coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sign decision envelopes and close FLEX-WP-0024.
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details

Browse source 
Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:57:50 +02:00
parent c074237aac
commit 127f83da4d
15 changed files with 697 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

23
pkg/api/canonical.go
View file

@ -229,9 +229,32 @@ type DecisionEnvelope struct {
Obligations []Obligation `json:"obligations,omitempty" yaml:"obligations,omitempty"`
Diagnostics map[string]any `json:"diagnostics,omitempty" yaml:"diagnostics,omitempty"`
Provenance DecisionProvenance `json:"provenance" yaml:"provenance"`
Signature *EnvelopeSignature `json:"signature,omitempty" yaml:"signature,omitempty"`
Caring *CaringDecisionMetadata `json:"caring,omitempty" yaml:"caring,omitempty"`
}
// EnvelopeSignatureMode is how the responder authenticates the envelope.
type EnvelopeSignatureMode string
const (
EnvelopeSignatureSigned EnvelopeSignatureMode = "signed"
EnvelopeSignatureUnsigned EnvelopeSignatureMode = "unsigned"
)
// EnvelopeSignature is a detached signature over the canonical envelope with
// this field omitted (FLEX-WP-0024). It is not decision material and is not
// part of request_digest.
type EnvelopeSignature struct {
Mode EnvelopeSignatureMode `json:"mode" yaml:"mode"`
Alg string `json:"alg,omitempty" yaml:"alg,omitempty"`
Kid string `json:"kid,omitempty" yaml:"kid,omitempty"`
Value string `json:"value,omitempty" yaml:"value,omitempty"`
}
func UnsignedEnvelopeSignature() *EnvelopeSignature {
return &EnvelopeSignature{Mode: EnvelopeSignatureUnsigned}
}
// DecisionLifetimeKind identifies how an allow ends.
type DecisionLifetimeKind string