httpsig

type Algorithm string

type CreatedScheme int

type Digest string

type ErrCode string

type ExpiresScheme int

type KeyError struct {
	Reason  KeyErrorReason
	Message string
	// contains filtered or unexported fields
}

type KeyErrorReason string

type KeyFetcher interface {
	// FetchByKeyID looks up a KeySpec from the 'keyid' metadata parameter on the signature.
	FetchByKeyID(keyID string) (KeySpec, error)
	// Fetch looks up a KeySpec when the is not a keyid in the signature.
	Fetch(rh http.Header, md MetadataProvider) (KeySpec, error)
}

type KeySpec struct {
	KeyID  string
	Algo   Algorithm
	PubKey crypto.PublicKey
	Secret []byte // shared secret for symmetric algorithms
}

type Metadata string

type MetadataProvider interface {
	Created() (int, error)
	Expires() (int, error)
	Nonce() (string, error)
	Alg() (string, error)
	KeyID() (string, error)
	Tag() (string, error)
}

type NonceScheme int

type SignatureError struct {
	Cause   error // may be nil
	Code    ErrCode
	Message string
}

type SignedField struct {
	Name       string
	Parameters map[string]any // Parameters are modifiers applied to the field that changes the way the signature is calculated.
}

type Signer struct {
	// contains filtered or unexported fields
}

type SigningOptions struct {
	PrivateKey crypto.PrivateKey // Required for asymetric algorithms
	Secret     []byte            // Required for HMAC signing
	Algorithm  Algorithm
	Digest     Digest        // The http digest algorithm to apply. Defaults to sha-256.
	Fields     []SignedField // Fields and Derived components to sign
	Metadata   []Metadata    // Metadata parameters to add to the signature
	Label      string        // The signature label. Defaults to DefaultSignatureLabel

	// Signature metadata settings.
	// These are only added to the signature if the parameter is listed in the Metadata list.
	MetaKeyID           string        // 'keyid' - No default. A value must be provided if the parameter is in Metadata.
	MetaTag             string        // 'tag' - No default. A value must be provided if the parameter is in Metadata.
	MetaExpiresDuration time.Duration // 'expires' - Current time plus this duration. Default duration 5 minutes.
	MetaNonce           NonceScheme   // 'nonce' - Defaults to NonceRandom32

}

type VerifiedSignature struct {
	Label    string // Label should not be used for the identity of the caller. Use keyid or tag instead. Label can be set by an attacker.
	Metadata MetadataProvider
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifyHandler struct {
	// contains filtered or unexported fields
}

type VerifyProfile struct {
	RequiredFields     []SignedField
	RequiredMetadata   []Metadata
	DisallowedMetadata []Metadata
	AllowedAlgorithms  []Algorithm // Which algorithms are allowed, either from keyid meta or in the KeySpec

	// Timing enforcement options
	DisableTimeEnforcement       bool          // If true do no time enforcement on any fields
	DisableExpirationEnforcement bool          // If expiration is present default to enforce
	CreatedValidDuration         time.Duration // Duration allowed for between time.Now and the created time
	ExpiredSkew                  time.Duration // Maximum duration allowed between time.Now and the expired time
	DateFieldSkew                time.Duration // Maximum duration allowed between Date field and created

}

type VerifyResult struct {
	Signatures []VerifiedSignature
}