Documentation
¶
Overview ¶
Package credentials creates and validates typed credentials.
Index ¶
- Variables
- func Bearer(headers http.Header) (string, error)
- func DeriveAssignmentCredential(seed AssignmentSeed, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
- func DeriveInvitationToken(retrySecret []byte, retryContext string) (InvitationToken, SecretHash, error)
- func DerivePublishRunToken(retrySecret []byte, retryContext string) (PublishRunToken, CredentialID, SecretHash, error)
- func DerivePublisherConnectionCredential(publishRunToken PublishRunToken, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
- func NewAccessToken() (AccessToken, CredentialID, SecretHash, error)
- func NewInvitationToken() (InvitationToken, SecretHash, error)
- func NewPublishRunToken() (PublishRunToken, CredentialID, SecretHash, error)
- func NewPublisherConnectionCredential() (PublisherConnectionCredential, SecretHash, error)
- func NewRefreshToken() (RefreshToken, CredentialID, SecretHash, error)
- func NewServiceRunToken() (ServiceRunToken, SecretHash, error)
- func ParseAccessToken(token AccessToken) (CredentialID, SecretHash, error)
- func ParseAssignmentSeed(seed AssignmentSeed) error
- func ParsePublishRunToken(token PublishRunToken) (CredentialID, SecretHash, error)
- func ParseRefreshToken(token RefreshToken) (CredentialID, SecretHash, error)
- func SecretHashMatches(stored []byte, candidate SecretHash) bool
- type AccessToken
- type AssignmentSeed
- type CredentialID
- type InvitationToken
- type PublishRunToken
- type PublisherConnectionCredential
- type RefreshToken
- type SecretHash
- type ServiceRunToken
Constants ¶
This section is empty.
Variables ¶
var ( // ErrInvalidAccessToken is returned for malformed or rejected access tokens. ErrInvalidAccessToken = errors.New("invalid access token") // ErrInvalidRefreshToken is returned for malformed or rejected refresh tokens. ErrInvalidRefreshToken = errors.New("invalid refresh token") // ErrInvalidInvitationToken is returned for malformed or rejected invitation tokens. ErrInvalidInvitationToken = errors.New("invalid invitation token") // ErrInvalidPublishRunToken is returned for malformed or rejected publish run tokens. ErrInvalidPublishRunToken = errors.New("invalid publish run token") // ErrInvalidPublisherConnectionCredential is returned for malformed publisher connection credentials. ErrInvalidPublisherConnectionCredential = errors.New("invalid publisher connection credential") )
var ErrInvalidAssignmentSeed = errors.New("invalid assignment seed")
var ErrInvalidAuthorization = errors.New("invalid authorization header")
var ErrInvalidCredentialID = errors.New("invalid credential ID")
ErrInvalidCredentialID is returned for malformed credential lookup IDs.
var ErrInvalidServiceRunToken = errors.New("invalid managed run token")
Functions ¶
func Bearer ¶
Bearer extracts one opaque token from exactly one Authorization header. the scheme is case-insensitive; whitespace and comma-combined tokens are rejected. it does not validate a credential class or authenticate its holder.
func DeriveAssignmentCredential ¶
func DeriveAssignmentCredential(seed AssignmentSeed, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
func DeriveInvitationToken ¶
func DeriveInvitationToken(retrySecret []byte, retryContext string) (InvitationToken, SecretHash, error)
DeriveInvitationToken returns the same one-time invitation secret when a request is retried with the same secret and context.
func DerivePublishRunToken ¶
func DerivePublishRunToken(retrySecret []byte, retryContext string) (PublishRunToken, CredentialID, SecretHash, error)
DerivePublishRunToken returns the same publish run token when a request is retried with the same secret and context.
func DerivePublisherConnectionCredential ¶
func DerivePublisherConnectionCredential(publishRunToken PublishRunToken, assignmentContext string) (PublisherConnectionCredential, SecretHash, error)
DerivePublisherConnectionCredential returns the same assignment credential for the same publish run token and assignment context.
func NewAccessToken ¶
func NewAccessToken() (AccessToken, CredentialID, SecretHash, error)
NewAccessToken creates an access token and its storage values.
func NewInvitationToken ¶
func NewInvitationToken() (InvitationToken, SecretHash, error)
NewInvitationToken creates a one-time team invitation token.
func NewPublishRunToken ¶
func NewPublishRunToken() (PublishRunToken, CredentialID, SecretHash, error)
NewPublishRunToken creates a publish run token and its storage values.
func NewPublisherConnectionCredential ¶
func NewPublisherConnectionCredential() (PublisherConnectionCredential, SecretHash, error)
NewPublisherConnectionCredential creates a credential for one connection assignment.
func NewRefreshToken ¶
func NewRefreshToken() (RefreshToken, CredentialID, SecretHash, error)
NewRefreshToken creates a control-session refresh token and its storage values.
func NewServiceRunToken ¶
func NewServiceRunToken() (ServiceRunToken, SecretHash, error)
func ParseAccessToken ¶
func ParseAccessToken(token AccessToken) (CredentialID, SecretHash, error)
ParseAccessToken validates an access token and returns its storage lookup values.
func ParseAssignmentSeed ¶
func ParseAssignmentSeed(seed AssignmentSeed) error
func ParsePublishRunToken ¶
func ParsePublishRunToken(token PublishRunToken) (CredentialID, SecretHash, error)
ParsePublishRunToken validates a publish run token and returns its storage lookup values.
func ParseRefreshToken ¶
func ParseRefreshToken(token RefreshToken) (CredentialID, SecretHash, error)
ParseRefreshToken validates a refresh token and returns its storage lookup values.
func SecretHashMatches ¶
func SecretHashMatches(stored []byte, candidate SecretHash) bool
SecretHashMatches compares a stored digest without data-dependent timing.
Types ¶
type AccessToken ¶
type AccessToken string
AccessToken authenticates an identity to the tnl server API.
func (AccessToken) String ¶
func (t AccessToken) String() string
String returns the serialized access token.
type AssignmentSeed ¶
type AssignmentSeed string
AssignmentSeed derives managed publisher connection credentials. its stored encoding is unchanged, but it never authorizes public URL run operations.
func NewAssignmentSeed ¶
func NewAssignmentSeed() (AssignmentSeed, error)
func (AssignmentSeed) String ¶
func (s AssignmentSeed) String() string
type CredentialID ¶
type CredentialID string
CredentialID is the nonsecret lookup portion of a credential.
func ParseCredentialID ¶
func ParseCredentialID(value string) (CredentialID, error)
ParseCredentialID validates a canonical nonsecret credential lookup ID.
func (CredentialID) String ¶
func (id CredentialID) String() string
String returns the nonsecret credential ID.
type InvitationToken ¶
type InvitationToken string
InvitationToken authorizes accepting one team invitation.
func (InvitationToken) String ¶
func (t InvitationToken) String() string
String returns the serialized invitation token.
type PublishRunToken ¶
type PublishRunToken string
PublishRunToken authorizes operations on one publish run.
func (PublishRunToken) String ¶
func (t PublishRunToken) String() string
String returns the serialized publish run token.
type PublisherConnectionCredential ¶
type PublisherConnectionCredential string
PublisherConnectionCredential authorizes one publisher connection assignment claim.
func (PublisherConnectionCredential) String ¶
func (t PublisherConnectionCredential) String() string
String returns the serialized publisher connection credential.
type RefreshToken ¶
type RefreshToken string
RefreshToken rotates one control session's access and refresh credentials.
func (RefreshToken) String ¶
func (t RefreshToken) String() string
String returns the serialized refresh token.
type SecretHash ¶
SecretHash is the stored digest of a random token secret.
func ParseInvitationToken ¶
func ParseInvitationToken(token InvitationToken) (SecretHash, error)
ParseInvitationToken validates an invitation token and returns its stored digest.
func ParsePublisherConnectionCredential ¶
func ParsePublisherConnectionCredential(credential PublisherConnectionCredential) (SecretHash, error)
ParsePublisherConnectionCredential validates a publisher connection credential and returns its stored hash.
func ParseServiceRunToken ¶
func ParseServiceRunToken(token ServiceRunToken) (SecretHash, error)
ParseServiceRunToken accepts only the existing canonical, unprefixed secret.
type ServiceRunToken ¶
type ServiceRunToken string
ServiceRunToken authorizes one service run, independently of public URL publish run tokens and publisher connection derivation seeds.
func (ServiceRunToken) String ¶
func (t ServiceRunToken) String() string
Source Files