Documentation
¶
Overview ¶
Package rungrant mints and checks the token that travels with one piece of work: proof that the chassis dispatched it, and the id of the run grant row that says what it may ask for.
A token is a claim set and an HMAC over it, the form of a signed URL (chassis/signedurl) under a key of its own:
rg1.<base64url(JSON claims)>.<base64url(HMAC-SHA256)>
The token IDENTIFIES; the row AUTHORIZES. A token carries no allowlist and no budget, so a genuine token is never enough on its own: every request reads the row (chassis/authn), where revocation, a newer generation and a spent budget live. Nothing is stored here, and any node holding the same key verifies any node's token.
A token is a bearer credential until it expires. Keep it out of logs, traces and envelopes.
Index ¶
Constants ¶
const KeyLabel = "txco/run-grant/v1"
KeyLabel is the derivation label of the signing key (secrets.DeriveKey). Part of the wire contract: changing it invalidates every live token. It differs from every other label, so a token of another kind (a signed URL) never verifies here, nor one of these there.
const (
// Prefix starts every token, for a scrubber that finds one by its shape.
Prefix = version + "."
)
Variables ¶
var ( // ErrInvalid is every way a token can be wrong that is not its age: // malformed, forged, signed by another key generation. ErrInvalid = errors.New("rungrant: invalid token") // ErrExpired is a genuine token past its expiry. ErrExpired = errors.New("rungrant: token expired") )
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
Grant string `json:"g"` // run grant id
Tenant string `json:"t"` // tenant id, not its slug
Principal string `json:"p"`
Run string `json:"r"`
Generation int64 `json:"n"`
Depth int `json:"d,omitempty"`
Trace string `json:"x,omitempty"` // the request that minted the grant
Expires int64 `json:"e"` // unix seconds
KeyVersion int `json:"k"` // master-key generation that signed it
}
Claims is what a token says: run grant Grant of tenant Tenant was minted for Principal's run Run at generation Generation, and is good until Expires. Every field but Depth and Trace is required.
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer signs and verifies tokens under one key.
func New ¶
New returns a Signer over key (32 bytes from secrets.DeriveKey with KeyLabel) of the given master-key generation. The Signer keeps its own copy.
Source Files