auth

package

v0.2.0-beta.4 Latest Latest Go to latest Published: Sep 4, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/larchwave/flowbaton

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth issues and verifies FlowBaton's channel-bound Ed25519 session tokens.

Index ¶

Constants
Variables
func LoadPrivateKey(path, expectedKeyID string) (string, ed25519.PrivateKey, error)
func NormalizeTokenTTL(ttl time.Duration) (time.Duration, error)
type Claims
- func (claims Claims) HasScope(scope string) bool
type Issuer
- func (issuer Issuer) Issue(claims Claims) (string, error)
- func (issuer Issuer) IssueAt(claims Claims, issuedAt, expiresAt time.Time) (string, error)
type Verifier

Constants ¶

View Source

const (
	DefaultTokenTTL = 5 * time.Minute
	MaxTokenTTL     = time.Hour
)

Variables ¶

View Source

var (
	ErrInvalidToken = errors.New("invalid FlowBaton session token")
	ErrExpiredToken = errors.New("expired FlowBaton session token")
)

Functions ¶

func LoadPrivateKey ¶

func LoadPrivateKey(path, expectedKeyID string) (string, ed25519.PrivateKey, error)

LoadPrivateKey reads the strict JSON format emitted by `flowbaton auth keygen`.

func NormalizeTokenTTL ¶

func NormalizeTokenTTL(ttl time.Duration) (time.Duration, error)

NormalizeTokenTTL applies the safe default and rejects negative, sub-second, or overly long token lifetimes.

Types ¶

type Claims ¶

type Claims struct {
	KeyID                  string   `json:"kid"`
	TenantID               string   `json:"tenant_id"`
	PrincipalID            string   `json:"principal_id"`
	CertificateFingerprint string   `json:"certificate_fingerprint_sha256"`
	ChannelBindingSHA256   string   `json:"channel_binding_sha256"`
	Nonce                  string   `json:"nonce"`
	Scopes                 []string `json:"scopes"`
	IssuedAt               int64    `json:"iat"`
	ExpiresAt              int64    `json:"exp"`
}

Claims are the authenticated facts carried by a FlowBaton-issued token. Tenant and principal are derived from a certificate mapping, never request JSON.

func (Claims) HasScope ¶

func (claims Claims) HasScope(scope string) bool

HasScope reports exact scope membership.

type Issuer ¶

type Issuer struct {
	KeyID      string
	PrivateKey ed25519.PrivateKey
	TTL        time.Duration
	Now        func() time.Time
}

Issuer signs short-lived session tokens with one Ed25519 key.

func (Issuer) Issue ¶

func (issuer Issuer) Issue(claims Claims) (string, error)

Issue signs claims after overwriting key and validity fields.

func (Issuer) IssueAt ¶

func (issuer Issuer) IssueAt(claims Claims, issuedAt, expiresAt time.Time) (string, error)

IssueAt signs claims using an exact, externally-authoritative validity window. Both endpoints must use whole-second precision.

type Verifier ¶

type Verifier struct {
	Keys map[string]ed25519.PublicKey
	Now  func() time.Time
}

Verifier accepts the active and previous public keys during rotation.

func (Verifier) Verify ¶

func (verifier Verifier) Verify(token string) (Claims, error)

Verify validates strict encoding, the Ed25519 signature, time bounds, and all mandatory channel-bound identity fields.

func (Verifier) VerifyAt ¶

func (verifier Verifier) VerifyAt(token string, now time.Time) (Claims, error)

VerifyAt validates a token at an explicitly supplied authoritative time.

func (Verifier) VerifySignature ¶

func (verifier Verifier) VerifySignature(token string) (Claims, error)

VerifySignature validates strict encoding, the Ed25519 signature, and all mandatory claims without consulting a clock.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL