Documentation
¶
Overview ¶
Package jwt provides JWT token creation and validation for Coral discovery.
Index ¶
Constants ¶
const DefaultAudience = "coral-colony"
DefaultAudience is the default token audience for colony tokens.
const DefaultIssuer = "coral-discovery"
DefaultIssuer is the default token issuer for discovery tokens.
const LegacyAudience = "colony-step-ca"
LegacyAudience is the legacy audience name for backwards compatibility.
const LegacyIssuer = "reef-control"
LegacyIssuer is the legacy issuer name for backwards compatibility.
Variables ¶
This section is empty.
Functions ¶
func CreateReferralTicketStatic ¶
func CreateReferralTicketStatic( privateKey ed25519.PrivateKey, keyID string, reefID, colonyID, agentID, intent string, ttlSeconds int, issuer, audience string, ) (string, int64, error)
CreateReferralTicketStatic creates a referral ticket using static parameters. This is the primary function for creating tokens, useful for Wasm compilation.
func VerifySignatureStatic ¶
VerifySignatureStatic verifies a JWT signature using a JWKS JSON string. This is the primary function for verification, useful for Wasm compilation.
Types ¶
type BootstrapClaims ¶
type BootstrapClaims struct {
ReefID string `json:"reef_id"`
ColonyID string `json:"colony_id"`
AgentID string `json:"agent_id"`
Intent string `json:"intent"`
jwt.RegisteredClaims
}
BootstrapClaims contains JWT claims for bootstrap tokens.
type JWK ¶
type JWK struct {
KID string `json:"kid"`
KTY string `json:"kty"` // "OKP"
CRV string `json:"crv"` // "Ed25519"
X string `json:"x"` // Base64URL encoded public key
USE string `json:"use"` // "sig"
ALG string `json:"alg"` // "EdDSA"
}
JWK represents a JSON Web Key.
type ReferralClaims ¶
type ReferralClaims struct {
ReefID string `json:"reef_id"`
ColonyID string `json:"colony_id"`
AgentID string `json:"agent_id"`
Intent string `json:"intent"`
jwt.RegisteredClaims
}
ReferralClaims contains JWT claims for referral tickets (RFD 049).
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer creates signed JWT tokens.
type SigningConfig ¶
type SigningConfig struct {
// PrivateKey is the Ed25519 private key for signing.
PrivateKey ed25519.PrivateKey
// KeyID is the key identifier for the JWT header.
KeyID string
// Issuer is the token issuer claim.
Issuer string
// Audience is the token audience claim.
Audience string
// DefaultTTL is the default token time-to-live.
DefaultTTL time.Duration
}
SigningConfig contains configuration for token signing.
type Validator ¶
type Validator struct {
// contains filtered or unexported fields
}
Validator validates JWT tokens using a JWKS.
func NewValidator ¶
NewValidator creates a new token validator from a JWKS.
func NewValidatorFromJSON ¶
NewValidatorFromJSON creates a validator from a JWKS JSON string.
func (*Validator) GetKeyFunc ¶
GetKeyFunc returns a jwt.Keyfunc for use with jwt.Parse.
func (*Validator) ValidateReferralTicket ¶
func (v *Validator) ValidateReferralTicket(tokenString string) (*ReferralClaims, error)
ValidateReferralTicket validates a referral ticket JWT. This is a stateless validation per RFD 049 using JWKS.
func (*Validator) VerifySignature ¶
VerifySignature verifies a JWT signature against the JWKS. Returns true if the signature is valid, false otherwise.
Source Files