token

Overview ¶

Package token mints and validates Atlas's opaque share tokens.

A share token is the whole authorization for an unauthenticated URL: a public process start link (ADR-0029) or a shared documentation version (ADR-0143) is readable by whoever holds the token and nobody else. Two properties follow, and they are why this is a package rather than a helper beside one of its callers:

• It must be unguessable, so it is 32 bytes of CSPRNG output. There is nothing to brute-force and nothing to derive it from.
• It must be *shaped*, because these tokens name their own files on disk. A token that is not bare hex is refused before it reaches the filesystem, which is what stops a request-supplied one from addressing a path (see api/sidecar, whose stores apply the same predicate to keys on the way in).

Both callers use the same two functions, so a token minted by one is valid by the other's rule — the alternative, a second copy of the hex check, is how the two definitions drift apart and one of them stops refusing something.