deviceauth

package

v1.20.2 Latest Latest Go to latest Published: Sep 4, 2026 License: GPL-3.0 Imports: 13 Imported by: 0

Details

Package deviceauth authenticates the optional device transport envelope. A shared transport key does not attest a physical device or an official app.

View Source

const (
	MaxAge     = 5 * time.Minute
	FutureSkew = 30 * time.Second
)

View Source

var ErrInvalidEnvelope = errors.New("invalid device envelope")

func Decrypt(cipherText string, keyStr string, ivStr string) (string, error)

Decrypt 传入 []byte 类型的加密数据，返回解密后的 []byte 明文数据

func Encrypt(plainText []byte, keyStr string) (string, string, error)

Encrypt 传入 []byte，返回 []byte 类型的加密数据

func Sign(secret, method, path, scope, data, timestamp string) string

Sign binds the ciphertext to its HTTP operation and envelope location. scope is one of "query", "body", or "response".

type Envelope struct {
	Data string `json:"data"`
	Time string `json:"time"`
	Sign string `json:"sign"`
}

func (e Envelope) Consume(ctx context.Context, store ReplayStore, secret string) error

Consume reserves the nonce across all server instances. Redis errors fail closed; the TTL spans the entire acceptance window including clock skew.

func (e Envelope) Open(secret, method, path, scope string, now time.Time) (string, error)

type ReplayStore interface {
	SetNX(context.Context, string, interface{}, time.Duration) *redis.BoolCmd
}