Documentation
¶
Overview ¶
Package authhandoff provides a small, in-process, single-use token→authority registry. It exists so a TRUSTED in-process producer — a background sub-agent's completion, which needs to wake a fresh parent turn — can hand the parent's OBO authority to that turn WITHOUT carrying any credential in the (unauthenticated) inbound message. The message carries only an opaque token; the runtime resolves it here.
Security: tokens are unguessable (crypto/rand) and single-use (consumed on Resolve), and the store only ever holds authorities the harness itself minted for in-process handoffs. So even a forged inbound cannot escalate — an unknown token is a miss (zero authority), and a lucky hit would only ever return an authority the harness had already authorized. This mirrors turncancel.Canceller (a dependency-free leaf keyed by an id) and avoids trusting OBO read off the message payload, which the gateway — not the harness — is the sole authority for.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func StampMessage ¶ added in v0.0.2
func StampMessage(message protocol.ChatMessage, token string) protocol.ChatMessage
StampMessage carries an opaque handoff token on an internally-created inbound message. The token is not a credential; ResolveMessage consumes it from the private Store. An empty token is a no-op.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store maps single-use tokens to a snapshot of a parent turn's OBO authority.
func (*Store) Put ¶
func (s *Store) Put(auth tools.MemoryAuthority) string
Put stores auth under a fresh random token and returns the token. A nil Store, or a zero authority (nothing to hand off, e.g. local dev with no OBO), returns "" — the caller then omits the token from the inbound entirely.
func (*Store) Resolve ¶
func (s *Store) Resolve(token string) (auth tools.MemoryAuthority, ok bool)
Resolve consumes the token and returns the stored authority. ok is false when the token is absent (unknown, forged, or already consumed). A nil Store or an empty token is a miss. Single-use: a resolved token is deleted, so a re-driven turn falls through to the caller's default derivation rather than replaying a stale grant.
func (*Store) ResolveMessage ¶ added in v0.0.2
func (s *Store) ResolveMessage(message protocol.ChatMessage) (tools.MemoryAuthority, bool)
ResolveMessage consumes the authority-handoff token carried by message and returns the authority previously stored for it. The wire metadata contains only an opaque, single-use lookup key; it never contains the grant itself. Unknown, malformed, empty, and already-consumed tokens are ordinary misses.
Source Files