remoteauth

package

v1.0.0 Latest Latest Go to latest Published: Sep 19, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Details

View Source

const HashPrefix = "sha256:"

This section is empty.

func Authenticate(doc *UsersFile, principal, token string) error

func FindDefaultRemote(cfg *remoteapi.AuthConfig) (*remoteapi.RemoteConfig, bool)

func GenerateKey() (string, error)

GenerateKey returns a 32-byte random HMAC key as hex.

func GenerateToken() (string, error)

func HashToken(token string) string

func LoadAuthConfig(path string) (*remoteapi.AuthConfig, error)

func LoadKey(path string) ([]byte, error)

LoadKey reads a JWT HMAC key from a file. The file must be at least 32 bytes.

func SaveAuthConfig(path string, cfg *remoteapi.AuthConfig) error

func SaveUsers(path string, doc *UsersFile) error

func UpsertRemote(cfg *remoteapi.AuthConfig, remote remoteapi.RemoteConfig)

func UpsertUser(doc *UsersFile, user User)

func VerifyToken(token, hash string) bool

type Identity struct {
	Principal string
	Role      string
	JTI       string
}

Identity is the verified actor from a JWT. Principal always comes from sub.

type Issuer struct {
	DB  *store.DB
	Key []byte
}

Issuer mints self-issued JWTs and persists jti rows.

func (i Issuer) Issue(principal, role string, ttl time.Duration) (string, Identity, error)

Issue creates a principal (if needed), records jti, and returns a signed JWT.

type StoreVerifier struct {
	DB  *store.DB
	Key []byte
}

StoreVerifier checks signature, expiry, principal, and jti revocation against the DB.

func (v StoreVerifier) Verify(token string) (Identity, error)

type User struct {
	Principal string   `json:"principal"`
	TokenHash string   `json:"token_hash"`
	Scopes    []string `json:"scopes,omitempty"`
}

type UsersFile struct {
	SchemaVersion int    `json:"schema_version"`
	Users         []User `json:"users"`
}

func LoadUsers(path string) (*UsersFile, error)

type Verifier interface {
	Verify(token string) (Identity, error)
}

Verifier validates a bearer token. Implementations can later be swapped for OIDC.