identityprojection

package
v0.42.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

Package identityprojection owns the credential-free desired identity projection accepted by a standalone StackKits installation. Cloud or Techstack may sign a proposal, but only current local Owner custody can approve it for a later PocketID mutation.

Index

Constants

View Source 
const (
	SchemaVersion = "stackkit.desired-identity-projection/v1"
	Audience      = "stackkit-local-identity"
	Kind          = "DesiredIdentityProjection"

	ProjectionActionUpsert = "upsert"
)

Variables

This section is empty.

Functions

This section is empty.

Types

type Approval 

type Approval struct {
	ApprovedAt        time.Time                                      `json:"approvedAt"`
	Kind              string                                         `json:"kind"`
	OwnerRef          string                                         `json:"ownerRef"`
	Projection        Projection                                     `json:"projection"`
	ProjectionSHA256  string                                         `json:"projectionSHA256"`
	SchemaVersion     string                                         `json:"schemaVersion"`
	TrustBundleSHA256 string                                         `json:"trustBundleSHA256"`
	OwnerSignature    localevidence.OwnerIdentityProjectionSignature `json:"ownerSignature"`
}

type Inspection 

type Inspection struct {
	SchemaVersion    string    `json:"schemaVersion"`
	ProjectionID     string    `json:"projectionId"`
	ProjectionSHA256 string    `json:"projectionSHA256"`
	IssuerID         string    `json:"issuerId"`
	KeyID            string    `json:"keyId"`
	OwnerRef         string    `json:"ownerRef"`
	SubjectRef       string    `json:"subjectRef"`
	Profile          Profile   `json:"profile"`
	Groups           []string  `json:"groups"`
	IssuedAt         time.Time `json:"issuedAt"`
	ExpiresAt        time.Time `json:"expiresAt"`
	CredentialFree   bool      `json:"credentialFree"`
}

type Mutator 

type Mutator interface {
	Apply(context.Context, Projection) (string, []string, error)
}

type Profile 

type Profile struct {
	Username    string `json:"username"`
	Email       string `json:"email"`
	DisplayName string `json:"displayName"`
}

type Projection 

type Projection struct {
	Audience        string   `json:"audience"`
	ExpiresAt       string   `json:"expiresAt"`
	Groups          []string `json:"groups"`
	IssuedAt        string   `json:"issuedAt"`
	IssuerID        string   `json:"issuerId"`
	KeyID           string   `json:"keyId"`
	Kind            string   `json:"kind"`
	OwnerRef        string   `json:"ownerRef"`
	Profile         Profile  `json:"profile"`
	ProjectionID    string   `json:"projectionId"`
	RequestedAction string   `json:"requestedAction"`
	SchemaVersion   string   `json:"schemaVersion"`
	Signature       string   `json:"signature"`
	SubjectRef      string   `json:"subjectRef"`
}

Projection contains only declarative identity data and public signature metadata. Exact-field decoding rejects credentials, sessions, passkeys, private keys, admin secrets, URLs, and provider endpoints.

func (Projection) MarshalCanonical 

func (projection Projection) MarshalCanonical() ([]byte, error)

type Receipt 

type Receipt struct {
	CloudRequired     bool                                           `json:"cloudRequired"`
	CompletedAt       time.Time                                      `json:"completedAt"`
	DeletionPerformed bool                                           `json:"deletionPerformed"`
	Groups            []string                                       `json:"groups"`
	Kind              string                                         `json:"kind"`
	Operation         string                                         `json:"operation"`
	OwnerRef          string                                         `json:"ownerRef"`
	PocketIDSubject   string                                         `json:"pocketIdSubject,omitempty"`
	ProjectionID      string                                         `json:"projectionId"`
	ProjectionSHA256  string                                         `json:"projectionSHA256"`
	SchemaVersion     string                                         `json:"schemaVersion"`
	Status            string                                         `json:"status"`
	OwnerSignature    localevidence.OwnerIdentityProjectionSignature `json:"ownerSignature"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func NewService 

func NewService(workspace string) (*Service, error)

func NewServiceWithMutator 

func NewServiceWithMutator(workspace string, mutator Mutator) (*Service, error)

func (*Service) Apply 

func (s *Service) Apply(ctx context.Context, projectionSHA256 string, now time.Time) (Receipt, error)

Apply returns an existing verified receipt before consulting projection expiry or PocketID. Therefore expiry, trust rotation, or Cloud loss can never undo an already locally applied identity.

func (*Service) Approve 

func (s *Service) Approve(raw []byte, now time.Time) (Approval, error)

Approve verifies external issuer trust and expiry, then records a separate local Owner signature. It performs no PocketID request or other network I/O.

func (*Service) Inspect 

func (s *Service) Inspect(raw []byte, now time.Time) (Inspection, error)
func (s *Service) Unlink(projectionSHA256 string, now time.Time) (Receipt, error)

Unlink records only that the optional external projection is detached. It deliberately has no Mutator call and no delete operation. Local users, groups, Owner custody, keys, TinyAuth, and lifecycle state remain untouched.

type Verified 

type Verified struct {
	Projection Projection
	SHA256     string
	IssuedAt   time.Time
	ExpiresAt  time.Time
}

func Verify 

func Verify(
	raw []byte,
	trust advancedcapability.TrustBundle,
	expectedOwnerRef string,
	now time.Time,
	allowExpired bool,
) (Verified, error)

func (Verified) Inspection 

func (verified Verified) Inspection() Inspection

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.