Documentation
¶
Overview ¶
Package credentials creates and validates typed credentials.
Index ¶
- Variables
- func Bearer(headers http.Header) (string, error)
- func DeriveInvitationToken(retrySecret []byte, retryContext string) (InvitationToken, SecretHash, error)
- func DerivePublisherConnectionCredential(routeSessionToken RouteSessionToken, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
- func DeriveRouteSessionToken(retrySecret []byte, retryContext string) (RouteSessionToken, CredentialID, SecretHash, error)
- func NewAccessToken() (AccessToken, CredentialID, SecretHash, error)
- func NewInvitationToken() (InvitationToken, SecretHash, error)
- func NewPublisherConnectionCredential() (PublisherConnectionCredential, SecretHash, error)
- func NewRefreshToken() (RefreshToken, CredentialID, SecretHash, error)
- func NewRouteSessionToken() (RouteSessionToken, CredentialID, SecretHash, error)
- func ParseAccessToken(token AccessToken) (CredentialID, SecretHash, error)
- func ParseRefreshToken(token RefreshToken) (CredentialID, SecretHash, error)
- func ParseRouteSessionToken(token RouteSessionToken) (CredentialID, SecretHash, error)
- func SecretHashMatches(stored []byte, candidate SecretHash) bool
- type AccessToken
- type CredentialID
- type InvitationToken
- type LoginToken
- type LoginVerifier
- type PublisherConnectionCredential
- type RefreshToken
- type RouteSessionToken
- type SecretHash
Constants ¶
This section is empty.
Variables ¶
var ( // ErrInvalidAccessToken is returned for malformed or rejected access tokens. ErrInvalidAccessToken = errors.New("invalid access token") // ErrInvalidLoginToken is returned for malformed login tokens. ErrInvalidLoginToken = errors.New("invalid login token") // ErrInvalidRefreshToken is returned for malformed or rejected refresh tokens. ErrInvalidRefreshToken = errors.New("invalid refresh token") // ErrInvalidInvitationToken is returned for malformed or rejected invitation tokens. ErrInvalidInvitationToken = errors.New("invalid invitation token") // ErrInvalidRouteSessionToken is returned for malformed or rejected route session tokens. ErrInvalidRouteSessionToken = errors.New("invalid route session token") // ErrInvalidPublisherConnectionCredential is returned for malformed publisher connection credentials. ErrInvalidPublisherConnectionCredential = errors.New("invalid publisher connection credential") )
var ErrInvalidAuthorization = errors.New("invalid authorization header")
var ErrInvalidCredentialID = errors.New("invalid credential ID")
ErrInvalidCredentialID is returned for malformed credential lookup IDs.
Functions ¶
func Bearer ¶
Bearer extracts one opaque token from exactly one Authorization header. The scheme is case-insensitive; whitespace and comma-combined tokens are rejected. It does not validate a credential class or authenticate its holder.
func DeriveInvitationToken ¶
func DeriveInvitationToken(retrySecret []byte, retryContext string) (InvitationToken, SecretHash, error)
DeriveInvitationToken returns the same one-time invitation secret when a request is retried with the same secret and context.
func DerivePublisherConnectionCredential ¶
func DerivePublisherConnectionCredential(routeSessionToken RouteSessionToken, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
DerivePublisherConnectionCredential returns the same assignment credential for the same route session token and assignment context.
func DeriveRouteSessionToken ¶
func DeriveRouteSessionToken(retrySecret []byte, retryContext string) (RouteSessionToken, CredentialID, SecretHash, error)
DeriveRouteSessionToken returns the same route session token when a request is retried with the same secret and context.
func NewAccessToken ¶
func NewAccessToken() (AccessToken, CredentialID, SecretHash, error)
NewAccessToken creates an access token and its storage values.
func NewInvitationToken ¶
func NewInvitationToken() (InvitationToken, SecretHash, error)
NewInvitationToken creates a one-time team invitation token.
func NewPublisherConnectionCredential ¶
func NewPublisherConnectionCredential() (PublisherConnectionCredential, SecretHash, error)
NewPublisherConnectionCredential creates a credential for one connection assignment.
func NewRefreshToken ¶
func NewRefreshToken() (RefreshToken, CredentialID, SecretHash, error)
NewRefreshToken creates a control-session refresh token and its storage values.
func NewRouteSessionToken ¶
func NewRouteSessionToken() (RouteSessionToken, CredentialID, SecretHash, error)
NewRouteSessionToken creates a route session token and its storage values.
func ParseAccessToken ¶
func ParseAccessToken(token AccessToken) (CredentialID, SecretHash, error)
ParseAccessToken validates an access token and returns its storage lookup values.
func ParseRefreshToken ¶
func ParseRefreshToken(token RefreshToken) (CredentialID, SecretHash, error)
ParseRefreshToken validates a refresh token and returns its storage lookup values.
func ParseRouteSessionToken ¶
func ParseRouteSessionToken(token RouteSessionToken) (CredentialID, SecretHash, error)
ParseRouteSessionToken validates a route session token and returns its storage lookup values.
func SecretHashMatches ¶
func SecretHashMatches(stored []byte, candidate SecretHash) bool
SecretHashMatches compares a stored digest without data-dependent timing.
Types ¶
type AccessToken ¶
type AccessToken string
AccessToken authenticates an identity to the tnl server API.
func (AccessToken) String ¶
func (t AccessToken) String() string
String returns the serialized access token.
type CredentialID ¶
type CredentialID string
CredentialID is the nonsecret lookup portion of a credential.
func ParseCredentialID ¶
func ParseCredentialID(value string) (CredentialID, error)
ParseCredentialID validates a canonical nonsecret credential lookup ID.
func (CredentialID) String ¶
func (id CredentialID) String() string
String returns the nonsecret credential ID.
type InvitationToken ¶
type InvitationToken string
InvitationToken authorizes accepting one team invitation.
func (InvitationToken) String ¶
func (t InvitationToken) String() string
String returns the serialized invitation token.
type LoginToken ¶
type LoginToken string
LoginToken authenticates only to the built-in authority's token exchange.
func NewLoginToken ¶
func NewLoginToken() (LoginToken, error)
NewLoginToken creates a local login token.
func (LoginToken) String ¶
func (t LoginToken) String() string
String returns the serialized login token.
type LoginVerifier ¶
type LoginVerifier struct {
// contains filtered or unexported fields
}
LoginVerifier is the verification material for one login token.
func ParseLoginToken ¶
func ParseLoginToken(token LoginToken) (LoginVerifier, error)
ParseLoginToken validates a login token and returns its verifier.
func (LoginVerifier) Matches ¶
func (v LoginVerifier) Matches(token LoginToken) bool
Matches reports whether token matches this verifier.
func (LoginVerifier) SourceRevision ¶
func (v LoginVerifier) SourceRevision() int64
SourceRevision identifies the login-token source used to issue sessions.
type PublisherConnectionCredential ¶
type PublisherConnectionCredential string
PublisherConnectionCredential authorizes one publisher connection assignment claim.
func (PublisherConnectionCredential) String ¶
func (t PublisherConnectionCredential) String() string
String returns the serialized publisher connection credential.
type RefreshToken ¶
type RefreshToken string
RefreshToken rotates one control session's access and refresh credentials.
func (RefreshToken) String ¶
func (t RefreshToken) String() string
String returns the serialized refresh token.
type RouteSessionToken ¶
type RouteSessionToken string
RouteSessionToken authorizes operations on one route session.
func (RouteSessionToken) String ¶
func (t RouteSessionToken) String() string
String returns the serialized route session token.
type SecretHash ¶
SecretHash is the stored digest of a random token secret.
func ParseInvitationToken ¶
func ParseInvitationToken(token InvitationToken) (SecretHash, error)
ParseInvitationToken validates an invitation token and returns its stored digest.
func ParsePublisherConnectionCredential ¶
func ParsePublisherConnectionCredential(credential PublisherConnectionCredential) (SecretHash, error)
ParsePublisherConnectionCredential validates a publisher connection credential and returns its stored hash.
Source Files