes incompatibly.
	AlphaCompatibilityVersion = 1
)
View Source 
const (
	DPOPProofType     = "dpop+jwt"
	DPOPPProofType    = DPOPProofType // compatibility spelling for callers
	DPOP_PROOF_TYP    = DPOPProofType
	MaxDpopProofAge   = 60 * time.Second
	MAX_PROOF_AGE_SEC = 60
)
View Source 
const (
	// LtHashLanes is the number of uint16 lanes in an LtHash state.
	LtHashLanes = 1024
	// LtHashStateBytes is the serialized state size.
	LtHashStateBytes = LtHashLanes * 2

	// LTHASH_STATE_BYTES is retained as a name matching the reference package.
	LTHASH_STATE_BYTES = LtHashStateBytes
	// StateBytes is a concise alias for LtHashStateBytes.
	StateBytes = LtHashStateBytes
)
View Source 
const (
	// CommitVersion is the signedCommit format version.
	CommitVersion uint64 = 1
	// COMMIT_VERSION is retained as a reference-compatible spelling.
	COMMIT_VERSION = CommitVersion

	CommitHashBytes = sha256.Size
	CommitIKMBytes  = sha256.Size
	CommitMACBytes  = sha256.Size

	// MaxCommitContextFieldBytes is the largest value representable by a u16
	// context length prefix.
	MaxCommitContextFieldBytes = int(^uint16(0))
	// @atproto/crypto and Indigo use compact secp256k1 r||s signatures.
	MaxCommitSignatureBytes = 64
)

Variables

View Source 
var (
	ErrReplay                 = errors.New("replay detected")
	ErrNilReplayStore         = errors.New("nil replay store")
	ErrBatchReplayUnavailable = errors.New("atomic replay batch store unavailable")
)

Functions

func CIDForCBOR 

func CIDForCBOR(data []byte) (cid.Cid, error)

CIDForCBOR computes the CID used for commit, index, and canonical DAG-CBOR record blocks.

func CommitMAC 

func CommitMAC(ikm, ctx, hash []byte) []byte

func ComputeCommitMAC 

func ComputeCommitMAC(ikm, ctx, hash []byte) ([]byte, error)

ComputeCommitMAC follows the pinned @atproto/crypto helper exactly: hkdfSha256(ikm, ctx) is HKDF-Expand-only with ikm directly as the SHA-256 PRK and ctx as info, followed by HMAC-SHA256(key, hash). It intentionally does not use x/crypto/hkdf, which performs an Extract step first.

func CreateClientAttestation 

func CreateClientAttestation(opts CreateSpaceTokenOptions, signer Signer) (string, error)

func CreateCredential 

func CreateCredential(opts CreateSpaceTokenOptions, signer Signer) (string, error)

func CreateDPoPProof 

func CreateDPoPProof(signer DPoPSigner, opts CreateDpopProofOptions) (string, error)

func CreateDelegationToken 

func CreateDelegationToken(opts CreateSpaceTokenOptions, signer Signer) (string, error)

func CreateDpopProof 

func CreateDpopProof(signer DPoPSigner, opts CreateDpopProofOptions) (string, error)

CreateDpopProof creates an RFC 9449 proof. The issuance form omits ath; set CredentialPresent (or Credential) when proving possession for a credential request.

func CreateSpaceCredential 

func CreateSpaceCredential(opts CreateSpaceTokenOptions, signer Signer) (string, error)

func CreateSpaceToken 

func CreateSpaceToken(kind TokenType, opts CreateSpaceTokenOptions, signer Signer) (string, error)

func DPoPJKTForKey 

func DPoPJKTForKey(key *ecdsa.PublicKey) (string, error)

func DpopJKTForKey 

func DpopJKTForKey(key *ecdsa.PublicKey) (string, error)

func EncodeCommitContext 

func EncodeCommitContext(ctx CommitContext, ikm []byte) ([]byte, error)

EncodeCommitContext implements the pinned context encoding: 

"atproto-space-v1" || u16be(len(space)) || space
|| u16be(len(author)) || author
|| u16be(len(rev)) || rev
|| u16be(len(ikm)) || ikm

Lengths are UTF-8 byte lengths.

func EncodeCommitCtx 

func EncodeCommitCtx(ctx CommitContext, ikm []byte) ([]byte, error)

func EncodeRepoIndex 

func EncodeRepoIndex(index RepoIndex) ([]byte, error)

EncodeRepoIndex returns canonical DAG-CBOR bytes for an index. The CBOR encoder emits CID values as IPLD link tag 42 and sorts text keys by the canonical shortest-then-bytewise order.

func EncodeSignedCommit 

func EncodeSignedCommit(c SignedCommit) ([]byte, error)

EncodeSignedCommit returns canonical DAG-CBOR bytes for c.

func ExpandElement 

func ExpandElement(element string) []byte

ExpandElement expands an element to the exact 2048-byte BLAKE3 XOF output used as the lane vector by LtHash. The returned bytes are independent of any internal hash state.

func FormatElement 

func FormatElement(collection, rkey, cid string) string

FormatElement formats a record identity for inclusion in an LtHash: {collection}/{rkey}/{cid}.

func FormatSetHashElement 

func FormatSetHashElement(collection, rkey, cid string) string

FormatSetHashElement is an alias matching the reference helper's name.

func NormalizeDpopHTU 

func NormalizeDpopHTU(raw string) (string, error)

NormalizeDpopHTU implements the common WHATWG URL serialization needed by RFC 9449 htu: absolute HTTP(S), lower-case scheme/host, default ports removed, literal dot segments resolved, and query/fragment removed. Raw percent-encoded path octets are preserved and are never treated as dots.

func NormalizeHTU 

func NormalizeHTU(raw string) (string, error)

func SerializeRepo 

func SerializeRepo(commit SignedCommit, records []SerializedRecord, opts ...SerializeRepoOptions) ([]byte, error)

SerializeRepo emits a CAR whose roots are [signedCommit, index], followed by commit/index blocks and then one value block per index entry in canonical path order. Duplicate paths follow the reference provider's last-write-wins behavior. ExcludeValues emits only the two roots' blocks.

func SerializeRepoCAR 

func SerializeRepoCAR(commit SignedCommit, records []SerializedRecord, opts ...SerializeRepoOptions) ([]byte, error)

func VerifyCommit 

func VerifyCommit(commit SignedCommit, ctx CommitContext, didKey string) bool

VerifyCommit verifies version/revision, MAC, and an atproto DID-key signature. It returns false for malformed or unauthenticated commits.

func VerifyCommitError 

func VerifyCommitError(commit SignedCommit, ctx CommitContext, didKey string) error

VerifyCommitError is an error-returning companion for trust boundaries.

func VerifyCommitWithPublicKey 

func VerifyCommitWithPublicKey(commit SignedCommit, ctx CommitContext, verifier CommitVerifier) bool

func VerifyCommitWithVerifier 

func VerifyCommitWithVerifier(commit SignedCommit, ctx CommitContext, verifier CommitVerifier) bool

func WriteRepoCAR 

func WriteRepoCAR(w io.Writer, commit SignedCommit, records []SerializedRecord, opts ...SerializeRepoOptions) error

WriteRepoCAR is the streaming form of SerializeRepo.

Types

type AtprotoSigner 

type AtprotoSigner struct {
	// contains filtered or unexported fields
}

AtprotoSigner adapts the account ES256K implementation used by Cocoon.

func NewAtprotoSigner 

func NewAtprotoSigner(key *atcrypto.PrivateKeyK256) (*AtprotoSigner, error)

func (*AtprotoSigner) Algorithm 

func (s *AtprotoSigner) Algorithm() string

func (*AtprotoSigner) Sign 

func (s *AtprotoSigner) Sign(input []byte) ([]byte, error)

type AtprotoVerifier 

type AtprotoVerifier struct {
	// contains filtered or unexported fields
}

func NewAtprotoVerifier 

func NewAtprotoVerifier(key atcrypto.PublicKey) (*AtprotoVerifier, error)

func (*AtprotoVerifier) Algorithm 

func (v *AtprotoVerifier) Algorithm() string

func (*AtprotoVerifier) Verify 

func (v *AtprotoVerifier) Verify(input, sig []byte) error

type BatchReplayStore 

type BatchReplayStore interface {
	ReplayStore
	ConsumeBatch(ctx context.Context, artifacts []ReplayArtifact) error
}

BatchReplayStore extends ReplayStore with all-or-nothing batch consumption. Production exchange paths must require this interface rather than falling back to sequential Consume calls.

type CAROptions 

type CAROptions = SerializeRepoOptions

type CommitContext 

type CommitContext struct {
	Space  string
	Author string
	Rev    string
}

CommitContext is the data bound into a signed commit. Author is the author's DID and Space is the canonical space URI.

type CommitCtx 

type CommitCtx = CommitContext

CommitCtx is the short spelling used by the pinned TypeScript reference.

type CommitSignOptions 

type CommitSignOptions = SignOptions

type CommitSigner 

type CommitSigner interface {
	HashAndSign(content []byte) ([]byte, error)
}

CommitSigner and CommitVerifier are small adapters satisfied by Indigo's atcrypto.PrivateKey and atcrypto.PublicKey. They also allow callers to adapt a persistence model without importing that model into this package.

type CommitVerifier 

type CommitVerifier interface {
	HashAndVerify(content, sig []byte) error
}

type CreateDpopProofOptions 

type CreateDpopProofOptions struct {
	Htm               string
	Htu               string
	HTTPMethod        string
	HTTPURL           string
	Credential        string
	CredentialPresent bool
	JTI               string
	Now               func() time.Time
	Random            io.Reader
}

type CreateSpaceTokenOptions 

type CreateSpaceTokenOptions struct {
	Iss       string
	Sub       string
	Aud       string
	DPoPJKT   string
	Kid       string
	ExpiresIn time.Duration
	Now       func() time.Time
	Random    io.Reader
	JTI       string
}

type DPoPSigner 

type DPoPSigner interface {
	Signer
	PublicJWK() ([]byte, error)
}

DPoPSigner must expose its bare public P-256 JWK. Embedded key material is part of the proof header and is verified before any claim is trusted.

type DpopProof 

type DpopProof struct {
	JTI      string
	JKT      string
	HTM      string
	HTU      string
	IssuedAt time.Time
}

func VerifyDPoPProof 

func VerifyDPoPProof(ctx context.Context, raw string, opts VerifyDpopProofOptions) (DpopProof, error)

func VerifyDpopProof 

func VerifyDpopProof(ctx context.Context, raw string, opts VerifyDpopProofOptions) (DpopProof, error)

VerifyDpopProof checks signature, method, normalized URL, age, embedded-key thumbprint, and ath. Replay is consumed atomically after every other check.

type ECDSASigner 

type ECDSASigner struct {
	// contains filtered or unexported fields
}

func NewECDSASigner 

func NewECDSASigner(key *ecdsa.PrivateKey, alg string, random io.Reader) (*ECDSASigner, error)

func (*ECDSASigner) Algorithm 

func (s *ECDSASigner) Algorithm() string

func (*ECDSASigner) PublicJWK 

func (s *ECDSASigner) PublicJWK() ([]byte, error)

func (*ECDSASigner) PublicKey 

func (s *ECDSASigner) PublicKey() *ecdsa.PublicKey

func (*ECDSASigner) Sign 

func (s *ECDSASigner) Sign(input []byte) ([]byte, error)

type ECDSAVerifier 

type ECDSAVerifier struct {
	// contains filtered or unexported fields
}

func NewECDSAVerifier 

func NewECDSAVerifier(key *ecdsa.PublicKey, alg string) (*ECDSAVerifier, error)

func (*ECDSAVerifier) Algorithm 

func (v *ECDSAVerifier) Algorithm() string

func (*ECDSAVerifier) Verify 

func (v *ECDSAVerifier) Verify(input, sig []byte) error

type GORMReplayStore 

type GORMReplayStore struct{ DB *gorm.DB }

GORMReplayStore persists replay consumption in models.SpaceReplayJTI. The schema is included by models.SpaceModels; migrations remain the server's responsibility. A unique primary-key insert gives the required atomicity.

func NewGORMReplayStore 

func NewGORMReplayStore(db *gorm.DB) *GORMReplayStore

func (*GORMReplayStore) Consume 

func (s *GORMReplayStore) Consume(ctx context.Context, jti, tokenType string, expiresAt time.Time) error

func (*GORMReplayStore) ConsumeBatch 

func (s *GORMReplayStore) ConsumeBatch(ctx context.Context, artifacts []ReplayArtifact) error

ConsumeBatch inserts all replay rows in one database transaction. Any duplicate or other error rolls the transaction back, so no earlier artifact in the batch is burned.

func (*GORMReplayStore) DeleteExpired 

func (s *GORMReplayStore) DeleteExpired(ctx context.Context, now time.Time, limit int) (int, error)

DeleteExpired removes at most limit replay rows whose deadline has passed. The strict comparison preserves a replay row at its exact deadline, matching MemoryReplayStore; it is removed on the first cleanup after that boundary.

type KeyResolutionRequest 

type KeyResolutionRequest struct {
	Issuer       string
	Kid          string
	Algorithm    string
	ForceRefresh bool
}

KeyResolutionRequest is the typed request passed to resolvers that can refresh a cached DID/JWKS lookup after a signature failure. ForceRefresh is false for the initial lookup and true only for the single retry.

type KeyResolver 

type KeyResolver func(context.Context, string, string, string) (Verifier, error)

type LtHash 

type LtHash struct {
	// contains filtered or unexported fields
}

LtHash is a homomorphic set hash. Each element expands to 1024 little-endian uint16 lanes, which are summed into the state modulo 2^16. Consequently, addition and subtraction commute and the state depends only on the current set (assuming each set member is added at most once).

func LtHashFromState 

func LtHashFromState(state []byte) (*LtHash, error)

LtHashFromState is an alias for NewLtHashFromState.

func NewLtHash 

func NewLtHash(states ...[]byte) (*LtHash, error)

NewLtHash creates an empty hash, or copies one serialized state. A nil state is equivalent to an omitted state; a non-nil state must be exactly 2048 bytes. The variadic form permits both NewLtHash() and NewLtHash(state).

func NewLtHashFromState 

func NewLtHashFromState(state []byte) (*LtHash, error)

NewLtHashFromState is an explicit spelling for constructing from serialized state.

func (*LtHash) Add 

func (h *LtHash) Add(element string) *LtHash

Add incorporates element into the state and returns h for convenient chaining. Lane arithmetic wraps modulo 2^16.

func (*LtHash) Digest 

func (h *LtHash) Digest() []byte

Digest returns SHA-256 of the serialized state.

func (*LtHash) Equal 

func (h *LtHash) Equal(other *LtHash) bool

Equal is an alias for Equals.

func (*LtHash) Equals 

func (h *LtHash) Equals(other *LtHash) bool

Equals reports whether h and other have identical states.

func (*LtHash) IsEmpty 

func (h *LtHash) IsEmpty() bool

IsEmpty reports whether every state lane is zero.

func (*LtHash) Remove 

func (h *LtHash) Remove(element string) *LtHash

Remove subtracts element from the state and returns h for convenient chaining. Lane arithmetic wraps modulo 2^16.

func (*LtHash) State 

func (h *LtHash) State() []byte

State returns a defensive copy of the serialized state.

type MemoryReplayStore 

type MemoryReplayStore struct {
	// contains filtered or unexported fields
}

MemoryReplayStore is concurrency-safe and useful for tests or explicitly ephemeral deployments. It is not durable across process restarts.

func NewMemoryReplayStore 

func NewMemoryReplayStore() *MemoryReplayStore

func NewMemoryReplayStoreWithClock 

func NewMemoryReplayStoreWithClock(now func() time.Time) *MemoryReplayStore

NewMemoryReplayStoreWithClock makes expiry deterministic in tests.

func (*MemoryReplayStore) Consume 

func (s *MemoryReplayStore) Consume(ctx context.Context, jti, tokenType string, expiresAt time.Time) error

func (*MemoryReplayStore) ConsumeBatch 

func (s *MemoryReplayStore) ConsumeBatch(_ context.Context, artifacts []ReplayArtifact) error

ConsumeBatch checks every artifact and inserts every fresh artifact while holding the same mutex. If validation or replay detection fails, the map is unchanged.

type RecordRef 

type RecordRef = RecordURI

func ParseRecordRef 

func ParseRecordRef(raw string) (RecordRef, error)

ParseRecordRef is an alias for ParseRecordURI.

type RecordURI 

type RecordURI struct {
	AuthorityDID syntax.DID
	SpaceType    syntax.NSID
	SKey         syntax.RecordKey
	AuthorDID    syntax.DID
	Collection   syntax.NSID
	RKey         syntax.RecordKey
}

RecordURI identifies a record in a space.

Its canonical form is at://{authorityDid}/space/{spaceType}/{skey}/{authorDid}/{collection}/{rkey}.

func NewRecordURI 

func NewRecordURI(authorityDID, spaceType, skey, authorDID, collection, rkey string) (RecordURI, error)

NewRecordURI validates components and returns a canonical record URI value.

func ParseRecord 

func ParseRecord(raw string) (RecordURI, error)

ParseRecord is an alias for ParseRecordURI.

func ParseRecordURI 

func ParseRecordURI(raw string) (RecordURI, error)

ParseRecordURI parses exactly the canonical space record URI grammar.

func (RecordURI) MarshalText 

func (u RecordURI) MarshalText() ([]byte, error)

MarshalText implements encoding.TextMarshaler.

func (RecordURI) Space 

func (u RecordURI) Space() SpaceURI

Space returns the space portion of a record URI.

func (RecordURI) String 

func (u RecordURI) String() string

String returns the canonical textual representation.

func (*RecordURI) UnmarshalText 

func (u *RecordURI) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler.

type ReplayArtifact 

type ReplayArtifact struct {
	JTI       string
	TokenType string
	ExpiresAt time.Time
}

ReplayArtifact is one validated, single-use token/proof replay entry. A batch must be committed all at once: no artifact may be persisted if any artifact in the batch is already consumed.

type ReplayStore 

type ReplayStore interface {
	Consume(ctx context.Context, jti, tokenType string, expiresAt time.Time) error
}

ReplayStore consumes a globally unique JTI exactly once. Implementations must make the check-and-insert atomic; callers invoke it only after a token or proof has passed signature and semantic validation.

type RepoCommit 

type RepoCommit struct {
	SetHash *LtHash
}

RepoCommit tracks the LtHash of a repo's collection/rkey/CID set.

func NewRepoCommit 

func NewRepoCommit() *RepoCommit

func RepoCommitFromIndex 

func RepoCommitFromIndex(index RepoIndex) (*RepoCommit, error)

RepoCommitFromIndex computes the LtHash represented by every index path/CID.

func RepoCommitFromRecords 

func RepoCommitFromRecords(records []SerializedRecord) (*RepoCommit, error)

RepoCommitFromRecords computes a set hash from serialized records.

func (*RepoCommit) Add 

func (r *RepoCommit) Add(collection, rkey string, recordCID interface{ String() string }) *RepoCommit

Add incorporates a record identity. The interface permits cid.Cid and other CID adapters without coupling the value helper to one concrete CID type.

func (*RepoCommit) Hash 

func (r *RepoCommit) Hash() []byte

func (*RepoCommit) Matches 

func (r *RepoCommit) Matches(commit SignedCommit) bool

Matches only compares the set hash; authenticate the commit first.

func (*RepoCommit) Remove 

func (r *RepoCommit) Remove(collection, rkey string, recordCID interface{ String() string }) *RepoCommit

func (*RepoCommit) Sign 

func (r *RepoCommit) Sign(ctx CommitContext, signer CommitSigner, opts ...SignOptions) (SignedCommit, error)

Sign signs only the encoded context, then MACs the current repo hash.

type RepoIndex 

type RepoIndex map[string]cid.Cid

RepoIndex maps collection/rkey paths to record CIDs.

func DecodeRepoIndex 

func DecodeRepoIndex(data []byte) (RepoIndex, error)

DecodeRepoIndex parses a canonical DAG-CBOR index.

type SerializeRepoOptions 

type SerializeRepoOptions struct {
	ExcludeValues bool
}

SerializeRepoOptions controls CAR serialization.

type SerializedRecord 

type SerializedRecord struct {
	Collection string
	RKey       string
	// Rkey is accepted as a compatibility spelling; RKey takes precedence.
	Rkey  string
	CID   cid.Cid
	Bytes []byte
}

SerializedRecord is one record block to be placed after the two CAR roots.

func NewSerializedRecord 

func NewSerializedRecord(collection, rkey string, record interface{}) (SerializedRecord, error)

NewSerializedRecord is an alias for SerializeRecord.

func SerializeRecord 

func SerializeRecord(collection, rkey string, record interface{}) (SerializedRecord, error)

SerializeRecord canonicalizes a Go value as DAG-CBOR and computes its CID.

func SerializeRecordBytes 

func SerializeRecordBytes(collection, rkey string, recordCID cid.Cid, data []byte) (SerializedRecord, error)

SerializeRecordBytes constructs a record from already canonical bytes. A supplied CID is checked against those bytes; an undefined CID is computed.

type SignOptions 

type SignOptions struct {
	IKM  []byte
	Rand io.Reader
}

SignOptions makes signing deterministic in tests. IKM must be exactly 32 bytes when supplied. Otherwise Rand is read for a fresh IKM; nil uses crypto/rand.Reader.

type SignedCommit 

type SignedCommit struct {
	Ver  uint64 `json:"ver"`
	Hash []byte `json:"hash"`
	IKM  []byte `json:"ikm"`
	Sig  []byte `json:"sig"`
	MAC  []byte `json:"mac"`
	Rev  string `json:"rev"`
}

SignedCommit is the signedCommit Lexicon object. It is serialized as a canonical DAG-CBOR map with keys ver/hash/ikm/sig/mac/rev.

func DecodeSignedCommit 

func DecodeSignedCommit(data []byte) (SignedCommit, error)

DecodeSignedCommit parses and validates canonical DAG-CBOR bytes. Re-encoding rejects non-canonical map encodings and unknown fields.

func SignCommit 

func SignCommit(hash []byte, ctx CommitContext, signer CommitSigner, opts ...SignOptions) (SignedCommit, error)

SignCommit signs a precomputed repo hash. RepoCommit.Sign is preferred when the caller has the record set available.

func (SignedCommit) MarshalJSON 

func (c SignedCommit) MarshalJSON() ([]byte, error)

MarshalJSON uses the atproto Lexicon bytes encoding. JSON bytes are {$bytes:<raw-base64url>}, not encoding/json's default base64 string.

func (*SignedCommit) UnmarshalJSON 

func (c *SignedCommit) UnmarshalJSON(data []byte) error

func (SignedCommit) Validate 

func (c SignedCommit) Validate() error

type Signer 

type Signer interface {
	Algorithm() string
	Sign([]byte) ([]byte, error)
}

Signer and Verifier make account-key and DID/JWKS integrations independent from this package. ECDSA signatures are JOSE's fixed-width R || S format.

type SignerFunc 

type SignerFunc struct {
	Alg  string
	Func func([]byte) ([]byte, error)
}

func (SignerFunc) Algorithm 

func (s SignerFunc) Algorithm() string

func (SignerFunc) Sign 

func (s SignerFunc) Sign(b []byte) ([]byte, error)

type SigningKeyResolver 

type SigningKeyResolver interface {
	ResolveSigningKey(context.Context, KeyResolutionRequest) (Verifier, error)
}

SigningKeyResolver is the refresh-capable resolver contract. A resolver must not silently fall back to an unrelated key when ForceRefresh is true.

type SigningKeyResolverFunc 

type SigningKeyResolverFunc func(context.Context, KeyResolutionRequest) (Verifier, error)

SigningKeyResolverFunc adapts a typed resolver function to the interface.

func (SigningKeyResolverFunc) ResolveSigningKey 

func (f SigningKeyResolverFunc) ResolveSigningKey(ctx context.Context, req KeyResolutionRequest) (Verifier, error)

type SpaceAuthError 

type SpaceAuthError struct {
	Code string
	Msg  string
	Err  error
}

func (*SpaceAuthError) Error 

func (e *SpaceAuthError) Error() string

func (*SpaceAuthError) Unwrap 

func (e *SpaceAuthError) Unwrap() error

type SpaceRef 

type SpaceRef = SpaceURI

SpaceRef and RecordRef are descriptive aliases for the URI value types.

func ParseSpaceRef 

func ParseSpaceRef(raw string) (SpaceRef, error)

ParseSpaceRef is an alias for ParseSpaceURI.

type SpaceToken 

type SpaceToken struct {
	Header       SpaceTokenHeader
	Claims       SpaceTokenClaims
	SigningInput []byte
	Signature    []byte
}

func ParseSpaceToken 

func ParseSpaceToken(kind TokenType, raw string) (SpaceToken, error)

ParseSpaceToken validates the complete JWT structure and all typed claims, but not its signature. It is intended solely to choose a separately resolved verification key before VerifySpaceToken performs mandatory verification.

func VerifyClientAttestation 

func VerifyClientAttestation(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error)

func VerifyCredential 

func VerifyCredential(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error)

func VerifyDelegationToken 

func VerifyDelegationToken(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error)

func VerifySpaceCredential 

func VerifySpaceCredential(ctx context.Context, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error)

func VerifySpaceToken 

func VerifySpaceToken(ctx context.Context, kind TokenType, raw string, opts VerifySpaceTokenOptions) (SpaceToken, error)

type SpaceTokenClaims 

type SpaceTokenClaims struct {
	Iss string                  `json:"iss"`
	Sub string                  `json:"sub"`
	Aud *string                 `json:"aud,omitempty"`
	Cnf *SpaceTokenConfirmation `json:"cnf,omitempty"`
	IAT int64                   `json:"iat"`
	Exp int64                   `json:"exp"`
	JTI string                  `json:"jti"`
}

type SpaceTokenConfirmation 

type SpaceTokenConfirmation struct {
	JKT string `json:"jkt"`
}

type SpaceTokenHeader 

type SpaceTokenHeader struct {
	Alg string `json:"alg"`
	Typ string `json:"typ"`
	Kid string `json:"kid,omitempty"`
}

type SpaceTokenType 

type SpaceTokenType = TokenType

SpaceTokenType is the terminology used by the reference implementation.

type SpaceURI 

type SpaceURI struct {
	AuthorityDID syntax.DID
	SpaceType    syntax.NSID
	SKey         syntax.RecordKey
}

SpaceURI identifies a space hosted by an authority.

Its canonical form is at://{authorityDid}/space/{spaceType}/{skey}.

func NewSpaceURI 

func NewSpaceURI(authorityDID, spaceType, skey string) (SpaceURI, error)

NewSpaceURI validates components and returns a canonical space URI value.

func ParseSpace 

func ParseSpace(raw string) (SpaceURI, error)

ParseSpace is an alias for ParseSpaceURI.

func ParseSpaceURI 

func ParseSpaceURI(raw string) (SpaceURI, error)

ParseSpaceURI parses exactly the canonical space URI grammar.

func (SpaceURI) MarshalText 

func (u SpaceURI) MarshalText() ([]byte, error)

MarshalText implements encoding.TextMarshaler.

func (SpaceURI) SpaceScopeComponents 

func (u SpaceURI) SpaceScopeComponents() (authority, spaceType, skey string)

SpaceScopeComponents returns the authority, space type, and space key used by OAuth space-scope matching.

func (SpaceURI) String 

func (u SpaceURI) String() string

String returns the canonical textual representation.

func (*SpaceURI) UnmarshalText 

func (u *SpaceURI) UnmarshalText(text []byte) error

UnmarshalText implements encoding.TextUnmarshaler.

type TokenType 

type TokenType string
const (
	TokenDelegation        TokenType = DelegationTokenType
	TokenClientAttestation TokenType = ClientAttestationTokenType
	TokenCredential        TokenType = CredentialTokenType
)

type VerifiedRecord 

type VerifiedRecord struct {
	Collection string
	RKey       string
	CID        cid.Cid
	Bytes      []byte
}

VerifiedRecord is a value block proven to match its index path and CID.

type VerifiedRepo 

type VerifiedRepo struct {
	Roots   []cid.Cid
	Commit  SignedCommit
	Index   RepoIndex
	Records []VerifiedRecord
	Repo    *RepoCommit
}

VerifiedRepo is the result of VerifyRepoCAR.

func ParseRepoCAR 

func ParseRepoCAR(data []byte, params VerifyRepoParams) (VerifiedRepo, error)

ParseRepoCAR is a descriptive alias for VerifyRepoCAR.

func VerifyRepoCAR 

func VerifyRepoCAR(data []byte, params VerifyRepoParams) (VerifiedRepo, error)

VerifyRepoCAR verifies roots, block CIDs, commit signature/MAC, index hash, and (when ExpectValues is true) every value block in index order.

func VerifyRepoCARFull 

func VerifyRepoCARFull(data []byte, params VerifyRepoParams) (VerifiedRepo, error)

func VerifyRepoCar 

func VerifyRepoCar(data []byte, params VerifyRepoParams) (VerifiedRepo, error)

type Verifier 

type Verifier interface {
	Algorithm() string
	Verify([]byte, []byte) error
}

type VerifierFunc 

type VerifierFunc struct {
	Alg  string
	Func func([]byte, []byte) error
}

func (VerifierFunc) Algorithm 

func (v VerifierFunc) Algorithm() string

func (VerifierFunc) Verify 

func (v VerifierFunc) Verify(b, sig []byte) error

type VerifyDpopProofOptions 

type VerifyDpopProofOptions struct {
	Htm               string
	Htu               string
	HTTPMethod        string
	HTTPURL           string
	Credential        string
	CredentialPresent bool
	JKT               string
	ExpectedJKT       string
	Now               func() time.Time
	ClockSkew         time.Duration
	Replay            ReplayStore
	Context           context.Context
}

type VerifyRepoParams 

type VerifyRepoParams struct {
	Space        string
	Author       string
	DIDKey       string
	ExpectValues interface{}
}

VerifyRepoParams are the context values and public key needed to verify a repo CAR. ExpectValues may be bool, *bool, or nil: nil defaults to true, matching the reference verifier's optional expectValues parameter. A false value verifies an index-only CAR produced with ExcludeValues.

type VerifySpaceTokenOptions 

type VerifySpaceTokenOptions struct {
	Resolver           KeyResolver
	KeyResolver        KeyResolver
	SigningKeyResolver SigningKeyResolver
	Verifier           Verifier
	Audience           string
	Subject            string
	Issuer             string
	Now                func() time.Time
	ClockSkew          time.Duration
	Replay             ReplayStore
	Context            context.Context
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.