Documentation
¶
Index ¶
- Constants
- func CompressZCAP(zcap *Capability) (string, error)
- func NewHTTPSigAuthHandler(config *HTTPSigAuthConfig, expect *InvocationExpectations, ...) http.HandlerFunc
- type AriesDIDKeySecrets
- type AriesDIDKeySignatureHashAlgorithm
- type Capability
- type CapabilityInvocation
- type CapabilityOption
- func WithAllowedActions(actions ...string) CapabilityOption
- func WithCapabilityChain(chain ...interface{}) CapabilityOption
- func WithCaveats(caveats ...Caveat) CapabilityOption
- func WithChallenge(c string) CapabilityOption
- func WithController(c string) CapabilityOption
- func WithDelegator(d string) CapabilityOption
- func WithDomain(d string) CapabilityOption
- func WithID(id string) CapabilityOption
- func WithInvocationTarget(targetID, targetType string) CapabilityOption
- func WithInvoker(i string) CapabilityOption
- func WithParent(p string) CapabilityOption
- type CapabilityOptions
- type CapabilityResolver
- type Caveat
- type DIDKeyResolver
- type HTTPSigAuthConfig
- type InvocationExpectations
- type InvocationTarget
- type KeyResolver
- type Proof
- type Signer
- type SimpleCapabilityResolver
- type SimpleKeyResolver
- type VDRResolver
- type VerificationMethod
- type VerificationOption
- type VerificationOptions
- type Verifier
Constants ¶
const ( // SecurityContextV2 is the JSON-LD context used in ZCAP-LD documents. SecurityContextV2 = "https://w3id.org/security/v2" // ProofPurpose is the proofPurpose set on proofs in ZCAP-LD documents. ProofPurpose = "capabilityDelegation" )
const (
// CapabilityInvocationHTTPHeader is the HTTP header expected on zcap'ed HTTP requests.
CapabilityInvocationHTTPHeader = "capability-invocation"
)
const (
CaveatTypeExpiry = "expiry"
)
Caveat types.
Variables ¶
This section is empty.
Functions ¶
func CompressZCAP ¶ added in v0.1.6
func CompressZCAP(zcap *Capability) (string, error)
CompressZCAP compresses capability into base64 encoded string.
func NewHTTPSigAuthHandler ¶
func NewHTTPSigAuthHandler( config *HTTPSigAuthConfig, expect *InvocationExpectations, next http.HandlerFunc) http.HandlerFunc
NewHTTPSigAuthHandler authenticates and authorizes a request before forwarding to 'next'. Authentication scheme: https://tools.ietf.org/html/draft-ietf-httpbis-message-signatures-00. Authorization scheme: https://w3c-ccg.github.io/zcap-ld/.
Types ¶
type AriesDIDKeySecrets ¶
type AriesDIDKeySecrets struct{}
AriesDIDKeySecrets is a secrets storage that can return did:key httpsignatures.Secrets. Based on workaround suggested by library authors here: https://github.com/igor-pavlenko/httpsignatures-go/issues/5.
type AriesDIDKeySignatureHashAlgorithm ¶
type AriesDIDKeySignatureHashAlgorithm struct {
Crypto crypto.Crypto
KMS kms.KeyManager
Resolver VDRResolver
}
AriesDIDKeySignatureHashAlgorithm is a custom httpsignatures.SignatureHashAlgorithm composed of the aries framework's KMS and Crypto apis, and designed to work with did:key. Based on workaround suggested by library authors here: https://github.com/igor-pavlenko/httpsignatures-go/issues/5.
func (*AriesDIDKeySignatureHashAlgorithm) Algorithm ¶
func (a *AriesDIDKeySignatureHashAlgorithm) Algorithm() string
Algorithm returns this algorithm's name.
type Capability ¶
type Capability struct {
Context string `json:"@context"`
ID string `json:"id"`
Invoker string `json:"invoker,omitempty"`
Controller string `json:"controller,omitempty"`
Delegator string `json:"delegator,omitempty"`
Parent string `json:"parentCapability,omitempty"`
AllowedAction []string `json:"allowedAction,omitempty"`
InvocationTarget InvocationTarget `json:"invocationTarget"`
Caveats []Caveat `json:"caveats"`
Proof []verifiable.Proof `json:"proof,omitempty"`
}
Capability is a ZCAP.
func DecompressZCAP ¶ added in v0.1.6
func DecompressZCAP(value string) (zcap *Capability, err error)
DecompressZCAP uncompresses base64 encoded string into capability.
func NewCapability ¶
func NewCapability(signer *Signer, options ...CapabilityOption) (*Capability, error)
NewCapability constructs a new, signed Capability with the options provided.
func ParseCapability ¶
func ParseCapability(raw []byte) (*Capability, error)
ParseCapability parses a Capability.
type CapabilityInvocation ¶
type CapabilityInvocation struct {
ExpectedTarget string
ExpectedAction string
ExpectedRootCapability string
VerificationMethod *VerificationMethod // loaded from the http sig's keyId
}
CapabilityInvocation describes the parameters for invocation of a capability.
type CapabilityOption ¶
type CapabilityOption func(options *CapabilityOptions)
CapabilityOption configures CapabilityOptions.
func WithAllowedActions ¶
func WithAllowedActions(actions ...string) CapabilityOption
WithAllowedActions sets the actions allowed by the Capability.
func WithCapabilityChain ¶
func WithCapabilityChain(chain ...interface{}) CapabilityOption
WithCapabilityChain specifies the capabilityChain on the proof for the Capability.
func WithCaveats ¶ added in v0.1.6
func WithCaveats(caveats ...Caveat) CapabilityOption
WithCaveats sets the caveats allowed by the Capability.
func WithChallenge ¶
func WithChallenge(c string) CapabilityOption
WithChallenge sets the challenge to include in the proof.
func WithController ¶
func WithController(c string) CapabilityOption
WithController identifies the controller of the Capability.
func WithDelegator ¶
func WithDelegator(d string) CapabilityOption
WithDelegator identifies the delegator of the Capability.
func WithDomain ¶
func WithDomain(d string) CapabilityOption
WithDomain sets the domain to include in the proof.
func WithID ¶
func WithID(id string) CapabilityOption
WithID overrides the default ID (urn:uuid:<uuid value>) used.
func WithInvocationTarget ¶
func WithInvocationTarget(targetID, targetType string) CapabilityOption
WithInvocationTarget sets the invocation target on the Capability.
func WithInvoker ¶
func WithInvoker(i string) CapabilityOption
WithInvoker identifies the invoker of the Capability.
func WithParent ¶
func WithParent(p string) CapabilityOption
WithParent identifies the parent Capability.
type CapabilityOptions ¶
type CapabilityOptions struct {
ID string
Parent string
Invoker string
Controller string
Delegator string
AllowedAction []string
InvocationTarget InvocationTarget
Challenge string
Domain string
CapabilityChain []interface{}
Caveats []Caveat
}
CapabilityOptions configures capabilities.
type CapabilityResolver ¶
type CapabilityResolver interface {
Resolve(uri string) (*Capability, error)
}
CapabilityResolver resolves capabilities.
type Caveat ¶ added in v0.1.6
Caveat is a restriction on how capability may be used.
TODO need to generalize this mechanism to support different caveat types.
type DIDKeyResolver ¶
type DIDKeyResolver struct {
VDR VDRResolver
}
DIDKeyResolver resolves verification keys from did:key URLs: https://w3c-ccg.github.io/did-method-key/.
func NewDIDKeyResolver ¶ added in v0.1.6
func NewDIDKeyResolver(v VDRResolver) *DIDKeyResolver
NewDIDKeyResolver creates new DID resolver.
type HTTPSigAuthConfig ¶
type HTTPSigAuthConfig struct {
CapabilityResolver CapabilityResolver
KeyResolver KeyResolver
VDRResolver VDRResolver
VerifierOptions []VerificationOption
Secrets httpsig.Secrets
ErrConsumer func(error)
KMS kms.KeyManager
Crypto crypto.Crypto
}
HTTPSigAuthConfig configures the HTTP auth handler.
type InvocationExpectations ¶
InvocationExpectations are set by the application's context as parameters to expect for any given invocation.
type InvocationTarget ¶
InvocationTarget is the target on which the capability applies.
type KeyResolver ¶
KeyResolver resolves verification keys.
type Proof ¶
type Proof struct {
Capability *Capability
CapabilityAction string
VerificationMethod string
}
Proof describes the capability, the action, and the verification method of an invocation.
type Signer ¶
type Signer struct {
ariessigner.SignatureSuite
SuiteType string
VerificationMethod string
ProcessorOpts []jsonld.ProcessorOpts
}
Signer signs the Capability.
type SimpleCapabilityResolver ¶
type SimpleCapabilityResolver map[string]*Capability
SimpleCapabilityResolver enables in-memory capability resolvers based on maps.
func (SimpleCapabilityResolver) Resolve ¶
func (s SimpleCapabilityResolver) Resolve(uri string) (*Capability, error)
Resolve resolves capabilities.
type SimpleKeyResolver ¶
SimpleKeyResolver enables in-memory key resolvers based on maps.
type VDRResolver ¶ added in v0.1.6
type VDRResolver interface {
Resolve(did string, opts ...vdr.DIDMethodOption) (*did.DocResolution, error)
}
VDRResolver represents VDR resolver.
type VerificationMethod ¶
VerificationMethod to use to verify an invocation.
type VerificationOption ¶
type VerificationOption func(*VerificationOptions)
VerificationOption sets an option for the Verifier.
func WithLDDocumentLoaders ¶
func WithLDDocumentLoaders(loaders ...ld.DocumentLoader) VerificationOption
WithLDDocumentLoaders sets the JSON-LD document loaders for the Verifier.
func WithSignatureSuites ¶
func WithSignatureSuites(suites ...verifier.SignatureSuite) VerificationOption
WithSignatureSuites sets the signature suites supported by the Verifier.
type VerificationOptions ¶
type VerificationOptions struct {
LDProcessorOptions []jsonld.ProcessorOpts
SignatureSuites []verifier.SignatureSuite
}
VerificationOptions holds options for the Verifier.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier verifies zcaps.
func NewVerifier ¶
func NewVerifier( zcapResolver CapabilityResolver, keyResolver KeyResolver, options ...VerificationOption) (*Verifier, error)
NewVerifier returns a new Verifier.