README
¶
Repl Identity
Blog post on https://blog.replit.com coming soon!
Repl Identity stores a REPL_IDENTITY token in every Repl automatically. This
token is a signed PASETO that includes verifiable repl
identity data (such as the user in the repl, and the repl ID).
WARNING: in their current form, these tokens are very forwardable! You should only send these tokens to repls that you trust, or between repls that you own.
This package provides the necessary code to verify these tokens.
Check the example at examples/extract.go for an example usage. You can also
see this in action at https://replit.com/@mattiselin/repl-identity. If you are
logged in to Replit, you'll see your username when you click "Run" on the Cover
Page - that's Repl Identity at work.
Documentation
¶
Overview ¶
Package replidentity provides verification utilities for Repl Identity tokens.
Example ¶
identity := os.Getenv("REPL_IDENTITY")
if identity == "" {
fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
return
}
identityKey := os.Getenv("REPL_IDENTITY_KEY")
if identity == "" {
fmt.Println("Sorry, this repl does not yet have an identity (anonymous run?).")
return
}
// This should be set to the Repl ID of the repl you want to prove your
// identity to.
targetRepl := "target_repl"
// Create a signing authority that is authorized to emit tokens for the
// current repl.
signingAuthority, err := replidentity.NewSigningAuthority(
string(identityKey),
identity,
os.Getenv("REPL_ID"),
replidentity.ReadPublicKeyFromEnv,
)
if err != nil {
panic(err)
}
signedToken, err := signingAuthority.Sign(targetRepl)
if err != nil {
panic(err)
}
// Verify the signed token, pretending we are the target repl.
replIdentity, err := replidentity.VerifyIdentity(
signedToken,
targetRepl,
replidentity.ReadPublicKeyFromEnv,
)
if err != nil {
panic(err)
}
fmt.Println()
fmt.Printf("The identity in the repl's token (%d bytes) is:\n", len(identity))
fmt.Printf(
"repl id: %s\n user: %s\n slug: %s audience: %s\n",
replIdentity.Replid,
replIdentity.User,
replIdentity.Slug,
replIdentity.Aud,
)
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ReadPublicKeyFromEnv ¶
ReadPublicKeyFromEnv provides a PubKeySource that reads public keys from the `REPL_PUBKEYS` environment variable that is present in all repls.
func VerifyIdentity ¶
func VerifyIdentity(message string, audience string, getPubKey PubKeySource) (*api.GovalReplIdentity, error)
VerifyIdentity verifies that the given `REPL_IDENTITY` value is in fact signed by Goval's chain of authority, and addressed to the provided audience (the `REPL_ID` of the recipient).
Types ¶
type MessageClaims ¶
type MessageClaims struct {
Repls map[string]struct{}
Users map[string]struct{}
Flags map[api.FlagClaim]struct{}
}
MessageClaims is a collection of indexable claims that are made by a certificate.
type PubKeySource ¶
PubKeySource provides an interface for looking up an [ed25519.PublicKey] from some external source.
type SigningAuthority ¶
type SigningAuthority struct {
// contains filtered or unexported fields
}
SigningAuthority can generate tokens that prove the identity of one repl (your own) against another repl (the audience). Use this to prevent the target repl from spoofing your own identity by forwarding the token.
func NewSigningAuthority ¶
func NewSigningAuthority( marshaledPrivateKey, marshaledIdentity string, replid string, getPubKey PubKeySource, ) (*SigningAuthority, error)
NewSigningAuthority returns a new SigningAuthority given the marshaled private key (obtained from the `REPL_IDENTITY_KEY` environment variable), the identity token (obtained from the `REPL_IDENTITY` environment variable), the current Repl ID (obtained from the `REPL_ID` environment varaible), and the source of public keys (typically ReadPublicKeyFromEnv).
func (*SigningAuthority) Sign ¶
func (a *SigningAuthority) Sign(audience string) (string, error)
Sign generates a new token that can be given to the provided audience, and is resistant against forwarding, so that the recipient cannot forward this token to another repl and claim it came directly from you.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package paserk contains implementations of [PASERK](https://github.com/paseto-standard/paserk), an extension to PASETO that allows for key sharing.
|
Package paserk contains implementations of [PASERK](https://github.com/paseto-standard/paserk), an extension to PASETO that allows for key sharing. |