Documentation
¶
Overview ¶
Package auth ports the bootnode authentication surface: the multi-network OAuth2 callback (lux-web3 shared client id) and bootnode-issued API keys.
IAM token validation and pk-/sk-/hk- key resolution are NOT reimplemented here — they live in github.com/hanzoai/base/iam and are reused. This package adds only what is bootnode-specific: deriving the per-network IAM client id from the redirect_uri, and the bn_ project-scoped API key lifecycle.
Index ¶
- Constants
- Variables
- func ClientIDForRedirect(redirectURI, defaultClientID string) string
- func GenerateKey(salt string) (rawKey, hash, prefix string, err error)
- func HashKey(rawKey, salt string) string
- func NetworkFromRedirectURI(redirectURI string) string
- func VerifyKey(rawKey, salt, storedHash string) bool
- type KeyType
Constants ¶
const BootnodeKeyPrefix = "bn_"
BootnodeKeyPrefix is the prefix for bootnode-issued project keys.
Variables ¶
var NetworkClientIDs = map[string]string{
"lux": "lux-web3",
"pars": "lux-web3",
"zoo": "lux-web3",
"hanzo": "lux-web3",
}
NetworkClientIDs maps a white-label network to its IAM application client id. All four cloud networks share a single IAM app (app-lux-web3, clientId "lux-web3") with per-network redirect URIs registered in IAM. This is the exact mapping from the Python bootnode/api/auth/oauth.py.
Functions ¶
func ClientIDForRedirect ¶
ClientIDForRedirect returns the IAM client id to use for a token exchange given the request's redirect_uri. It falls back to defaultClientID when the redirect maps to no known network.
func GenerateKey ¶
GenerateKey mints a new bootnode project API key. It returns the raw key (shown to the user exactly once), the salted hash to persist, and the prefix to persist for display.
The raw key is 32 bytes of crypto/rand entropy, URL-safe base64 encoded, prefixed with bn_. The stored hash is SHA-256(rawKey + salt) — the same construction as the Python bootnode so previously-issued keys verify unchanged. SHA-256+salt (not bcrypt) is correct here: the key is a high-entropy random token, not a low-entropy human password, so the brute-force resistance bcrypt buys is irrelevant and its cost would only slow every authenticated request.
func HashKey ¶
HashKey computes the salted SHA-256 hash of a raw key for storage and lookup. Deterministic: the same (rawKey, salt) always yields the same hash, which is required because the hash is the lookup index.
func NetworkFromRedirectURI ¶
NetworkFromRedirectURI extracts the network slug from an OAuth redirect_uri.
https://cloud.lux.network/auth/callback → "lux" (cloud.<net>.<tld>) https://web3.hanzo.ai/auth/callback → "hanzo" (web3.<net>.<tld>) https://web3.zoo.ngo/auth/callback → "zoo" https://lux.cloud/auth/callback → "lux" (apex brand) https://zoo.cloud/auth/callback → "zoo" https://bootno.de/... → "lux" (primary brand)
Returns "" when no network can be derived.
Types ¶
type KeyType ¶
type KeyType int
KeyType classifies a presented credential. bootnode accepts three credential shapes: its own project keys (bn_), IAM bearer JWTs, and IAM-managed API keys (pk-/sk-/hk-).
const ( // KeyUnknown is an unrecognized credential shape. KeyUnknown KeyType = iota // KeyBootnode is a bootnode-issued project key (bn_…), hashed in // _bootnode_api_keys. KeyBootnode // KeyIAMPublishable is an IAM publishable key (pk-…), read-only. KeyIAMPublishable // KeyIAMSecret is an IAM secret key (sk-…), full access. KeyIAMSecret // KeyIAMService is an IAM service key (hk-…), full access. KeyIAMService // KeyJWT is an IAM bearer JWT (three dot-separated segments). KeyJWT )
Source Files