peerticket

type Claims struct {
	Issuer    string    // "cloudbox" — informational; not gated on
	Audience  string    // "outpost:<peer agent_name>" — must equal receiver
	Subject   string    // OS user the peer should impersonate
	Role      string    // "user" or "admin" — feeds the X-Periscope-Role-equivalent decision
	Scope     []string  // capability strings the ticket grants ("ssh", "sftp", "backup", …)
	ExpiresAt time.Time // hard cutoff (cloudbox issues 60s tickets)
	NotBefore time.Time // optional; honored if set
	IssuedAt  time.Time // informational; not gated on
	JTI       string    // unique-per-issuance; replay-protected by Verifier
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifyOptions struct {
	// Pubkey is the cloudbox ed25519 verification key, loaded from
	// FileConfig.CloudboxTicketPubkey via LoadPubkey.
	Pubkey ed25519.PublicKey

	// ExpectedAudience must match the ticket's `aud` claim exactly.
	// The receiver passes its own identity ("outpost:" + AgentName)
	// — never a value taken from the request. Prevents an attacker
	// who captured a ticket scoped to peer-A from replaying it to
	// peer-B.
	ExpectedAudience string

	// RequiredScope is the capability the receiver is gating right
	// now ("ssh" for the WS-SSH handler, "sftp" or "backup" for
	// future per-route gates). The ticket's `scope` claim MUST
	// contain this value.
	RequiredScope string

	// ClockSkew widens both the `nbf` and `exp` windows by this
	// amount to absorb modest clock drift between cloudbox and the
	// receiver. Default 30s when zero.
	ClockSkew time.Duration

	// Now overrides time.Now() for tests. Zero-valued = real clock.
	Now time.Time
}