httpsig

type AcceptSignature struct {
	Profile   SigningProfile
	MetaNonce string // 'nonce'
	MetaKeyID string // 'keyid'
	MetaTag   string // 'tag' - No default. A value must be provided if the parameter is in Metadata.
}

type Algorithm string

type CreatedScheme int

type Digest string

type ErrCode string

type ExpiresScheme int

type KeyError struct {
	Reason  KeyErrorReason
	Message string
	// contains filtered or unexported fields
}

type KeyErrorReason string

type KeyFetcher interface {
	// FetchByKeyID looks up a KeySpec from the 'keyid' metadata parameter on the signature.
	FetchByKeyID(ctx context.Context, rh http.Header, keyID string) (KeySpecer, error)
	// Fetch looks up a KeySpec when the keyid is not in the signature.
	Fetch(ctx context.Context, rh http.Header, md MetadataProvider) (KeySpecer, error)
}

type KeySpec struct {
	KeyID  string
	Algo   Algorithm
	PubKey crypto.PublicKey
	Secret []byte // shared secret for symmetric algorithms
}

type KeySpecer interface {
	KeySpec() (KeySpec, error)
}

type Metadata string

type MetadataProvider interface {
	Created() (int, error)
	Expires() (int, error)
	Nonce() (string, error)
	Alg() (string, error)
	KeyID() (string, error)
	Tag() (string, error)
}

type NonceScheme int

type SignatureError struct {
	Cause   error // may be nil
	Code    ErrCode
	Message string
}

type SignedField struct {
	Name       string
	Parameters map[string]any // Parameters are modifiers applied to the field that changes the way the signature is calculated.
}

type Signer struct {
	// contains filtered or unexported fields
}

type SigningKey struct {
	Key    crypto.PrivateKey // private key for asymmetric algorithms
	Secret []byte            // Secret to use for symmetric algorithms
	Opts   SigningKeyOpts    // Options for advanced signing use cases like TPMs.
	// Meta fields
	MetaKeyID string // 'keyid' - Only used if 'keyid' is set in the SigningProfile. A value must be provided if the parameter is required in the SigningProfile. Metadata.
	MetaTag   string // 'tag'. Only used if 'tag' is set in the SigningProfile. A value must be provided if the parameter is required in the SigningProfile.
}

type SigningKeyOpts struct {
	Signer       crypto.Signer // crypto.Signer interface for TPMs and other custom use cases.
	ASN1ForECDSA bool          // Set to true to indicate the crypto.Signer returns ASN.1 formatted signatures for ECDSA algorithms. False (default) indicates ECDSA signatures are concatenated R and S parameters as per the HTTP Signatures spec.
}

type SigningProfile struct {
	Algorithm       Algorithm
	Digest          Digest        // The http digest algorithm to apply. Defaults to sha-256.
	Fields          []SignedField // Fields and Derived components to sign.
	Metadata        []Metadata    // Metadata parameters to add to the signature.
	Label           string        // The signature label. Defaults to DefaultSignatureLabel.
	ExpiresDuration time.Duration // Current time plus this duration. Default duration 5 minutes. Used only if included in Metadata.
	Nonce           NonceScheme   // Scheme to use for generating the nonce if included in Metadata.
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifyDebugInfo struct {
	SignatureBase string // The signature base derived from the request.
}

type VerifyHandler struct {
	// contains filtered or unexported fields
}

type VerifyProfile struct {
	SignatureLabel     string // Which signature this profile applies to.
	RequiredFields     []SignedField
	RequiredMetadata   []Metadata
	DisallowedMetadata []Metadata
	AllowedAlgorithms  []Algorithm // Which algorithms are allowed, either from keyid meta or in the KeySpec

	// Timing enforcement options
	DisableTimeEnforcement       bool          // If true do no time enforcement on any fields
	DisableExpirationEnforcement bool          // If expiration is present default to enforce
	CreatedValidDuration         time.Duration // Duration allowed for between time.Now and the created time. Default to 5 minutes.
	ExpiredSkew                  time.Duration // Maximum duration allowed between time.Now and the expired time. Default to 1 minute.
	// contains filtered or unexported fields
}

type VerifyResult struct {
	Verified  bool
	Label     string
	KeySpecer KeySpecer
	DebugInfo VerifyDebugInfo // Present if the verifier debug flag is set and the signature was valid.
	MetadataProvider
}