httpsignature

type AcceptSignatures struct {
	// contains filtered or unexported fields
}

type Algorithm string

type BufferedContentDigestRoundTripper struct {
	// contains filtered or unexported fields
}

type BufferedContentDigestRoundTripperConfig struct {
	// Transport is mandatory borrowed RoundTripper; callers own timeout, redirects,
	// connections and concurrency.
	Transport http.RoundTripper
	// Algorithms is copied nonempty unique SHA256/SHA512 computation policy.
	Algorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
}

type BufferedContentDigestVerificationMiddleware func(http.Handler) http.Handler

type BufferedContentDigestVerificationMiddlewareConfig struct {
	// RequiredAlgorithms is copied nonempty unique SHA256/SHA512 verification policy,
	// not negotiated from untrusted fields.
	RequiredAlgorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
	// MapError is mandatory synchronous application failure rendering; it may receive
	// nil request and must redact safely.
	MapError func(http.ResponseWriter, *http.Request, error)
}

type BufferedTrailerVerificationMiddleware func(http.Handler) http.Handler

type BufferedTrailerVerificationMiddlewareConfig struct {
	// Verifier is mandatory borrowed constructed verifier; it verifies policy, not
	// protected business effects.
	Verifier *Verifier
	// SelectLabel must explicitly select a valid actual label from parsed fields;
	// snapshot inputs do not confer authority.
	SelectLabel func(*http.Request, SignatureInputs, Signatures) (string, error)
	// RequiredAlgorithms is copied nonempty unique SHA256/SHA512 verification policy,
	// not negotiated from untrusted fields.
	RequiredAlgorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error)
	// MapError is mandatory synchronous application failure rendering; it may receive
	// nil request and must redact safely.
	MapError func(http.ResponseWriter, *http.Request, error)
}

type BufferedTrailerVerifyingRoundTripper struct {
	// contains filtered or unexported fields
}

type BufferedTrailerVerifyingRoundTripperConfig struct {
	// Transport is mandatory borrowed RoundTripper; callers own timeout, redirects,
	// connections and concurrency.
	Transport http.RoundTripper
	// Verifier is mandatory borrowed constructed verifier; it verifies policy, not
	// protected business effects.
	Verifier *Verifier
	// SelectLabel must explicitly select a valid actual label from parsed fields;
	// snapshot inputs do not confer authority.
	SelectLabel func(*http.Request, *http.Response, SignatureInputs, Signatures) (string, error)
	// RequiredAlgorithms is copied nonempty unique SHA256/SHA512 verification policy,
	// not negotiated from untrusted fields.
	RequiredAlgorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error)
}

type ComponentIdentifier struct {
	// Name is a lowercase covered field or derived @ identifier; known modes are
	// enforced during base resolution.
	Name string
	// Parameters is borrowed ordered data; identity comparison sorts names while
	// serialization retains order.
	Parameters []Parameter
}

type Digest struct {
	// Algorithm is a parsed dictionary key; unknown unselected names remain available to
	// application policy.
	Algorithm DigestAlgorithm
	// Value is borrowed checksum bytes in constructed values; parsing/Entries returns
	// owned copies.
	Value []byte
	// Parameters preserves ordered SF extensions, not an automatic algorithm negotiation
	// policy.
	Parameters []Parameter
}

type DigestAlgorithm string

type DigestField struct {
	// contains filtered or unexported fields
}

type DigestPreference struct {
	// Algorithm is a syntactically valid digest key; unknown names are retained rather
	// than automatically computed.
	Algorithm DigestAlgorithm
	// Weight is inclusive 0–10 relative preference; zero refuses and equal weights add
	// no tie-break rule.
	Weight int64
}

type DigestPreferences struct {
	// contains filtered or unexported fields
}

type ExistingSignaturesPolicy uint8

type ExternalRequestContext struct {
	// Scheme is trusted external http/https context, not arbitrary forwarding data.
	Scheme string
	// Authority is trusted external authority, normalized consistently with any
	// absolute/CONNECT target.
	Authority string
	// RequestTarget is the complete trusted target; all three fields must be nonempty
	// when supplied.
	RequestTarget string
}

type HMACKey struct {
	// contains filtered or unexported fields
}

type KeyResolver interface {
	// Resolve supplies trusted algorithm/key/lifecycle/freshness for an opaque
	// ID, not policy inferred from untrusted alg. Honor ctx and support concurrent
	// use; late success refuses and backend diagnostic graphs are stripped.
	Resolve(context.Context, string) (ResolvedKey, error)
}

type MemoryReplayConfig struct {
	// Capacity is the maximum number of retained key and nonce identities.
	Capacity int
	// MaxTTL is the longest accepted interval from Now to ExpiresAt.
	MaxTTL time.Duration
	// MaxKeyIDBytes and MaxNonceBytes bound caller-controlled identity storage.
	MaxKeyIDBytes int
	// MaxNonceBytes is a positive per-nonce retained-byte ceiling, not a global heap
	// quota.
	MaxNonceBytes int
	// Now must be safe for concurrent use and must return promptly. The store
	// never invokes it while holding replay state.
	Now func() time.Time
}

type MemoryReplayStore struct {
	// contains filtered or unexported fields
}

type MessageContext struct {
	// Request is the borrowed target request; exactly one of Request/Response must be
	// non-nil.
	Request *http.Request
	// Response is the borrowed target response; managed fields require correct
	// ResponseTransport selection.
	Response *http.Response
	// RelatedRequest is explicit borrowed actual-request context for response components
	// carrying req.
	RelatedRequest *http.Request
	// ExternalRequest is optional borrowed complete trusted proxy reconstruction, never
	// auto-derived from forwarding fields.
	ExternalRequest *ExternalRequestContext
	// StructuredFields is borrowed lowercase field-name/type policy required for sf
	// canonicalization.
	StructuredFields map[string]StructuredFieldType
	// ResponseTransport selects received versus Response.Write wire identity;
	// unspecified refuses ambiguous managed fields.
	ResponseTransport ResponseTransportMode
	// MaxSignatureBaseBytes bounds the complete canonical base. Zero selects
	// DefaultMaxSignatureBaseBytes; negative values are invalid.
	MaxSignatureBaseBytes int
}

type Parameter struct {
	// Name is an RFC 8941 lowercase key, preserved in supplied serialization order.
	Name string
	// Value is a supported SF scalar/token or borrowed bytes; copying accessors clone
	// byte values.
	Value any
}

type ParameterPolicy uint8

type ReplayRecord struct {
	// KeyID is the exact opaque resolver namespace; rotation namespaces and multi-tenant
	// isolation are caller-defined.
	KeyID string
	// Nonce is exact opaque signed identity; equal key/nonce pairs share replay state.
	Nonce string
	// ExpiresAt is retention boundary selected from accepted validity windows, including
	// configured skew.
	ExpiresAt time.Time
}

type ReplayStore interface {
	// Consume atomically reserves exact key/nonce until ExpiresAt, including
	// accepted skew. Honor ctx and document bounded retention/durability and
	// namespace scope; unknown outcomes fail closed, not coupled to business effects.
	Consume(context.Context, ReplayRecord) error
}

type RequestVerificationMiddleware func(http.Handler) http.Handler

type RequestVerificationMiddlewareConfig struct {
	// Verifier is mandatory borrowed constructed verifier; it verifies policy, not
	// protected business effects.
	Verifier *Verifier
	// SelectLabel must explicitly select a valid actual label from parsed fields;
	// snapshot inputs do not confer authority.
	SelectLabel func(*http.Request, SignatureInputs, Signatures) (string, error)
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error)
	// MapError is mandatory synchronous application failure rendering; it may receive
	// nil request and must redact safely.
	MapError func(http.ResponseWriter, *http.Request, error)
}

type ResolvedKey struct {
	// Algorithm is trusted resolver binding; it must be allowed and match any protected
	// alg.
	Algorithm Algorithm
	// Key is borrowed verification material of the exact public/shared type; private
	// asymmetric keys are refused.
	Key any
	// NotBefore is required inclusive activation; verification and signed creation apply
	// configured skew.
	NotBefore time.Time
	// NotAfter is required exclusive key expiry after NotBefore, extended only by
	// configured skew.
	NotAfter time.Time
	// FreshUntil is required exclusive resolver-cache freshness at processing time,
	// without skew extension.
	FreshUntil time.Time
	// Revoked refuses use regardless of cached algorithm/time data.
	Revoked bool
}

type ResponseSigningMiddleware func(http.Handler) http.Handler

type ResponseSigningMiddlewareConfig struct {
	// Signer is mandatory borrowed constructed signer; shared use depends on safe
	// profile collaborators.
	Signer *Signer
	// Label is an explicit valid SF dictionary key, never chosen by map iteration.
	Label string
	// Existing is explicit reject/append policy; append preserves labels but does not
	// verify earlier signatures.
	Existing ExistingSignaturesPolicy
	// MaxBufferedBytes must be positive and bounds emitted content buffered before
	// signing, not header/global memory.
	MaxBufferedBytes int64
	// ContentDigestAlgorithms optionally computes copied SHA256/SHA512 policy; the
	// signing profile must cover Content-Digest.
	ContentDigestAlgorithms []DigestAlgorithm
	// Options is a mandatory synchronous borrowed per-message callback; support
	// concurrency, bound work and avoid body/message mutation.
	Options func(context.Context, *http.Request, *http.Response) (SigningOptions, error)
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error)
	// MapError is mandatory synchronous application failure rendering; it may receive
	// nil request and must redact safely.
	MapError func(http.ResponseWriter, *http.Request, error)
	// ReportError is mandatory synchronous diagnostic reporting; bound work and redact,
	// including after response commitment.
	ReportError func(*http.Request, error)
}

type ResponseTransportMode uint8

type SFToken string

type SignatureInput struct {
	// Label is a dictionary key selecting this member, not authentication by itself.
	Label string
	// Components is borrowed ordered coverage; full identity includes order-insensitive
	// parameters.
	Components []ComponentIdentifier
	// Parameters is borrowed ordered metadata; unknown extensions parse, application
	// policy selects registered fields.
	Parameters []Parameter
}

type SignatureInputs struct {
	// contains filtered or unexported fields
}

type SignatureRequest = SignatureInput

type SignatureValue struct {
	// Label must match its Signature-Input dictionary label for verification.
	Label string
	// Value is borrowed signature bytes in direct constructed values; parser/accessors
	// return owned copies.
	Value []byte
	// Parameters preserves ordered SF extensions; cryptographic verification operates on
	// Value.
	Parameters []Parameter
}

type Signatures struct {
	// contains filtered or unexported fields
}

type SignedFields struct {
	// contains filtered or unexported fields
}

type Signer struct {
	// contains filtered or unexported fields
}

type SigningKey struct {
	// KeyID is nonempty public key identity emitted in protected metadata, not
	// application authorization.
	KeyID string
	// Algorithm must match the profile allowlist and the exact key type.
	Algorithm Algorithm
	// Key is borrowed private/shared material; keep it immutable during use and obey
	// algorithm size rules.
	Key any
	// NotBefore is required inclusive activation at sampled signing time.
	NotBefore time.Time
	// NotAfter is required exclusive expiry after NotBefore; required signature expiry
	// cannot extend beyond it.
	NotAfter time.Time
	// Revoked refuses use even when the time window and algorithm match.
	Revoked bool
}

type SigningKeyProvider interface {
	// SigningKey selects trusted current algorithm-bound material with explicit
	// activation/expiry/revocation. Late success is rejected; raw provider errors
	// are mapped to ErrSigningProvider rather than retained.
	SigningKey(context.Context) (SigningKey, error)
}

type SigningOptions struct {
	// Nonce is supplied by the caller only when required; freshness/entropy is
	// application-owned.
	Nonce string
}

type SigningProfile struct {
	// contains filtered or unexported fields
}

type SigningProfileConfig struct {
	// AllowedAlgorithms is a nonempty unique supported allowlist copied at construction.
	AllowedAlgorithms []Algorithm
	// CoveredComponents is copied, including parameter byte values, in exact signing
	// order.
	CoveredComponents []ComponentIdentifier
	// AllowEmptyCoverage must explicitly permit no covered components; it does not
	// authorize any message effect.
	AllowEmptyCoverage bool
	// Expires must explicitly require or forbid expires; optional is not a signing
	// policy.
	Expires ParameterPolicy
	// AlgorithmParameter must require or forbid emitting alg; resolved provider
	// algorithm always binds the primitive.
	AlgorithmParameter ParameterPolicy
	// Nonce must require or forbid a caller-supplied nonce; no nonce generator is
	// provided.
	Nonce ParameterPolicy
	// Tag must require or forbid the configured exact TagValue.
	Tag ParameterPolicy
	// TagValue is required valid SF text with required Tag, empty when forbidden.
	TagValue string
	// Lifetime is whole positive seconds with required Expires, zero when forbidden.
	Lifetime time.Duration
	// ResolveTimeout is positive cooperative key-provider deadline; late success is
	// rejected.
	ResolveTimeout time.Duration
	// Now is mandatory borrowed concurrent-safe prompt clock, not context-preempted.
	Now func() time.Time
	// Provider is mandatory borrowed rotation/key owner; honor context and support
	// concurrent calls.
	Provider SigningKeyProvider
	// Random is retained for source compatibility.
	//
	// Deprecated: Random is ignored. Randomized algorithms use Go-managed
	// cryptographically secure randomness.
	Random io.Reader
	// RequireExternalRequestContext refuses signing without an explicit trusted external
	// request context.
	RequireExternalRequestContext bool
}

type SigningRoundTripper struct {
	// contains filtered or unexported fields
}

type SigningRoundTripperConfig struct {
	// Transport is mandatory borrowed RoundTripper; callers own timeout, redirects,
	// connections and concurrency.
	Transport http.RoundTripper
	// Signer is mandatory borrowed constructed signer; shared use depends on safe
	// profile collaborators.
	Signer *Signer
	// Label is an explicit valid SF dictionary key, never chosen by map iteration.
	Label string
	// Existing is explicit reject/append policy; append preserves labels but does not
	// verify earlier signatures.
	Existing ExistingSignaturesPolicy
	// Options runs synchronously on the original request; caller mutations/effects are
	// not isolated by this adapter.
	Options func(context.Context, *http.Request) (SigningOptions, error)
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error)
}

type StructuredFieldType uint8

type SyntaxLimits struct {
	// MaxFieldBytes caps combined encoded bytes, including comma-space line separators;
	// positive.
	MaxFieldBytes int
	// MaxFieldLines caps input field-line count before parsing; positive.
	MaxFieldLines int
	// MaxDictionaryMembers caps decoded dictionary members after parsing; positive.
	MaxDictionaryMembers int
	// MaxComponentsPerSignature caps covered items per decoded signature inner list;
	// positive.
	MaxComponentsPerSignature int
	// MaxParametersPerItem caps each decoded item/list parameter count; positive.
	MaxParametersPerItem int
	// MaxBinaryBytes caps decoded byte sequences; positive and no larger than
	// MaxFieldBytes.
	MaxBinaryBytes int
}

type TrailerResponseSigningMiddleware func(http.Handler) http.Handler

type TrailerResponseSigningMiddlewareConfig struct {
	// Signer is mandatory borrowed constructed signer; shared use depends on safe
	// profile collaborators.
	Signer *Signer
	// Label is an explicit valid SF dictionary key, never chosen by map iteration.
	Label string
	// Algorithms is copied nonempty unique SHA256/SHA512 computation policy.
	Algorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
	// Options is a mandatory synchronous borrowed per-message callback; support
	// concurrency, bound work and avoid body/message mutation.
	Options func(context.Context, *http.Request) (SigningOptions, error)
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error)
	// ReportError is mandatory synchronous diagnostic reporting; bound work and redact,
	// including after response commitment.
	ReportError func(*http.Request, error)
}

type TrailerSigningRoundTripper struct {
	// contains filtered or unexported fields
}

type TrailerSigningRoundTripperConfig struct {
	// Transport is mandatory borrowed RoundTripper; callers own timeout, redirects,
	// connections and concurrency.
	Transport http.RoundTripper
	// Signer is mandatory borrowed constructed signer; shared use depends on safe
	// profile collaborators.
	Signer *Signer
	// Label is an explicit valid SF dictionary key, never chosen by map iteration.
	Label string
	// Algorithms is copied nonempty unique SHA256/SHA512 computation policy.
	Algorithms []DigestAlgorithm
	// MaxBytes is a positive per-body content-byte bound, not an exact heap/aggregate-
	// throughput quota.
	MaxBytes int64
	// Options runs on the original request at EOF; own nonce freshness and do not mutate
	// covered state.
	Options func(context.Context, *http.Request) (SigningOptions, error)
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request) (*ExternalRequestContext, error)
}

type VerificationError struct {
	// Failure is a fixed category for core-created errors; caller-constructed strings
	// are not sanitized.
	Failure VerificationFailure
	// contains filtered or unexported fields
}

type VerificationFailure string

type VerificationProfile struct {
	// contains filtered or unexported fields
}

type VerificationProfileConfig struct {
	// AllowedAlgorithms is nonempty unique supported policy copied at construction;
	// inbound alg cannot widen it.
	AllowedAlgorithms []Algorithm
	// RequiredComponents is copied coverage policy with order-insensitive parameter
	// identity; extra covered components may remain.
	RequiredComponents []ComponentIdentifier
	// AllowEmptyCoverage must explicitly permit empty coverage and does not imply
	// authorization.
	AllowEmptyCoverage bool
	// Created explicitly forbids, permits or requires signed creation; non-forbidden
	// needs positive MaxAge.
	Created ParameterPolicy
	// Expires explicitly forbids, permits or requires exclusive signature expiration.
	Expires ParameterPolicy
	// AlgorithmParameter controls protected alg presence, not whether resolver/primitive
	// binding is enforced.
	AlgorithmParameter ParameterPolicy
	// Nonce controls nonce presence; non-forbidden requires Replay and positive
	// ReplayTimeout.
	Nonce ParameterPolicy
	// Tag controls tag presence; non-forbidden requires a nonempty allowed-tag set.
	Tag ParameterPolicy
	// AllowedTags is a unique valid SF-text allowlist copied at construction; empty only
	// when Tag is forbidden.
	AllowedTags []string
	// MaxAge is zero with forbidden Created, positive otherwise; MaxAge+ClockSkew must
	// not overflow.
	MaxAge time.Duration
	// ClockSkew is nonnegative payload/key tolerance; it does not extend FreshUntil.
	ClockSkew time.Duration
	// ResolveTimeout is positive cooperative resolver deadline; late successful results
	// are rejected.
	ResolveTimeout time.Duration
	// ReplayTimeout is positive when nonce is not forbidden, otherwise zero; timeout may
	// follow a committed reservation.
	ReplayTimeout time.Duration
	// Now is mandatory borrowed prompt concurrent-safe clock; input and key policy
	// sample it separately.
	Now func() time.Time
	// Resolver is mandatory borrowed trusted key/lifecycle owner; honor context and
	// support concurrent use.
	Resolver KeyResolver
	// Replay is mandatory when nonce is not forbidden; atomic backend
	// lifetime/consistency remain caller-owned.
	Replay ReplayStore
	// RequireExternalRequestContext refuses verification without explicit trusted
	// external request context.
	RequireExternalRequestContext bool
}

type VerifiedSignature struct {
	// Label is the explicitly selected actual signature label.
	Label string
	// KeyID is resolved public identity, not principal authentication or authorization.
	KeyID string
	// Algorithm is trusted resolved primitive binding.
	Algorithm Algorithm
	// Created is signed creation time, zero if absent under policy.
	Created time.Time
	// Expires is signed expiration, zero if absent; replay retention may use MaxAge and
	// skew instead.
	Expires time.Time
}

type Verifier struct {
	// contains filtered or unexported fields
}

type VerifyingRoundTripper struct {
	// contains filtered or unexported fields
}

type VerifyingRoundTripperConfig struct {
	// Transport is mandatory borrowed RoundTripper; callers own timeout, redirects,
	// connections and concurrency.
	Transport http.RoundTripper
	// Verifier is mandatory borrowed constructed verifier; it verifies policy, not
	// protected business effects.
	Verifier *Verifier
	// SelectLabel must explicitly select a valid actual label from parsed fields;
	// snapshot inputs do not confer authority.
	SelectLabel func(*http.Request, *http.Response, SignatureInputs, Signatures) (string, error)
	// ContentDigestAlgorithms is optional copied policy; required before accepting
	// coverage of a response Content-Digest.
	ContentDigestAlgorithms []DigestAlgorithm
	// MaxBufferedBytes is positive with ContentDigestAlgorithms, zero when no digest
	// buffering policy is configured.
	MaxBufferedBytes int64
	// ExternalContext is optional borrowed trusted origin/target reconstruction; never
	// trust arbitrary forwarding values.
	ExternalContext func(context.Context, *http.Request, *http.Response) (*ExternalRequestContext, error)
}