crypt

func AgentRegistrationKey ¶ added in v0.33.0

func AgentRegistrationKey(encryptionKey, spaceId string) string

AgentRegistrationKey derives the per-space secret an agent must prove possession of to register. Injected into the container at create time; shown alongside the space UUID for manual agents.

func AgentRegistrationProof ¶ added in v0.33.0

func AgentRegistrationProof(registrationKey, spaceId, agentNonce, serverNonce string) string

AgentRegistrationProof computes the registration proof: an HMAC over the space id and both handshake nonces, so a captured proof can't be replayed (each side contributes fresh randomness).

func AgentTLSCert ¶ added in v0.33.0

func AgentTLSCert(encryptionKey string) (tls.Certificate, error)

AgentTLSCert deterministically builds the zone's self-signed certificate for the agent listener. Held in memory only: regenerating at every boot yields the same certificate, so there is nothing to persist.

func AgentTLSCertFingerprint ¶ added in v0.33.0

func AgentTLSCertFingerprint(encryptionKey string) (string, error)

AgentTLSCertFingerprint returns the hex SHA-256 of the certificate's public key (SPKI) — the value pinned by agents. Pinning the key rather than the certificate bytes keeps the pin stable across minor encoding differences while still authenticating the server.

func CreateKey ¶

func CreateKey() string

func Decrypt ¶

func Decrypt(key string, text string) string

func DecryptB64 ¶

func DecryptB64(key string, text string) string

func DecryptB64Safe ¶ added in v0.25.0

func DecryptB64Safe(key string, text string) string

func Encrypt ¶

func Encrypt(key string, text string) string

func EncryptB64 ¶

func EncryptB64(key string, text string) string

func EncryptB64Safe ¶ added in v0.25.0

func EncryptB64Safe(key string, text string) string

func ExtractSpaceIdFromToken ¶ added in v0.23.0

func ExtractSpaceIdFromToken(token string) string

ExtractSpaceIdFromToken extracts the space ID from an agent token without validation. Returns empty string if token format is invalid.

func GenerateAPIKey ¶

func GenerateAPIKey() (string, error)

func GenerateAgentToken ¶ added in v0.23.0

func GenerateAgentToken(spaceId, userId, zone, encryptionKey string) (string, error)

GenerateAgentToken creates a deterministic authentication token for an agent using HMAC-SHA256. The token format is: agt_<spaceId>_<signature>

Parameters:

• spaceId: The ID of the space the agent is running in
• userId: The ID of the user who owns the space
• zone: The zone/region name where the server is located
• encryptionKey: The server's encryption key used as the HMAC secret

Returns a token in the format: "agt_<spaceId>_<signature>"

func IsAgentToken ¶ added in v0.23.0

func IsAgentToken(token string) bool

IsAgentToken checks if a token is an agent token (vs a regular API token)

func NewAgentNonce ¶ added in v0.33.0

func NewAgentNonce() (string, error)

NewAgentNonce returns fresh randomness for one side of the registration handshake.

func ValidateAgentToken ¶ added in v0.23.0

func ValidateAgentToken(token, spaceId, userId, zone, encryptionKey string) bool

ValidateAgentToken validates an agent token and extracts the space ID. The caller must look up the space to get userId and zone for verification.

Parameters:

• token: The agent token to validate
• spaceId: The space ID from the token (for DB lookup)
• userId: The user ID from the space record
• zone: The zone from server config
• encryptionKey: The server's encryption key used to verify the signature

Returns: true if the signature is valid

func VerifyAgentRegistrationProof ¶ added in v0.33.0

func VerifyAgentRegistrationProof(expected, got string) bool

VerifyAgentRegistrationProof reports whether a proof from an agent matches the expected value, in constant time.