Documentation
¶
Overview ¶
Package plantoken proves that what is about to be applied is exactly what somebody was already shown.
Authorization is a separate question, decided by the platform on the caller's own credential on every request. This package settles agreement. A plan returns a token hashing the manifests, their order, the project, and the resource version each manifest saw. Apply re-derives the hash and refuses any mismatch, so an edited manifest, a reordered list, another project's token, or an object somebody else changed cannot reach the platform. A change nobody was shown has no token at all.
The token proves agreement covered this change. It cannot prove agreement happened; the platform prompt requires that human step.
Index ¶
Constants ¶
const ( // TTL bounds how long agreement stays good: long enough to read and // answer, short enough not to outlive the conversation it was given in. TTL = 15 * time.Minute )
Variables ¶
This section is empty.
Functions ¶
func Mint ¶
Mint returns the token that authorizes applying exactly this plan until expiry.
The form is base64(HMAC-SHA256(payload)) + "." + expiry in seconds. The expiry travels in the clear but is covered by the hash, so moving it invalidates the token rather than extending it.
func ResolveKey ¶
ResolveKey returns the key tokens are minted and checked with.
A configured key survives restarts and is shared between replicas, so one process can apply another's plan. Without one, this process generates a random key: the guarantee still holds within the process, but a restart loses every outstanding plan and a sibling replica's plan is refused. That warrants a loud warning, and beats refusing to write or minting tokens with a guessable key.
func Verify ¶
Verify refuses anything that is not a token minted for exactly this plan and still inside its window.
A person reads every refusal, so each one says what happened, that nothing was changed, and what to do next. planTool names the tool that advice points at, so this package hard-codes no caller's vocabulary.
Types ¶
type Binding ¶
type Binding struct {
// Project scopes the token. One minted elsewhere cannot be spent here.
Project string
// Manifests are the canonical forms to apply, in apply order. Order is
// part of the agreement: the same set reordered is a different plan.
Manifests [][]byte
// ResourceVersions is the version each manifest would replace,
// positionally, and empty where it would create. A moved version means
// somebody else changed the object, so the agreed change no longer
// describes what would happen.
ResourceVersions []string
}
Binding is everything a plan assumed. All of it is hashed, so any of it moving invalidates the token.
Source Files