Documentation
¶
Overview ¶
Package localowner realizes and verifies the init-owned human identity in the local PocketID runtime without exposing its bootstrap credential.
Index ¶
- Constants
- Variables
- func ConsumeRemoteActionApproval(workspaceRoot string, receipt json.RawMessage, ...) error
- func NormalizeStepUpOrigin(origin string) (string, error)
- func StepUpNonce(binding RemoteActionApprovalBinding) (string, error)
- func VerifyRemoteActionApproval(ctx context.Context, workspaceRoot, origin string, receipt json.RawMessage, ...) error
- func VerifyRemoteActionApprovalClaims(receipt json.RawMessage, expected RemoteActionApprovalBinding, ...) error
- type HouseholdUser
- type HouseholdUserSpec
- type OwnerActivation
- type RemoteActionApproval
- type RemoteActionApprovalBinding
- type Result
- type Service
- func (s *Service) AddHouseholdUser(ctx context.Context, spec HouseholdUserSpec) (HouseholdUser, error)
- func (s *Service) ExchangeStepUpCode(ctx context.Context, origin, code, verifier string, ...) (json.RawMessage, error)
- func (s *Service) IssueOwnerActivation(ctx context.Context) (OwnerActivation, error)
- func (s *Service) ListHouseholdUsers(ctx context.Context) ([]HouseholdUser, error)
- func (s *Service) OwnerActivationStatus(ctx context.Context) (OwnerActivation, error)
- func (s *Service) PrepareStepUp(ctx context.Context, origin string) (StepUpTrust, error)
- func (s *Service) ReadStepUpTrust(ctx context.Context, origin string) (StepUpTrust, error)
- func (s *Service) Realize(ctx context.Context) (Result, error)
- func (s *Service) RemoveHouseholdUser(ctx context.Context, username string) error
- func (s *Service) Verify(ctx context.Context) (localevidence.OwnerRuntimeBinding, error)
- type StepUpTrust
Constants ¶
const StepUpCallbackPath = "/api/v1/identity/step-up/callback"
const StepUpClientID = "stackkits-owner-step-up"
Variables ¶
var ErrStepUpRejected = errors.New("localowner: current PocketID owner approval required")
Functions ¶
func ConsumeRemoteActionApproval ¶
func ConsumeRemoteActionApproval(workspaceRoot string, receipt json.RawMessage, expected RemoteActionApprovalBinding, trust StepUpTrust, now time.Time) error
ConsumeRemoteActionApproval is a cross-process no-replace replay journal in existing local custody. A crash after consumption leaves the approval spent; resume through the executor's existing operation journal, never replay it.
func NormalizeStepUpOrigin ¶
NormalizeStepUpOrigin keeps registration, the browser Origin and OAuth callback on one canonical HTTPS origin. Unsupported host forms fail during startup.
func StepUpNonce ¶
func StepUpNonce(binding RemoteActionApprovalBinding) (string, error)
func VerifyRemoteActionApproval ¶
func VerifyRemoteActionApproval(ctx context.Context, workspaceRoot, origin string, receipt json.RawMessage, expected RemoteActionApprovalBinding) error
VerifyRemoteActionApproval requires the live Home owner/client projection and consumes the exact approval before the caller dispatches any mutation.
func VerifyRemoteActionApprovalClaims ¶
func VerifyRemoteActionApprovalClaims(receipt json.RawMessage, expected RemoteActionApprovalBinding, trust StepUpTrust, now time.Time) error
VerifyRemoteActionApprovalClaims verifies the independent human signature. It performs no mutation. The executor must consume the approval durably before its first side effect, using ConsumeRemoteActionApproval or its existing replay journal, after all action, device, target and current Home-trust admission.
Types ¶
type HouseholdUser ¶
type HouseholdUser struct {
Username string
Email string
DisplayName string
Status string
ExpiresAt time.Time
SetupURL string
}
HouseholdUser is one non-owner PocketID subject in the household group.
type HouseholdUserSpec ¶
HouseholdUserSpec is the owner-supplied identity for one household member.
type OwnerActivation ¶
OwnerActivation is the owner-bound passkey enrollment state. SetupURL is returned only by the explicit activation operation and must remain transient.
type RemoteActionApproval ¶
type RemoteActionApproval struct {
IDToken string `json:"idToken"`
}
RemoteActionApproval preserves the actual PocketID signature. A lifecycle owner-key signature cannot replace this token or satisfy human approval. Treat this structure as a credential: never put it in logs or public receipts.
type RemoteActionApprovalBinding ¶
type RemoteActionApprovalBinding struct {
ActionDigest string `json:"actionDigest"`
PlanHash string `json:"planHash"`
Action string `json:"action"`
OwnerRef string `json:"ownerRef"`
HomeSiteRef string `json:"homeSiteRef"`
TargetSiteRef string `json:"targetSiteRef"`
TargetNodeRef string `json:"targetNodeRef"`
IssuedAt time.Time `json:"issuedAt"`
ExpiresAt time.Time `json:"expiresAt"`
}
RemoteActionApprovalBinding is supplied by the admitted action receiver, never copied from the receipt. ActionDigest covers the unsigned action envelope, including its nonce and idempotency key, but excludes the approval itself.
type Result ¶
type Result struct {
Binding localevidence.OwnerRuntimeBinding
EnrollmentPath string
}
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func (*Service) AddHouseholdUser ¶
func (s *Service) AddHouseholdUser(ctx context.Context, spec HouseholdUserSpec) (HouseholdUser, error)
AddHouseholdUser creates a non-admin PocketID subject in the household group and returns a one-time passkey enrollment URL. Owners, admins and break-glass identities are refused.
func (*Service) ExchangeStepUpCode ¶
func (s *Service) ExchangeStepUpCode(ctx context.Context, origin, code, verifier string, expected RemoteActionApprovalBinding) (json.RawMessage, error)
ExchangeStepUpCode uses only the fixed local PocketID endpoint. Neither an incoming token nor discovery metadata may redirect a request to another host.
func (*Service) IssueOwnerActivation ¶
func (s *Service) IssueOwnerActivation(ctx context.Context) (OwnerActivation, error)
IssueOwnerActivation returns the current pending one-time URL, or replaces an expired enrollment. It never mints another link for an active owner.
func (*Service) ListHouseholdUsers ¶
func (s *Service) ListHouseholdUsers(ctx context.Context) ([]HouseholdUser, error)
ListHouseholdUsers returns non-admin PocketID subjects in the household group.
func (*Service) OwnerActivationStatus ¶
func (s *Service) OwnerActivationStatus(ctx context.Context) (OwnerActivation, error)
OwnerActivationStatus verifies the exact owner runtime binding and reports completion from PocketID's passkey records.
func (*Service) PrepareStepUp ¶
PrepareStepUp binds a dedicated confidential PKCE client to an explicitly configured HTTPS server origin. Existing clients are verified, never silently rewritten.
func (*Service) ReadStepUpTrust ¶
ReadStepUpTrust verifies current owner, client and public signing keys without creating or changing identity resources. The remote peer enrollment owner may project this trust only through its existing authenticated custody contract.
func (*Service) Realize ¶
Realize creates the exact desired PocketID owner once, persists a private one-time passkey-enrollment URL, and records a secret-free signed binding to ownerRef and the step-ca certificate chain.
A reset host answers as an empty PocketID: reachable, unbootstrapped, and without the subject, groups, or client the workspace recorded. Realize treats that as work to redo rather than as a reason to refuse, so re-running an install rebuilds the owner from the custody that survived on disk.
func (*Service) RemoveHouseholdUser ¶
RemoveHouseholdUser deletes one household subject. Owner and admin identities are refused.
func (*Service) Verify ¶
func (s *Service) Verify(ctx context.Context) (localevidence.OwnerRuntimeBinding, error)
Verify performs only authenticated readback. It verifies custody and the signed binding before any network request and never creates or updates a PocketID resource.
type StepUpTrust ¶
type StepUpTrust struct {
Issuer string
Subject string
OwnerRef string
HomeSiteRef string
Keys jose.JSONWebKeySet
}
StepUpTrust must come from admitted Home identity custody. A caller must never accept issuer, subject, or keys supplied alongside an untrusted approval. Remote consumers also need a current admitted client/owner projection: offline verification alone cannot discover a disabled owner or changed client policy.
Source Files