Authorize.Macaroon

This module contains an implementation of macaroons as described in http://theory.stanford.edu/~ataly/Papers/macaroons.pdf. The serialization, cryptography, and validation semantics are compatible with go-macaroons https://github.com/go-macaroon/macaroon.

Types

newtype MacaroonId

Constructors

MacaroonId

Fields

• unMacaroonId :: ByteString

Instances

Show MacaroonId

Defined in Authorize.Macaroon.Types

Methods

showsPrec :: Int -> MacaroonId -> ShowS

show :: MacaroonId -> String

showList :: [MacaroonId] -> ShowS

Serialize MacaroonId

Defined in Authorize.Macaroon.Types

Methods

put :: Putter MacaroonId

get :: Get MacaroonId

Eq MacaroonId

Defined in Authorize.Macaroon.Types

Methods

(==) :: MacaroonId -> MacaroonId -> Bool

(/=) :: MacaroonId -> MacaroonId -> Bool

Ord MacaroonId

Defined in Authorize.Macaroon.Types

Methods

compare :: MacaroonId -> MacaroonId -> Ordering

(<) :: MacaroonId -> MacaroonId -> Bool

(<=) :: MacaroonId -> MacaroonId -> Bool

(>) :: MacaroonId -> MacaroonId -> Bool

(>=) :: MacaroonId -> MacaroonId -> Bool

max :: MacaroonId -> MacaroonId -> MacaroonId

min :: MacaroonId -> MacaroonId -> MacaroonId

ByteArrayAccess MacaroonId

Defined in Authorize.Macaroon.Types

Methods

length :: MacaroonId -> Int

withByteArray :: MacaroonId -> (Ptr p -> IO a) -> IO a

copyByteArrayToPtr :: MacaroonId -> Ptr p -> IO ()

data Macaroon

Instances

Show Macaroon

Defined in Authorize.Macaroon.Types

Methods

showsPrec :: Int -> Macaroon -> ShowS

show :: Macaroon -> String

showList :: [Macaroon] -> ShowS

Serialize Macaroon

Defined in Authorize.Macaroon.Types

Methods

put :: Putter Macaroon

get :: Get Macaroon

Eq Macaroon

Defined in Authorize.Macaroon.Types

Methods

(==) :: Macaroon -> Macaroon -> Bool

(/=) :: Macaroon -> Macaroon -> Bool

data SealedMacaroon

Couple a macaroon with its discharges. Application developers should only produce these values either by invoking prepareForRequest or by deserializing a client token.

Constructors

SealedMacaroon

Fields

• rootMacaroon :: Macaroon
• dischargeMacaroons :: [Macaroon]

Instances

Show SealedMacaroon

Defined in Authorize.Macaroon.Types

Methods

showsPrec :: Int -> SealedMacaroon -> ShowS

show :: SealedMacaroon -> String

showList :: [SealedMacaroon] -> ShowS

Serialize SealedMacaroon

Defined in Authorize.Macaroon.Types

Methods

put :: Putter SealedMacaroon

get :: Get SealedMacaroon

Eq SealedMacaroon

Defined in Authorize.Macaroon.Types

Methods

(==) :: SealedMacaroon -> SealedMacaroon -> Bool

(/=) :: SealedMacaroon -> SealedMacaroon -> Bool

newtype Key

Constructors

Key

Fields

• unKey :: ScrubbedBytes

Instances

Show Key

Defined in Authorize.Macaroon.Types

Methods

showsPrec :: Int -> Key -> ShowS

show :: Key -> String

showList :: [Key] -> ShowS

Eq Key

Defined in Authorize.Macaroon.Types

Methods

(==) :: Key -> Key -> Bool

(/=) :: Key -> Key -> Bool

Ord Key

Defined in Authorize.Macaroon.Types

Methods

compare :: Key -> Key -> Ordering

(<) :: Key -> Key -> Bool

(<=) :: Key -> Key -> Bool

(>) :: Key -> Key -> Bool

(>=) :: Key -> Key -> Bool

max :: Key -> Key -> Key

min :: Key -> Key -> Key

ByteArrayAccess Key

Defined in Authorize.Macaroon.Types

Methods

length :: Key -> Int

withByteArray :: Key -> (Ptr p -> IO a) -> IO a

copyByteArrayToPtr :: Key -> Ptr p -> IO ()

type Location = ByteString

Core interface

createMacaroon

Arguments

:: Key

signing key

-> MacaroonId

identifier for this macaroon

-> Location

location hint

-> [ByteString]

first party caveats to include

-> Macaroon

Mint a macaroon

addFirstPartyCaveat :: Macaroon -> ByteString -> Macaroon

A first party caveat corresponds to a proposition that might or might not hold in the validation context of the macaroon.

addThirdPartyCaveat

Arguments

:: Macaroon

-> Key

third party key

-> Location

-> ByteString

-> IO Macaroon

A third party caveat links the macaroon to an additional key, and must be discharged by a supplementary macaroon in order to validate.

extractThirdPartyCaveats :: Macaroon -> [ByteString]

Get the third party caveats encoded in the macaroon

sealMacaroon

Arguments

:: Macaroon

root macaroon

-> [Macaroon]

discharge macaroons

-> SealedMacaroon

In order to secure discharge macaroons, they must be bound to the root macaroon before transmission.

createDischargeMacaroon

Arguments

:: Key

discharge key

-> Location

location hint

-> ByteString

caveat to discharge

-> [ByteString]

additional first party caveats to include

-> Macaroon

Mint a macaroon discharging a third party caveat

verify

Arguments

:: Key

root key

-> SealedMacaroon

-> Either VerificationFailure (Set ByteString)

Macaroon verification succeeds by producing a set of first party caveats requiring further validation.

data VerificationFailure

Constructors

InvalidSignature MacaroonId

InvalidBinding MacaroonId

MissingDischargeMacaroon MacaroonId

ExcessDischarges [Macaroon]

ThirdPartyKeyError MacaroonId

Instances

Show VerificationFailure

Defined in Authorize.Macaroon.Verify

Methods

showsPrec :: Int -> VerificationFailure -> ShowS

show :: VerificationFailure -> String

showList :: [VerificationFailure] -> ShowS

Eq VerificationFailure

Defined in Authorize.Macaroon.Verify

Methods

(==) :: VerificationFailure -> VerificationFailure -> Bool

(/=) :: VerificationFailure -> VerificationFailure -> Bool