Documentation
¶
Overview ¶
Package advancedcapability verifies the short-lived, secret-free capabilities which authorize individual StackKits advanced operations.
Verification is deliberately offline. Callers must inject a versioned trust bundle and the exact local stack, owner, and operation scope being admitted.
Index ¶
- Constants
- func VerifyIdentityProjectionDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- type Denial
- type Grant
- type ReasonCode
- type Request
- type TrustBundle
- type TrustedKey
Constants ¶
const ( SchemaVersion = "stackkit.advanced-capability/v1" TrustBundleSchemaVersion = "stackkit.advanced-trust-bundle/v1" Audience = "stackkit" )
const ( OperationDriftReconcileAdvanced = "drift.reconcile.advanced" OperationRestoreDrill = "restore.drill" OperationRollbackCoordinated = "rollback.coordinated" OperationTerramateChangeSetApply = "terramate.change-set.apply" OperationTerramateChangeSetCreate = "terramate.change-set.create" )
Variables ¶
This section is empty.
Functions ¶
func VerifyIdentityProjectionDigest ¶
func VerifyIdentityProjectionDigest( bundle *TrustBundle, issuerID, keyID string, digest, signature []byte, ) error
VerifyIdentityProjectionDigest verifies one domain-separated desired identity projection digest against the exact Owner-approved issuer/key binding. It intentionally exposes neither trusted public-key bytes nor a generic signing oracle to callers.
func VerifyTrustedDigest ¶
func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
VerifyTrustedDigest verifies one domain-separated digest against the exact Owner-approved issuer/key binding used by Advanced capability verification. It is the only additional trust seam needed by authenticated execution channels: callers cannot supply a second trust schema, store, or key parser.
Types ¶
type Denial ¶
type Denial struct {
Code ReasonCode
Field string
Detail string
}
Denial is returned for every Verify failure. Code is stable; Field and Detail are diagnostic and must not be used as policy inputs.
type Grant ¶
type Grant struct {
CapabilityID string
IssuerID string
StackID string
OwnerRef string
AllowedOperations []string
UIManagerRef string
RILRef string
IssuedAt time.Time
ExpiresAt time.Time
KeyID string
}
Grant is the fully verified and locally scoped capability.
type ReasonCode ¶
type ReasonCode string
ReasonCode is a stable, machine-readable fail-closed denial reason.
const ( ReasonCapabilityRequired ReasonCode = "advanced_capability_required" ReasonCapabilityMalformed ReasonCode = "advanced_capability_malformed" ReasonCapabilityUntrustedKey ReasonCode = "advanced_capability_untrusted_key" ReasonCapabilitySignatureInvalid ReasonCode = "advanced_capability_signature_invalid" ReasonCapabilityNotYetValid ReasonCode = "advanced_capability_not_yet_valid" ReasonCapabilityExpired ReasonCode = "advanced_capability_expired" ReasonCapabilityLifetimeExceeded ReasonCode = "advanced_capability_lifetime_exceeded" ReasonCapabilityScopeMismatch ReasonCode = "advanced_capability_scope_mismatch" ReasonCapabilityOperationDenied ReasonCode = "advanced_capability_operation_denied" ReasonAdvancedChangeSetInvalid ReasonCode = "advanced_change_set_invalid" ReasonAdvancedChangeSetStale ReasonCode = "advanced_change_set_stale" )
func Reason ¶
func Reason(err error) (ReasonCode, bool)
Reason returns a stable reason code for a denial.
type Request ¶
type Request struct {
Now time.Time
TrustBundle *TrustBundle
StackID string
OwnerRef string
Operation string
IssuerID string
UIManagerRef string
RILRef string
}
Request binds verification to the exact local operation being admitted. Optional expected issuer/approval references add narrower caller scope.
type TrustBundle ¶
type TrustBundle struct {
SchemaVersion string
Keys []TrustedKey
}
TrustBundle is injected by the StackKits composition root. Verification performs no network, environment, file, or Techstack-client discovery.
Source Files