Documentation
¶
Index ¶
- func ClaimsFromBearerToken(publicKey *rsa.PublicKey, bearerToken string) (any, error)
- func EncodeDeviceClaims(claims authorizer.DeviceClaims, issuer string, privateKey *rsa.PrivateKey) (string, error)
- func EncodeEnrollmentDecisionClaims(claims EnrollmentDecisionClaims, ttl time.Duration, issuer string, ...) (string, error)
- func EncodeUserClaims(claims authorizer.UserClaims, issuer string, privateKey *rsa.PrivateKey) (string, error)
- type EnrollmentDecisionClaims
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClaimsFromBearerToken ¶ added in v0.17.0
ClaimsFromBearerToken decodes the provided bearer token into either github.com/shellhub-io/shellhub/pkg/api/authorizer.UserClaims or github.com/shellhub-io/shellhub/pkg/api/authorizer.DeviceClaims. It returns the decoded claims and an error if any.
func EncodeDeviceClaims ¶ added in v0.17.0
func EncodeDeviceClaims(claims authorizer.DeviceClaims, issuer string, privateKey *rsa.PrivateKey) (string, error)
EncodeDeviceClaims encodes the provided device claims into a signed JWT token. It returns the encoded token and an error, if any.
issuer names the instance signing the token and is written to the iss claim verbatim.
func EncodeEnrollmentDecisionClaims ¶
func EncodeEnrollmentDecisionClaims(claims EnrollmentDecisionClaims, ttl time.Duration, issuer string, privateKey *rsa.PrivateKey) (string, error)
EncodeEnrollmentDecisionClaims signs a deferred enrollment-decision callback token, valid for ttl.
issuer names the instance signing the token and is written to the iss claim verbatim.
func EncodeUserClaims ¶ added in v0.17.0
func EncodeUserClaims(claims authorizer.UserClaims, issuer string, privateKey *rsa.PrivateKey) (string, error)
EncodeUserClaims encodes the provided user claims into a signed JWT token. It returns the encoded token and an error, if any.
The token is valid for 72 hours; tenantID is optional. issuer names the instance signing the token and is written to the iss claim verbatim.
Types ¶
type EnrollmentDecisionClaims ¶
type EnrollmentDecisionClaims struct {
DeviceUID string `json:"device_uid"`
TenantID string `json:"tenant_id"`
ProvisioningKeyID string `json:"provisioning_key_id"`
}
EnrollmentDecisionClaims scopes a deferred-decision callback token to exactly one enrolling device, so a webhook integrator can accept/reject it later without any standing credential.
func DecodeEnrollmentDecisionClaims ¶
func DecodeEnrollmentDecisionClaims(publicKey *rsa.PublicKey, raw string) (*EnrollmentDecisionClaims, string, error)
DecodeEnrollmentDecisionClaims verifies the signature and expiry of a callback token and returns its claims together with the token's unique id (jti), which the caller records to keep the token single-use. It errors on an invalid/expired token or one that is not an enrollment-decision token.
Source Files