Documentation
¶
Overview ¶
Package webkey manages the dedicated web-surface access credential for the embedded web UI. It is a separate credential namespace: the web key is never used as, defaulted to, or derived from http.token or the sync token.
Index ¶
Constants ¶
const ( // DefaultFileName is the conventional web key file name inside the Cortex // configuration directory. DefaultFileName = "web.key" )
Variables ¶
var ( // ErrKeyNotFound indicates no web key file exists at the store path. ErrKeyNotFound = errors.New("webkey: web access key file not found") // ErrKeyExists indicates the web key file is already present. ErrKeyExists = errors.New("webkey: web access key file already exists") // ErrInvalidKey is the deterministic rejection for any failed verification. ErrInvalidKey = errors.New("webkey: invalid web access key") // ErrMalformedKeyFile indicates the key file cannot be parsed. ErrMalformedKeyFile = errors.New("webkey: malformed web key file") // ErrInsecurePermissions indicates the key file is group/other readable. ErrInsecurePermissions = errors.New("webkey: web key file permissions too permissive") )
Functions ¶
This section is empty.
Types ¶
type Record ¶
Record is the non-secret at-rest representation of a web access key. It never carries the plaintext secret.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store owns a single web key file at a caller-supplied path.
func NewStore ¶
NewStore returns a Store bound to path. The path is never defaulted or read from global configuration; callers pass an explicit location.
func (*Store) EnsureFirstBoot ¶
EnsureFirstBoot mints and persists a key when none exists, returning the plaintext with minted=true exactly once. When a key already exists, including the loser of a concurrent first boot, it returns minted=false and no plaintext.
func (*Store) Generate ¶
Generate mints a new web key, persists it with an exclusive create, and returns the plaintext exactly once. It fails with ErrKeyExists when a key file already exists and never leaves a partial file behind.
func (*Store) Regenerate ¶
Regenerate atomically replaces the persisted key with a freshly minted one and returns the new plaintext exactly once. The previous key remains valid until the replacement write succeeds.
Source Files