Documentation
¶
Overview ¶
Package signedurl mints and checks the capability tokens behind `/_txc/signed/<token>`: a short-lived, self-contained grant to read ONE exact document, handed to something outside the chassis (a parser, a transcoder) so a large body never has to ride an envelope.
A token is a claim set and an HMAC over it:
v1.<base64url(JSON claims)>.<base64url(HMAC-SHA256)>
Nothing is stored. Any node holding the same key verifies any node's token, which is what lets one web node sign and another serve. The claims pin the document's CONTENT (its sha256), not just its address, so a token can never be made to read bytes that were not there when it was signed.
A token is a bearer credential for its lifetime. Keep it out of logs.
Index ¶
Constants ¶
const KeyLabel = "txco/signed-url/v1"
KeyLabel is the derivation label of the signing key (secrets.DeriveKey). Part of the wire contract: changing it invalidates every live token.
const PathPrefix = "/_txc/signed/"
PathPrefix is where the web head serves a token: PathPrefix + token.
Variables ¶
var ( // ErrInvalid is every way a token can be wrong that is not its age: // malformed, forged, signed by another key generation. ErrInvalid = errors.New("signedurl: invalid token") // ErrExpired is a genuine token past its expiry. ErrExpired = errors.New("signedurl: token expired") // ErrTooLong is a claim set (a long Name, JSON-escaped) that would make a // token Verify refuses: Sign never mints one. ErrTooLong = errors.New("signedurl: token too long") )
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
Tenant string `json:"t"`
Collection string `json:"c"` // collection id
Resource string `json:"r"` // resource id
SHA256 string `json:"h"` // bare hex of the pinned content
Expires int64 `json:"e"` // unix seconds
KeyVersion int `json:"k"` // master-key generation that signed it
Name string `json:"n,omitempty"` // the download's filename, if the signer chose one
}
Claims is what a token grants: a read of resource Resource in collection Collection of tenant Tenant, while its content is still SHA256, until Expires. Name, when set, is the filename the download is served under (the signer's choice; the document's own name otherwise).
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer signs and verifies tokens under one key.
func New ¶
New returns a Signer over key (32 bytes from secrets.DeriveKey) of the given master-key generation. The Signer keeps its own copy.
Source Files