Documentation
¶
Overview ¶
Package advancedcapability verifies the short-lived, secret-free capabilities which authorize individual StackKits advanced operations.
Verification is deliberately offline. Callers must inject a versioned trust bundle and the exact local stack, owner, and operation scope being admitted.
Index ¶
- Constants
- func VerifyIdentityProjectionDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- type BackupRenewal
- type Denial
- type Grant
- type ReasonCode
- type Request
- type TrustBundle
- type TrustedKey
Constants ¶
const ( SchemaVersion = "stackkit.advanced-capability/v1" TrustBundleSchemaVersion = "stackkit.advanced-trust-bundle/v1" Audience = "stackkit" )
const ( OperationDriftReconcileAdvanced = "drift.reconcile.advanced" OperationRestoreDrill = "restore.drill" OperationRollbackCoordinated = "rollback.coordinated" OperationTerramateChangeSetApply = "terramate.change-set.apply" OperationTerramateChangeSetCreate = "terramate.change-set.create" )
Variables ¶
This section is empty.
Functions ¶
func VerifyIdentityProjectionDigest ¶
func VerifyIdentityProjectionDigest( bundle *TrustBundle, issuerID, keyID string, digest, signature []byte, ) error
VerifyIdentityProjectionDigest verifies one domain-separated desired identity projection digest against the exact Owner-approved issuer/key binding. It intentionally exposes neither trusted public-key bytes nor a generic signing oracle to callers.
func VerifyTrustedDigest ¶
func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
VerifyTrustedDigest verifies one domain-separated digest against the exact Owner-approved issuer/key binding used by Advanced capability verification. It is the only additional trust seam needed by authenticated execution channels: callers cannot supply a second trust schema, store, or key parser.
Types ¶
type BackupRenewal ¶ added in v0.47.7
type BackupRenewal struct {
AgentID string `json:"agentId"`
BindingHash string `json:"bindingHash"`
CustodyAttestationRef string `json:"custodyAttestationRef"`
DeploymentID string `json:"deploymentId"`
FreshAttestationRef string `json:"freshAttestationRef"`
JobID string `json:"jobId"`
MeasuredAt string `json:"measuredAt"`
PlanHash string `json:"planHash"`
QuotaBytes string `json:"quotaBytes"`
RepositoryID string `json:"repositoryId"`
TargetRef string `json:"targetRef"`
TenantID string `json:"tenantId"`
UsedBytes string `json:"usedBytes"`
}
BackupRenewal authorizes one local staged drill against unchanged applied authority after fresh managed entitlement, usage and remote target attestation. It grants no remote snapshot or data activation authority. All fields are canonical ASCII strings so both issuers serialize identical JCS bytes.
type Denial ¶
type Denial struct {
Code ReasonCode
Field string
Detail string
}
Denial is returned for every Verify failure. Code is stable; Field and Detail are diagnostic and must not be used as policy inputs.
type Grant ¶
type Grant struct {
BackupRenewal *BackupRenewal
CapabilityID string
IssuerID string
StackID string
OwnerRef string
AllowedOperations []string
UIManagerRef string
RILRef string
IssuedAt time.Time
ExpiresAt time.Time
KeyID string
}
Grant is the fully verified and locally scoped capability.
func Verify ¶
Verify validates signature, trust, lifetime, and the exact caller-supplied local scope without network access or side effects.
func (Grant) AuthorizeBackupRenewal ¶ added in v0.47.7
func (grant Grant) AuthorizeBackupRenewal(jobID, planHash, repositoryID, bindingHash, targetRef, custodyRef string, now time.Time) error
AuthorizeBackupRenewal narrows a verified grant to one immutable local operation and repository. Callers derive this scope from signed Apply custody.
type ReasonCode ¶
type ReasonCode string
ReasonCode is a stable, machine-readable fail-closed denial reason.
const ( ReasonCapabilityRequired ReasonCode = "advanced_capability_required" ReasonCapabilityMalformed ReasonCode = "advanced_capability_malformed" ReasonCapabilityUntrustedKey ReasonCode = "advanced_capability_untrusted_key" ReasonCapabilitySignatureInvalid ReasonCode = "advanced_capability_signature_invalid" ReasonCapabilityNotYetValid ReasonCode = "advanced_capability_not_yet_valid" ReasonCapabilityExpired ReasonCode = "advanced_capability_expired" ReasonCapabilityLifetimeExceeded ReasonCode = "advanced_capability_lifetime_exceeded" ReasonCapabilityScopeMismatch ReasonCode = "advanced_capability_scope_mismatch" ReasonCapabilityOperationDenied ReasonCode = "advanced_capability_operation_denied" ReasonAdvancedChangeSetInvalid ReasonCode = "advanced_change_set_invalid" ReasonAdvancedChangeSetStale ReasonCode = "advanced_change_set_stale" )
func Reason ¶
func Reason(err error) (ReasonCode, bool)
Reason returns a stable reason code for a denial.
type Request ¶
type Request struct {
Now time.Time
TrustBundle *TrustBundle
StackID string
OwnerRef string
Operation string
IssuerID string
UIManagerRef string
RILRef string
}
Request binds verification to the exact local operation being admitted. Optional expected issuer/approval references add narrower caller scope.
type TrustBundle ¶
type TrustBundle struct {
SchemaVersion string
Keys []TrustedKey
}
TrustBundle is injected by the StackKits composition root. Verification performs no network, environment, file, or Techstack-client discovery.
Source Files