auth

package

v0.3.1 Latest Latest Go to latest Published: Jul 24, 2026 License: MIT Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/newtosh/tuile

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func HasScope(claims Claims, want Scope) bool
type BootstrapSecret
- func NewBootstrapSecret() (BootstrapSecret, error)
- func (b BootstrapSecret) ConstantTimeEqual(other string) bool
type Claims
type Scope
type Store
- func NewStore() *Store

Constants ¶

This section is empty.

Variables ¶

View Source

var AgentScopes = []Scope{ScopeAgentRead, ScopeAgentWrite}

AgentScopes are minted for automated clients.

View Source

var ErrForbidden = errors.New("forbidden")

ErrForbidden is returned when credentials lack required scope.

View Source

var ErrUnauthorized = errors.New("unauthorized")

ErrUnauthorized is returned for invalid or expired credentials.

View Source

var HumanScopes = []Scope{ScopeHumanView, ScopeHumanControl}

HumanScopes include observe and takeover.

View Source

var SessionScopes = []Scope{
	ScopeAgentRead, ScopeAgentWrite, ScopeHumanView, ScopeHumanControl,
}

SessionScopes grants full access to a session (returned at create time).

Functions ¶

func HasScope ¶

func HasScope(claims Claims, want Scope) bool

HasScope reports whether claims include scope.

Types ¶

type BootstrapSecret ¶

type BootstrapSecret string

BootstrapSecret is a server-wide secret for session creation.

func NewBootstrapSecret ¶

func NewBootstrapSecret() (BootstrapSecret, error)

NewBootstrapSecret generates a random bootstrap secret.

func (BootstrapSecret) ConstantTimeEqual ¶

func (b BootstrapSecret) ConstantTimeEqual(other string) bool

ConstantTimeEqual compares bootstrap secrets safely.

type Claims ¶

type Claims struct {
	SessionID string
	Scopes    []Scope
	ExpiresAt time.Time
}

Claims binds a bearer token to a session.

type Scope ¶

type Scope string

Scope names credential capabilities (KTD1).

const (
	ScopeAgentRead    Scope = "agent:read"
	ScopeAgentWrite   Scope = "agent:write"
	ScopeHumanView    Scope = "human:view"
	ScopeHumanControl Scope = "human:control"
)

type Store ¶

type Store struct {
	// contains filtered or unexported fields
}

Store holds active bearer tokens in memory.

func NewStore ¶

func NewStore() *Store

NewStore creates an empty token store.

func (*Store) Mint ¶

func (s *Store) Mint(sessionID string, scopes []Scope, ttl time.Duration) (string, error)

Mint issues a new bearer token for sessionID.

func (*Store) Revoke ¶

func (s *Store) Revoke(token string)

Revoke removes a single token.

func (*Store) RevokeSession ¶

func (s *Store) RevokeSession(sessionID string)

RevokeSession removes all tokens for a session.

func (*Store) Validate ¶

func (s *Store) Validate(token string) (Claims, error)

Validate checks a bearer token and returns claims.

Source Files ¶

View all Source files

token.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL