deviceauth

package

v1.21.2 Latest Latest Go to latest Published: Oct 27, 2026 License: GPL-3.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/perfect-panel/server

Links

Open Source Insights

Documentation ¶

Overview ¶

Package deviceauth authenticates the optional device transport envelope. A shared transport key does not attest a physical device or an official app.

Index ¶

Constants
Variables
func Decrypt(cipherText string, keyStr string, ivStr string) (string, error)
func Encrypt(plainText []byte, keyStr string) (string, string, error)
func Sign(secret, method, path, scope, data, timestamp string) string
type Envelope
- func (e Envelope) Consume(ctx context.Context, store ReplayStore, secret string) error
- func (e Envelope) Open(secret, method, path, scope string, now time.Time) (string, error)
type ReplayStore

Constants ¶

View Source

const (
	MaxAge     = 5 * time.Minute
	FutureSkew = 30 * time.Second
)

Variables ¶

View Source

var ErrInvalidEnvelope = errors.New("invalid device envelope")

Functions ¶

func Decrypt ¶

func Decrypt(cipherText string, keyStr string, ivStr string) (string, error)

Decrypt reverses Encrypt: cipherText is the base64 ciphertext and ivStr the nonce Encrypt returned with it.

func Encrypt ¶

func Encrypt(plainText []byte, keyStr string) (string, string, error)

Encrypt encrypts plainText for the device transport with AES-256-CBC and PKCS#7 padding. It returns the base64 ciphertext and the nonce, the current time in hexadecimal nanoseconds. The IV is derived from the nonce and the key instead of being sent, so the receiver needs the nonce to decrypt; the envelope carries it as its time.

func Sign ¶

func Sign(secret, method, path, scope, data, timestamp string) string

Sign binds the ciphertext to its HTTP operation and envelope location. scope is one of "query", "body", or "response".

Types ¶

type Envelope ¶

type Envelope struct {
	Data string `json:"data"`
	Time string `json:"time"`
	Sign string `json:"sign"`
}

func (Envelope) Consume ¶

func (e Envelope) Consume(ctx context.Context, store ReplayStore, secret string) error

Consume reserves the nonce across all server instances. Redis errors fail closed; the TTL spans the entire acceptance window including clock skew.

func (Envelope) Open ¶

func (e Envelope) Open(secret, method, path, scope string, now time.Time) (string, error)

type ReplayStore ¶

type ReplayStore interface {
	SetNX(context.Context, string, any, time.Duration) *redis.BoolCmd
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL