Documentation
¶
Overview ¶
Package advancedcapability verifies the short-lived, secret-free capabilities which authorize individual StackKits advanced operations.
Verification is deliberately offline. Callers must inject a versioned trust bundle and the exact local stack, owner, and operation scope being admitted.
Index ¶
- Constants
- func VerifyIdentityProjectionDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
- type Denial
- type Grant
- type ReasonCode
- type Request
- type TransferReceive
- type TransferRetirement
- type TrustBundle
- type TrustedKey
Constants ¶
const ( SchemaVersion = wire.SchemaVersion TrustBundleSchemaVersion = wire.TrustBundleSchemaVersion Audience = wire.Audience )
const ( OperationApplicationTransferReceive = wire.OperationApplicationTransferReceive OperationApplicationTransferRetire = wire.OperationApplicationTransferRetire OperationDriftReconcileAdvanced = wire.OperationDriftReconcileAdvanced OperationOriginCertificateInstall = wire.OperationOriginCertificateInstall OperationOriginCertificateRequest = wire.OperationOriginCertificateRequest OperationRestoreDrill = wire.OperationRestoreDrill OperationRollbackCoordinated = wire.OperationRollbackCoordinated OperationTerramateChangeSetApply = wire.OperationTerramateChangeSetApply OperationTerramateChangeSetCreate = wire.OperationTerramateChangeSetCreate )
const TrustedIssuerID = "techstack"
TrustedIssuerID is the only issuer identity whose Advanced capabilities and execution-channel digests the standalone CLI accepts: Techstack is the Advanced control plane. A trust bundle can hold other issuer bindings (for example the kombify Cloud issuer of desired identity projections), but none of them is ever consulted for a capability or an execution channel.
Variables ¶
This section is empty.
Functions ¶
func VerifyIdentityProjectionDigest ¶
func VerifyIdentityProjectionDigest( bundle *TrustBundle, issuerID, keyID string, digest, signature []byte, ) error
VerifyIdentityProjectionDigest verifies one domain-separated desired identity projection digest against the exact Owner-approved issuer/key binding. It intentionally exposes neither trusted public-key bytes nor a generic signing oracle to callers.
func VerifyTrustedDigest ¶
func VerifyTrustedDigest(bundle *TrustBundle, issuerID, keyID string, digest, signature []byte) error
VerifyTrustedDigest verifies one domain-separated digest against the exact Owner-approved issuer/key binding used by Advanced capability verification. It is the only additional trust seam needed by authenticated execution channels: callers cannot supply a second trust schema, store, or key parser.
Types ¶
type Denial ¶
type Denial struct {
Code ReasonCode
Field string
Detail string
}
Denial is returned for every Verify failure. Code is stable; Field and Detail are diagnostic and must not be used as policy inputs.
type Grant ¶
type Grant struct {
TransferRetirement *wire.TransferRetirement
TransferReceive *wire.TransferReceive
BackupRenewal *wire.BackupRenewal
CapabilityID string
IssuerID string
StackID string
OwnerRef string
AllowedOperations []string
UIManagerRef string
RILRef string
IssuedAt time.Time
ExpiresAt time.Time
KeyID string
}
Grant is the fully verified and locally scoped capability.
func Verify ¶
Verify validates signature, trust, lifetime, and the exact caller-supplied local scope without network access or side effects.
func (Grant) AuthorizeBackupRenewal ¶ added in v0.47.7
func (grant Grant) AuthorizeBackupRenewal(jobID, planHash, repositoryID, bindingHash, targetRef, custodyRef string, now time.Time) error
AuthorizeBackupRenewal narrows a verified grant to one immutable local operation and repository. Callers derive this scope from signed Apply custody.
type ReasonCode ¶
type ReasonCode string
ReasonCode is a stable, machine-readable fail-closed denial reason.
const ( ReasonCapabilityRequired ReasonCode = "advanced_capability_required" ReasonCapabilityMalformed ReasonCode = "advanced_capability_malformed" ReasonCapabilityUntrustedKey ReasonCode = "advanced_capability_untrusted_key" ReasonCapabilitySignatureInvalid ReasonCode = "advanced_capability_signature_invalid" ReasonCapabilityNotYetValid ReasonCode = "advanced_capability_not_yet_valid" ReasonCapabilityExpired ReasonCode = "advanced_capability_expired" ReasonCapabilityLifetimeExceeded ReasonCode = "advanced_capability_lifetime_exceeded" ReasonCapabilityScopeMismatch ReasonCode = "advanced_capability_scope_mismatch" ReasonCapabilityOperationDenied ReasonCode = "advanced_capability_operation_denied" ReasonAdvancedChangeSetInvalid ReasonCode = "advanced_change_set_invalid" ReasonAdvancedChangeSetStale ReasonCode = "advanced_change_set_stale" )
func Reason ¶
func Reason(err error) (ReasonCode, bool)
Reason returns a stable reason code for a denial.
type Request ¶
type Request struct {
TransferRetirement *wire.TransferRetirement
TransferReceive *wire.TransferReceive
Now time.Time
TrustBundle *TrustBundle
StackID string
OwnerRef string
Operation string
IssuerID string
UIManagerRef string
RILRef string
}
Request binds verification to the exact local operation being admitted. Optional expected issuer/approval references add narrower caller scope.
type TransferReceive ¶
type TransferReceive = wire.TransferReceive
type TransferRetirement ¶ added in v0.54.10
type TransferRetirement = wire.TransferRetirement
type TrustBundle ¶
type TrustBundle struct {
SchemaVersion string
Keys []TrustedKey
}
TrustBundle is injected by the StackKits composition root. Verification performs no network, environment, file, or Techstack-client discovery.
Source Files