Documentation
¶
Overview ¶
Package webkey manages the dedicated web-surface access credential for the embedded web UI. It is a separate credential namespace: the web key is never used as, defaulted to, or derived from http.token or the sync token.
Index ¶
Constants ¶
const ( // DefaultFileName is the conventional web key file name inside the Cortex // configuration directory. DefaultFileName = "web.key" )
const EnvKey = "CORTEX_WEB_KEY"
EnvKey is the environment variable that pins the web access key on deployments without a writable state volume (e.g. ephemeral container hosts). When set, the key file is never minted or consulted: verification uses the pinned secret in memory and the previous key file is ignored.
Variables ¶
var ( // ErrKeyNotFound indicates no web key file exists at the store path. ErrKeyNotFound = errors.New("webkey: web access key file not found") // ErrKeyExists indicates the web key file is already present. ErrKeyExists = errors.New("webkey: web access key file already exists") // ErrInvalidKey is the deterministic rejection for any failed verification. ErrInvalidKey = errors.New("webkey: invalid web access key") // ErrMalformedKeyFile indicates the key file cannot be parsed. ErrMalformedKeyFile = errors.New("webkey: malformed web key file") // ErrInsecurePermissions indicates the key file is group/other readable. ErrInsecurePermissions = errors.New("webkey: web key file permissions too permissive") )
var ( // ErrInvalidPinnedKey is the deterministic fail-closed rejection for any // CORTEX_WEB_KEY value that does not match the minted key format. ErrInvalidPinnedKey = errors.New("webkey: CORTEX_WEB_KEY does not match the minted key format (ctx_ + 43 base64url characters)") )
Functions ¶
func ResolveEnvOverride ¶ added in v2.4.17
ResolveEnvOverride returns the trimmed CORTEX_WEB_KEY override ("" when the variable is unset or blank). A non-blank value that fails ValidateSecret is an error so callers can abort startup instead of silently regenerating.
func ValidateSecret ¶ added in v2.4.17
ValidateSecret enforces the minted key format: the ctx_ namespace prefix followed by exactly 43 RawURL-base64 characters decoding to a 256-bit secret. It is the fail-closed gate for operator-pinned keys.
Types ¶
type Record ¶
Record is the non-secret at-rest representation of a web access key. It never carries the plaintext secret.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store owns a single web key file at a caller-supplied path.
func NewStore ¶
NewStore returns a Store bound to path. The path is never defaulted or read from global configuration; callers pass an explicit location.
func (*Store) EnsureFirstBoot ¶
EnsureFirstBoot mints and persists a key when none exists, returning the plaintext with minted=true exactly once. When a key already exists, including the loser of a concurrent first boot, it returns minted=false and no plaintext.
func (*Store) Generate ¶
Generate mints a new web key, persists it with an exclusive create, and returns the plaintext exactly once. It fails with ErrKeyExists when a key file already exists and never leaves a partial file behind.
func (*Store) Regenerate ¶
Regenerate atomically replaces the persisted key with a freshly minted one and returns the new plaintext exactly once. The previous key remains valid until the replacement write succeeds.
Source Files