confirmation

type Authority ¶

type Authority struct {
	// contains filtered or unexported fields
}

Authority mints and verifies proofs. Key material is supplied by the composition root and is never generated or persisted by this package.

func NewAuthority(config Config) (*Authority, error)

func (a *Authority) Mint(ctx context.Context, binding Binding) (Proof, error)

func (a *Authority) VerifyAndConsume(ctx context.Context, expected Binding) error

type Binding ¶

type Binding struct {
	DeviceID        domain.DeviceID
	Generation      uint64
	Effect          domain.EffectClass
	Action          string
	ArgumentsDigest [sha256.Size]byte
	PolicyRevision  string
}

Binding is the complete authority identity for one high-risk operation. ArgumentsDigest must cover deterministic, versioned canonical arguments.

type Config ¶

type Config struct {
	Key    []byte
	TTL    time.Duration
	Nonces NonceStore
	Now    func() time.Time
}

type MemoryNonceStore ¶

type MemoryNonceStore struct {
	// contains filtered or unexported fields
}

MemoryNonceStore is suitable for the single-process stdio and loopback HTTP deployment supported by the first release.

func NewMemoryNonceStore() *MemoryNonceStore

func (s *MemoryNonceStore) Consume(_ context.Context, nonce uuid.UUID, expiresAt time.Time) error

type NonceStore ¶

type NonceStore interface {
	Consume(context.Context, uuid.UUID, time.Time) error
}

NonceStore is the atomic single-use authority. Implementations used by multi-process servers must place this state in their shared durable store.

type Principal ¶

type Principal struct {
	ID        string
	Transport string
}

Principal is the authenticated caller identity established by a trusted transport adapter. ID must be stable within the adapter's trust domain.

func LocalProcessPrincipal() Principal

func PrincipalFromContext(ctx context.Context) (Principal, bool)

type Proof ¶

type Proof struct {
	// contains filtered or unexported fields
}

Proof is intentionally opaque. Only an Issuer can create a valid value.