auth

Documentation

Overview

Package auth provides authentication to the SecretHub API.

Index

• Constants
• Variables
• type Authenticator
  • func NewHTTPSigner(signer Signer) Authenticator
• type NopAuthenticator
  • func (s NopAuthenticator) Authenticate(r *http.Request) error
• type SessionSigner
  • func NewSessionSigner(sessionID uuid.UUID, secretKey string) *SessionSigner
  • func (s SessionSigner) ID() (string, error)
  • func (s SessionSigner) Sign(msg []byte) ([]byte, error)
  • func (s SessionSigner) SignMethod() string
• type Signer

Constants

const (
	// AuthHeaderVersionV1 is the authorization header tag used for authorization
	// headers that include the signing method.
	AuthHeaderVersionV1 = "SecretHub-v1"
)

Variables

var (
	ErrCannotParseDateHeader      = errNamespace.Code("parse_date_header_failed").StatusError("could not authenticate request because the date header of the auth message could not be parsed", http.StatusBadRequest)
	ErrInvalidAuthorizationHeader = errNamespace.Code("invalid_authorization_header").StatusErrorf("could not authenticate request because the authorization header has invalid format", http.StatusBadRequest)
	ErrOutdatedSignatureProtocol  = errNamespace.Code("outdated_signature_protocol").StatusError("the signature protocol used for authentication is outdated, please upgrade to a newer version", http.StatusBadRequest)

	ErrMalformedSignature = errNamespace.Code("malformed_signature").StatusError("could not authenticate request because the signature is malformed", http.StatusBadRequest)
	ErrSignatureExpired   = errNamespace.Code("signature_expired").StatusError("could not authenticate request because signature has expired", http.StatusUnauthorized)
	ErrSignatureFuture    = errNamespace.Code("signature_future").StatusError("could not authenticate request because signature timestamp is too far in the future", http.StatusUnauthorized)
)

Errors

Types

type Authenticator

type Authenticator interface {
	Authenticate(r *http.Request) error
}

Authenticator proofs that an HTTP request is made by the owner of the authenticator.

func NewHTTPSigner

func NewHTTPSigner(signer Signer) Authenticator

NewHTTPSigner creates an authenticator that uses the given signer to prove the owner of the signer is making the HTTP request.

type NopAuthenticator

type NopAuthenticator struct{}

NopAuthenticator is an authenticator that does not add any authentication to the request.

func (NopAuthenticator) Authenticate

func (s NopAuthenticator) Authenticate(r *http.Request) error

Authenticate the provided request.

type SessionSigner

type SessionSigner struct {
	// contains filtered or unexported fields
}

SessionSigner is an implementation of the Signer interface that uses an HMAC session to authenticate a request.

func NewSessionSigner

func NewSessionSigner(sessionID uuid.UUID, secretKey string) *SessionSigner

NewSessionSigner returns a new SessionSigner.

func (SessionSigner) ID

func (s SessionSigner) ID() (string, error)

ID returns the session id of this signer.

func (SessionSigner) Sign

func (s SessionSigner) Sign(msg []byte) ([]byte, error)

Sign the payload with an HMAC signature.

func (SessionSigner) SignMethod

func (s SessionSigner) SignMethod() string

SignMethod returns the signature method of this signer.

type Signer

type Signer interface {
	ID() (string, error)
	Sign([]byte) ([]byte, error)
	SignMethod() string
}

Signer provides proof that given bytes are processed by the owner of the signer.