targetenrollment

type Authority ¶

type Authority struct {
	// contains filtered or unexported fields
}

func New(store Store, issuer serviceaccess.CSRIssuer) (*Authority, error)

func (a *Authority) Create(ctx context.Context, scope Scope, lifetime, certificateTTL time.Duration) (Bootstrap, error)

func (a *Authority) CreateRenewal(ctx context.Context, scope Scope, lifetime, certificateTTL time.Duration) (Bootstrap, error)

func (a *Authority) Enroll(ctx context.Context, request Request) (Result, error)

type Bootstrap ¶

type Bootstrap struct {
	Token     string    `json:"token"`
	Nonce     string    `json:"nonce"`
	ExpiresAt time.Time `json:"expires_at"`
}

type CurrentNodeTrust ¶

type CurrentNodeTrust interface {
	NodeTrust(context.Context) (*x509.CertPool, error)
}

CurrentNodeTrust is consulted for active sessions as well as new admission. Handshake-time VerifiedChains alone cannot detect removal of a former CA.

type Grant ¶

type Grant struct {
	Scope          Scope
	TokenDigest    string
	NonceDigest    string
	ExpiresAt      time.Time
	CertificateTTL time.Duration
}

Grant contains only digests, never the bootstrap bearer credential or nonce.

type HTTPHandler ¶

type HTTPHandler struct {
	// contains filtered or unexported fields
}

func NewHTTP(authority *Authority, resolve ScopeResolver) (*HTTPHandler, error)

func (h *HTTPHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

type NodeRegistry ¶

type NodeRegistry interface {
	AdmitCertificate(context.Context, Scope, string, time.Time) error
}

NodeRegistry admits only a currently active certificate bound to the exact persisted tenant/Target/node/runtime. A trusted CA alone is not admission.

func WithLiveTrust(registry NodeRegistry, load func(context.Context) (*x509.CertPool, error)) (NodeRegistry, error)

type RenewalStore ¶

type RenewalStore interface {
	CreateRenewal(context.Context, Grant) error
}

RenewalStore explicitly authorizes replacement of an existing node's active certificate. Ordinary initial enrollment cannot replace an issued identity.

type Request ¶

type Request struct {
	Scope  Scope
	Token  string
	Nonce  string
	CSRPEM []byte
}

type Result ¶

type Result struct {
	Certificate serviceaccess.IssuedCertificate
	Trust       serviceaccess.TrustBundle
}

type Scope ¶

type Scope struct {
	TenantID string
	TargetID string
	NodeID   string
	Runtime  string
}

Scope is selected and authorized by Core before creating a bootstrap grant. The Connector cannot choose another tenant, Target, runtime, or identity.

func (s Scope) Identity() string

func (s Scope) Validate() error

type ScopeResolver ¶

type ScopeResolver func(context.Context, string, string, string) (Scope, error)

ScopeResolver must use Core's Target registry, tenant ownership and effective policy. User-supplied runtime and tenant fields are deliberately not accepted.

type Store ¶

type Store interface {
	Create(context.Context, Grant) error
	Consume(context.Context, Scope, string, string, string, time.Time) (Grant, error)
	RecordIssued(context.Context, Scope, string, string, time.Time) error
}

Store must persist consumption before returning success, including under concurrent requests and process restarts. Signing failures do not unconsume.