Expand description
Turns the bearer token on a request into a caller, or refuses it.
Structs§
- Caller
- Who a request comes from: a tenant’s key, or with no tenant the operator’s.
- Scopes
- A set of scopes.
Enums§
Functions§
- authenticate
- The caller a request’s Authorization header names. The key is looked up on every call, with no cache, so a revoked key fails on its next request.
- parse
- Reads a token written as
vcs_<key id>_<secret>: the key id is 16 lowercase hex digits, and the secret is 256 bits in base64url without padding. The secret may hold_, so the parts are found by position. - require
- Refuses a caller whose key does not hold
scope. Admin belongs only to an operator key, and the vCon, legal and audit scopes only to a tenant key, so a key holding a scope of the other kind is still refused it. - tenant_
for - The tenant a vCon or legal request acts on: the caller’s own, from its key, never from the request.