Documentation
¶
Overview ¶
Package auth provides shared authentication primitives for the stackkit CLI and supporting libraries. The single primitive today is the HS256 service-auth JWT signer used for service-to-service calls into kombify-Administration.
Wire-format mirrors kombify-go-common/servicecall.IssueToken byte-for-byte so admin's tryServiceAuth verifier accepts our tokens. Kept inline (not pulled from go-common) because servicekit cannot import go-common as a module without changing the repo's external-dependency posture.
Index ¶
Constants ¶
const DefaultTokenTTL = 5 * time.Minute
DefaultTokenTTL is the default expiry duration for a minted token. Short by design: replays are bounded to 5 minutes.
const HeaderServiceAuth = "X-Kombify-Service-Auth"
HeaderServiceAuth is the HTTP header that carries the signed token. Must equal kombify-Administration's HEADER_SERVICE_AUTH constant.
Variables ¶
This section is empty.
Functions ¶
func SignServiceToken ¶
SignServiceToken mints an HS256 service-auth JWT.
svc service slug (the caller; e.g. "stackkits") target service slug being called (e.g. "administration") secret shared signing secret (SERVICE_AUTH_SECRET from the deployment's secret store) ttl token lifetime; <=0 falls back to DefaultTokenTTL
Returns "header.payload.signature" with each part base64url-encoded without padding. Admin's tryServiceAuth verifies signature + audience (kombify-<target>) + caller-allowlist (svc).
Types ¶
type Claims ¶
type Claims struct {
Iss string `json:"iss"`
Aud string `json:"aud"`
Iat int64 `json:"iat"`
Exp int64 `json:"exp"`
Svc string `json:"svc"`
RequestID string `json:"reqId,omitempty"`
}
Claims is the JSON shape inside the JWT payload. Kept minimal — admin only inspects iss/aud/iat/exp/svc.
func VerifyServiceToken ¶
func VerifyServiceToken(token string, opts VerifyOptions) (*Claims, error)
VerifyServiceToken verifies an HS256 service-auth JWT minted by SignServiceToken or kombify-go-common/servicecall.IssueToken.
Source Files