keys

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 15, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Overview

Package keys derives purpose-specific keys from server.secret so that a session key can never be used to forge an API token or an upload URL.

Index

Constants

View Source
const (
	Session    = "backyard/session/v1"
	OAuthState = "backyard/oauth-state/v1"
	APIToken   = "backyard/api-token/v1"
	Deploy     = "backyard/deploy/v1"
	Upload     = "backyard/upload/v1"
	Anon       = "backyard/anon/v1"
	// CLIConfirm signs the confirmation form of a cross-site CLI login
	// (/__backyard/auth/cli). The value never leaves one deployment, so the
	// Cloudflare edition need not derive it identically.
	CLIConfirm = "backyard/cli-confirm/v1"
	// The remote MCP connector's authorization server (SPEC §8.4). These
	// values reference per-deployment grant state, so they never
	// interoperate between deployments or editions.
	MCPClient  = "backyard/mcp-client/v1"  // stateless DCR client_ids
	MCPConsent = "backyard/mcp-consent/v1" // consent page CSRF tokens
	MCPCode    = "backyard/mcp-code/v1"    // authorization codes
	MCPRefresh = "backyard/mcp-refresh/v1" // refresh tokens
	MCPAccess  = "backyard/mcp-access/v1"  // access tokens
)

Labels for the derived keys. Every component must use its own label.

Variables

View Source
var ErrBadSignature = errors.New("keys: bad signature")

ErrBadSignature is returned by Verify for malformed or forged values.

Functions

func Derive

func Derive(secret, label string) []byte

Derive returns a 32-byte key for label derived from secret with HKDF-SHA256.

func Sign

func Sign(key, payload []byte) string

Sign returns base64url(payload) + "." + base64url(HMAC-SHA256(key, payload)).

func Verify

func Verify(key []byte, signed string) ([]byte, error)

Verify checks a value produced by Sign and returns the payload.

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL