Documentation
¶
Overview ¶
Package statictoken implements a Provider that matches the presented bearer token against a single expected value using constant-time comparison.
Two intended uses:
Channel adapter loopback. The runner generates a random per-process token, configures a statictoken Provider with it (placed at the head of the chain), and shares the same token with Slack/Telegram adapters so their callbacks into the local A2A server authenticate cheaply without touching an upstream IdP.
Local dev / CI. A fixed token configured via env var lets developers hit a running agent with `curl -H "Authorization: Bearer $FORGE_DEV_TOKEN"` without setting up an IdP.
Mismatch returns ErrTokenNotForMe (yield to next provider), not ErrTokenRejected — the loopback token is "not for me" from the perspective of an external client, and chain semantics require yielding in that case.
Index ¶
Constants ¶
const ProviderName = "static_token"
ProviderName is the type name used to register and reference this provider.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Token is the expected bearer value (literal). Prefer TokenEnv for
// non-test use — putting a secret in YAML is a footgun.
Token string `yaml:"token,omitempty"`
// TokenEnv names an environment variable that holds the token at
// construction time. Read once in New(); subsequent env changes do
// not affect the running provider.
TokenEnv string `yaml:"token_env,omitempty"`
// Identity is returned on a successful match (a defensive copy is
// returned to callers). If Source is empty it defaults to "static_token".
Identity auth.Identity `yaml:"identity,omitempty"`
}
Config controls the static_token provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements auth.Provider with a constant-time token compare.
func New ¶
New constructs a Provider after resolving the token (TokenEnv takes precedence over Token literal). Returns ErrProviderNotConfigured if the resolved token is empty.
func (*Provider) Verify ¶
Verify implements auth.Provider. Constant-time compare against the configured token. Mismatch yields to the next provider via ErrTokenNotForMe.
Length-leak guard (review #11a): subtle.ConstantTimeCompare returns 0 immediately when the two slices have different lengths, without inspecting any bytes — that early return leaks the expected token's length via measurable timing differences over many trials. We hash both sides to SHA-256 first so the comparison is always over equal-length (32-byte) digests. Hash → constant-time compare is the standard mitigation for this class.
Source Files