-- Hoogle documentation, generated by Haddock -- See Hoogle, http://www.haskell.org/hoogle/ -- | Platform-Agnostic Security Tokens -- -- Haskell implementation of PASETO (Platform-Agnostic Security Tokens). -- . The recommended entry point for this library is -- Crypto.Paseto. . For more information about this library and a -- rundown on how to use it, check out the README on GitHub. @package paseto @version 0.1.0.0 -- | P384 ECDSA cryptographic keys. module Crypto.Paseto.Keys.V3 -- | Elliptic curve SEC_p384r1. curveP384 :: Curve -- | ECDSA private key for curve SEC_p384r1. -- -- Note that this type's Eq instance performs a constant-time -- equality check. data PrivateKeyP384 pattern PrivateKeyP384 :: PrivateKey -> PrivateKeyP384 unPrivateKeyP384 :: PrivateKeyP384 -> PrivateKey -- | Construct a private key for curve SEC_p384r1. mkPrivateKeyP384 :: PrivateKey -> Maybe PrivateKeyP384 -- | Generate a private key for curve SEC_p384r1. generatePrivateKeyP384 :: IO PrivateKeyP384 -- | Encode a private key into its binary format as defined in RFC -- 5915, i.e. the privateKey field described in section -- 3. encodePrivateKeyP384 :: PrivateKeyP384 -> ScrubbedBytes -- | Error decoding a scalar value. data ScalarDecodingError -- | Invalid scalar length. ScalarDecodingInvalidLengthError :: !Int -> !Int -> ScalarDecodingError -- | Decoded scalar is invalid for the curve. ScalarDecodingInvalidError :: ScalarDecodingError -- | Render a ScalarDecodingError as Text. renderScalarDecodingError :: ScalarDecodingError -> Text -- | Decode a private key from its binary format as defined in RFC -- 5915, i.e. the privateKey field described in section -- 3. decodePrivateKeyP384 :: ScrubbedBytes -> Either ScalarDecodingError PrivateKeyP384 -- | Generate a random scalar on the curve SEC_p384r1. generateScalarP384 :: IO Integer -- | Whether a scalar is valid on the curve SEC_p384r1. isScalarValidP384 :: Integer -> Bool -- | ECDSA public key for curve SEC_p384r1. data PublicKeyP384 pattern PublicKeyP384 :: PublicKey -> PublicKeyP384 unPublicKeyP384 :: PublicKeyP384 -> PublicKey -- | Construct a public key for curve SEC_p384r1. mkPublicKeyP384 :: PublicKey -> Maybe PublicKeyP384 -- | Construct the PublicKeyP384 which corresponds to a given -- PrivateKeyP384. fromPrivateKeyP384 :: PrivateKeyP384 -> PublicKeyP384 -- | Encode an elliptic curve point into its compressed binary format as -- defined by SEC 1 and RFC 5480 section 2.2. encodePublicKeyP384 :: PublicKeyP384 -> ByteString -- | Error decoding a compressed elliptic curve point. data CompressedPointDecodingError -- | Prefix is not either of the expected values (0x02 or -- 0x03). CompressedPointDecodingInvalidPrefixError :: !Word8 -> CompressedPointDecodingError -- | Length of the provided compressed point is invalid. CompressedPointDecodingInvalidLengthError :: !Int -> !Int -> CompressedPointDecodingError -- | Failed to find the modular square root of a value. CompressedPointDecodingModularSquareRootError :: CompressedPointDecodingError -- | Point is invalid for the curve. CompressedPointDecodingInvalidPointError :: !Point -> CompressedPointDecodingError -- | Error decoding an uncompressed elliptic curve point. data UncompressedPointDecodingError -- | Prefix is not the expected value (0x04). UncompressedPointDecodingInvalidPrefixError :: !Word8 -> UncompressedPointDecodingError -- | Length of the provided point is invalid. UncompressedPointDecodingInvalidLengthError :: !Int -> !Int -> UncompressedPointDecodingError -- | Point is invalid for the curve. UncompressedPointDecodingInvalidPointError :: !Point -> UncompressedPointDecodingError -- | Error decoding a public key for curve SEC_p384r1. data PublicKeyP384DecodingError -- | Error decoding a compressed public key. PublicKeyP384DecodingCompressedError :: !CompressedPointDecodingError -> PublicKeyP384DecodingError -- | Error decoding an uncompressed public key. PublicKeyP384DecodingUncompressedError :: !UncompressedPointDecodingError -> PublicKeyP384DecodingError -- | Render a PublicKeyP384DecodingError as Text. renderPublicKeyP384DecodingError :: PublicKeyP384DecodingError -> Text -- | Decode a public key from either its compressed or uncompressed binary -- format as defined by SEC 1 and RFC 5480 section 2.2. decodePublicKeyP384 :: ByteString -> Either PublicKeyP384DecodingError PublicKeyP384 instance GHC.Show.Show Crypto.Paseto.Keys.V3.PrivateKeyP384 instance GHC.Classes.Eq Crypto.Paseto.Keys.V3.PublicKeyP384 instance GHC.Show.Show Crypto.Paseto.Keys.V3.PublicKeyP384 instance GHC.Classes.Eq Crypto.Paseto.Keys.V3.PublicKeyP384DecodingError instance GHC.Show.Show Crypto.Paseto.Keys.V3.PublicKeyP384DecodingError instance GHC.Classes.Eq Crypto.Paseto.Keys.V3.PrivateKeyP384 module Crypto.Paseto.Mode -- | PASETO protocol version. data Version -- | Version 3. Modern NIST cryptography. V3 :: Version -- | Version 4. Modern Sodium (libsodium) cryptography. V4 :: Version -- | PASETO token purpose. data Purpose -- | Shared-key authenticated encryption. Local :: Purpose -- | Public-key digital signatures (not encrypted). Public :: Purpose instance GHC.Classes.Eq Crypto.Paseto.Mode.Version instance GHC.Show.Show Crypto.Paseto.Mode.Version instance GHC.Classes.Eq Crypto.Paseto.Mode.Purpose instance GHC.Show.Show Crypto.Paseto.Mode.Purpose -- | PASETO Pre-Authentication Encoding (PAE). module Crypto.Paseto.PreAuthenticationEncoding -- | Encode a multipart message using Pre-Authentication Encoding -- (PAE) as defined in the PASETO spec. encode :: [ByteString] -> ByteString -- | Error decoding a PAE-encoded message. newtype DecodingError DecodingError :: (ByteString, ByteOffset, String) -> DecodingError -- | Decode a multipart message which has been encoded using -- Pre-Authentication Encoding (PAE) as defined in the PASETO -- spec. decode :: ByteString -> Either DecodingError [ByteString] instance GHC.Classes.Eq Crypto.Paseto.PreAuthenticationEncoding.DecodingError instance GHC.Show.Show Crypto.Paseto.PreAuthenticationEncoding.DecodingError module Crypto.Paseto.ScrubbedBytes -- | Simple wrapper around a 32-byte (256-bit) ScrubbedBytes value. -- -- Note that this type's Eq instance performs a constant-time -- equality check. data ScrubbedBytes32 pattern ScrubbedBytes32 :: ScrubbedBytes -> ScrubbedBytes32 -- | Construct a 32-byte (256-bit) ScrubbedBytes value from an array -- of bytes. mkScrubbedBytes32 :: ByteArrayAccess b => b -> Maybe ScrubbedBytes32 -- | Construct a ScrubbedBytes32 value from a SizedByteArray -- of ScrubbedBytes. fromSizedBytes :: SizedByteArray 32 ScrubbedBytes -> ScrubbedBytes32 -- | Convert a ScrubbedBytes32 value to ScrubbedBytes. toBytes :: ScrubbedBytes32 -> ScrubbedBytes -- | Convert a ScrubbedBytes32 value to a SizedByteArray of -- ScrubbedBytes. toSizedBytes :: ScrubbedBytes32 -> SizedByteArray 32 ScrubbedBytes -- | Randomly generate a ScrubbedBytes32 value. generateScrubbedBytes32 :: IO ScrubbedBytes32 instance Data.ByteArray.Types.ByteArrayAccess Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance Basement.NormalForm.NormalForm Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance GHC.Classes.Ord Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance GHC.Classes.Eq Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance GHC.Show.Show Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance Control.DeepSeq.NFData Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 instance Data.ByteArray.Sized.ByteArrayN 32 Crypto.Paseto.ScrubbedBytes.ScrubbedBytes32 -- | PASETO cryptographic keys. module Crypto.Paseto.Keys -- | Symmetric key. -- -- Note that this type's Eq instance performs a constant-time -- equality check. data SymmetricKey v -- | Version 3 symmetric key. [SymmetricKeyV3] :: !ScrubbedBytes32 -> SymmetricKey V3 -- | Version 4 symmetric key. [SymmetricKeyV4] :: !ScrubbedBytes32 -> SymmetricKey V4 -- | Get the raw bytes associated with a symmetric key. symmetricKeyToBytes :: SymmetricKey v -> ScrubbedBytes -- | Construct a version 3 symmetric key from bytes. -- -- If the provided byte string does not have a length of 32 -- (256 bits), Nothing is returned. bytesToSymmetricKeyV3 :: ScrubbedBytes -> Maybe (SymmetricKey V3) -- | Construct a version 4 symmetric key from bytes. -- -- If the provided byte string does not have a length of 32 -- (256 bits), Nothing is returned. bytesToSymmetricKeyV4 :: ScrubbedBytes -> Maybe (SymmetricKey V4) -- | Randomly generate a version 3 symmetric key. generateSymmetricKeyV3 :: IO (SymmetricKey V3) -- | Randomly generate a version 4 symmetric key. generateSymmetricKeyV4 :: IO (SymmetricKey V4) -- | Signing key (also known as a private/secret key). -- -- Note that this type's Eq instance performs a constant-time -- equality check. data SigningKey v -- | Version 3 signing key. [SigningKeyV3] :: !PrivateKeyP384 -> SigningKey V3 -- | Version 3 signing key. [SigningKeyV4] :: !SecretKey -> SigningKey V4 -- | Get the raw bytes associated with a signing key. signingKeyToBytes :: SigningKey v -> ScrubbedBytes -- | Construct a version 3 signing key from bytes. bytesToSigningKeyV3 :: ScrubbedBytes -> Either ScalarDecodingError (SigningKey V3) -- | Construct a version 4 signing key from bytes. bytesToSigningKeyV4 :: ScrubbedBytes -> Maybe (SigningKey V4) -- | Randomly generate a version 3 signing key. generateSigningKeyV3 :: IO (SigningKey V3) -- | Randomly generate a version 4 signing key. generateSigningKeyV4 :: IO (SigningKey V4) -- | Verification key (also known as a public key). data VerificationKey v -- | Version 3 verification key. [VerificationKeyV3] :: !PublicKeyP384 -> VerificationKey V3 -- | Version 4 verification key. [VerificationKeyV4] :: !PublicKey -> VerificationKey V4 -- | Get the raw bytes associated with a verification key. verificationKeyToBytes :: VerificationKey v -> ByteString -- | Construct a version 3 verification key from bytes. -- -- The input ByteString is expected to be formatted as either a -- compressed or uncompressed elliptic curve public key as defined by -- SEC 1 and RFC 5480 section 2.2. bytesToVerificationKeyV3 :: ByteString -> Either PublicKeyP384DecodingError (VerificationKey V3) -- | Construct a version 4 verification key from bytes. bytesToVerificationKeyV4 :: ByteString -> Maybe (VerificationKey V4) -- | Get the VerificationKey which corresponds to a given -- SigningKey. fromSigningKey :: SigningKey v -> VerificationKey v instance GHC.Classes.Eq (Crypto.Paseto.Keys.VerificationKey v) instance GHC.Classes.Eq (Crypto.Paseto.Keys.SigningKey v) instance GHC.Classes.Eq (Crypto.Paseto.Keys.SymmetricKey v) module Crypto.Paseto.Token -- | Footer consisting of unencrypted free-form data. -- -- The footer's contents may be JSON or some other structured data, but -- it doesn't have to be. -- -- When a PASETO token is constructed, the footer is authenticated, but -- not encrypted (i.e. its integrity is protected, but it is not made -- confidential). In authenticated encryption schemes, this is referred -- to as "associated data". -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype Footer Footer :: ByteString -> Footer [unFooter] :: Footer -> ByteString -- | Unencrypted authenticated data which is not stored in the PASETO -- token. -- -- When a PASETO token is constructed, the implicit assertion is -- authenticated, but it is not stored in the token. This is useful if -- one wants to associate some data that should remain confidential. -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype ImplicitAssertion ImplicitAssertion :: ByteString -> ImplicitAssertion [unImplicitAssertion] :: ImplicitAssertion -> ByteString -- | Raw PASETO token payload. -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype Payload Payload :: ByteString -> Payload [unPayload] :: Payload -> ByteString -- | PASETO token parameterized by its protocol Version and -- Purpose. data Token v p -- | PASETO version 3 local token. [TokenV3Local] :: !Payload -> !Maybe Footer -> Token V3 Local -- | PASETO version 3 public token. [TokenV3Public] :: !Payload -> !Maybe Footer -> Token V3 Public -- | PASETO version 4 local token. [TokenV4Local] :: !Payload -> !Maybe Footer -> Token V4 Local -- | PASETO version 4 public token. [TokenV4Public] :: !Payload -> !Maybe Footer -> Token V4 Public -- | Some kind of PASETO token. data SomeToken SomeTokenV3Local :: !Token V3 Local -> SomeToken SomeTokenV3Public :: !Token V3 Public -> SomeToken SomeTokenV4Local :: !Token V4 Local -> SomeToken SomeTokenV4Public :: !Token V4 Public -> SomeToken -- | Convert a Token to a SomeToken. toSomeToken :: Token v p -> SomeToken instance GHC.Show.Show Crypto.Paseto.Token.Footer instance GHC.Show.Show Crypto.Paseto.Token.ImplicitAssertion instance GHC.Show.Show Crypto.Paseto.Token.Payload instance GHC.Classes.Eq Crypto.Paseto.Token.SomeToken instance GHC.Show.Show Crypto.Paseto.Token.SomeToken instance GHC.Show.Show (Crypto.Paseto.Token.Token v p) instance GHC.Classes.Eq (Crypto.Paseto.Token.Token v p) instance GHC.Classes.Eq Crypto.Paseto.Token.Payload instance GHC.Classes.Eq Crypto.Paseto.Token.ImplicitAssertion instance GHC.Classes.Eq Crypto.Paseto.Token.Footer -- | PASETO token claim. module Crypto.Paseto.Token.Claim -- | Issuer of a token. newtype Issuer Issuer :: Text -> Issuer [unIssuer] :: Issuer -> Text -- | Subject of a token. newtype Subject Subject :: Text -> Subject [unSubject] :: Subject -> Text -- | Recipient for which a token is intended. newtype Audience Audience :: Text -> Audience [unAudience] :: Audience -> Text -- | Time after which a token expires. newtype Expiration Expiration :: UTCTime -> Expiration [unExpiration] :: Expiration -> UTCTime -- | Render an Expiration as Text. renderExpiration :: Expiration -> Text -- | Time from which a token should be considered valid. newtype NotBefore NotBefore :: UTCTime -> NotBefore [unNotBefore] :: NotBefore -> UTCTime -- | Render a NotBefore as Text. renderNotBefore :: NotBefore -> Text -- | Time at which a token was issued. newtype IssuedAt IssuedAt :: UTCTime -> IssuedAt [unIssuedAt] :: IssuedAt -> UTCTime -- | Render an IssuedAt as Text. renderIssuedAt :: IssuedAt -> Text -- | Token identifier. newtype TokenIdentifier TokenIdentifier :: Text -> TokenIdentifier [unTokenIdentifier] :: TokenIdentifier -> Text -- | Token claim key. data ClaimKey pattern IssuerClaimKey :: ClaimKey pattern SubjectClaimKey :: ClaimKey pattern AudienceClaimKey :: ClaimKey pattern ExpirationClaimKey :: ClaimKey pattern NotBeforeClaimKey :: ClaimKey pattern IssuedAtClaimKey :: ClaimKey pattern TokenIdentifierClaimKey :: ClaimKey pattern CustomClaimKey :: UnregisteredClaimKey -> ClaimKey -- | Render a ClaimKey as Text. renderClaimKey :: ClaimKey -> Text -- | Parse a ClaimKey from Text. parseClaimKey :: Text -> ClaimKey -- | Registered claims as defined by the PASETO specification. registeredClaimKeys :: Set ClaimKey -- | Unregistered claim key. data UnregisteredClaimKey -- | Construct an unregistered claim key. -- -- If the provided Text key matches that of a registered claim -- (registeredClaimKeys), this function will return -- Nothing. mkUnregisteredClaimKey :: Text -> Maybe UnregisteredClaimKey -- | Render an UnregisteredClaimKey as Text. renderUnregisteredClaimKey :: UnregisteredClaimKey -> Text -- | Token claim. data Claim IssuerClaim :: !Issuer -> Claim SubjectClaim :: !Subject -> Claim AudienceClaim :: !Audience -> Claim ExpirationClaim :: !Expiration -> Claim NotBeforeClaim :: !NotBefore -> Claim IssuedAtClaim :: !IssuedAt -> Claim TokenIdentifierClaim :: !TokenIdentifier -> Claim CustomClaim :: !UnregisteredClaimKey -> !Value -> Claim -- | Get the JSON object key which corresponds to a Claim. claimKey :: Claim -> ClaimKey claimToPair :: Claim -> Pair claimFromJson :: Key -> Value -> Parser Claim instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.Issuer instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.Issuer instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.Issuer instance GHC.Show.Show Crypto.Paseto.Token.Claim.Issuer instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.Subject instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.Subject instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.Subject instance GHC.Show.Show Crypto.Paseto.Token.Claim.Subject instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.Audience instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.Audience instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.Audience instance GHC.Show.Show Crypto.Paseto.Token.Claim.Audience instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.Expiration instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.Expiration instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.Expiration instance GHC.Show.Show Crypto.Paseto.Token.Claim.Expiration instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.NotBefore instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.NotBefore instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.NotBefore instance GHC.Show.Show Crypto.Paseto.Token.Claim.NotBefore instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.IssuedAt instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.IssuedAt instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.IssuedAt instance GHC.Show.Show Crypto.Paseto.Token.Claim.IssuedAt instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claim.TokenIdentifier instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claim.TokenIdentifier instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.TokenIdentifier instance GHC.Show.Show Crypto.Paseto.Token.Claim.TokenIdentifier instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.ClaimKey instance GHC.Show.Show Crypto.Paseto.Token.Claim.ClaimKey instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.UnregisteredClaimKey instance GHC.Show.Show Crypto.Paseto.Token.Claim.UnregisteredClaimKey instance GHC.Classes.Eq Crypto.Paseto.Token.Claim.Claim instance GHC.Show.Show Crypto.Paseto.Token.Claim.Claim instance GHC.Classes.Ord Crypto.Paseto.Token.Claim.ClaimKey -- | Collection of PASETO token claims. -- -- It is recommended to import this module qualified since it contains -- functions which may conflict with those in Prelude and other -- container implementations such as Data.Map. -- -- For example: -- -- 
--   import Crypto.Paseto.Token.Claims (Claims)
--   import qualified Crypto.Paseto.Token.Claims as Claims
--
module Crypto.Paseto.Token.Claims -- | Collection of Claims. data Claims -- | Empty collection of claims. empty :: Claims -- | Construct a collection of claims with a single element. singleton :: Claim -> Claims -- | Insert a Claim into a collection of Claims. -- -- Note that if a claim with the same key is already present, it is -- replaced with the provided claim. insert :: Claim -> Claims -> Claims -- | Delete a claim from the collection. delete :: ClaimKey -> Claims -> Claims -- | Lookup the issuer claim. lookupIssuer :: Claims -> Maybe Issuer -- | Lookup the subject claim. lookupSubject :: Claims -> Maybe Subject -- | Lookup the audience claim. lookupAudience :: Claims -> Maybe Audience -- | Lookup the expiration claim. lookupExpiration :: Claims -> Maybe Expiration -- | Lookup the "not before" claim. lookupNotBefore :: Claims -> Maybe NotBefore -- | Lookup the "issued at" claim. lookupIssuedAt :: Claims -> Maybe IssuedAt -- | Lookup the token identifier claim. lookupTokenIdentifier :: Claims -> Maybe TokenIdentifier -- | Lookup a custom unregistered claim. lookupCustom :: UnregisteredClaimKey -> Claims -> Maybe Value -- | Whether a collection of claims is empty. null :: Claims -> Bool -- | Size of a collection of claims. size :: Claims -> Int -- | Convert a collection of Claims to a list of Claims. toList :: Claims -> [Claim] -- | Convert a list of Claims to a collection of Claims. -- -- Note that if the provided list contains more than one value for the -- same claim, the last value for that claim is retained. fromList :: [Claim] -> Claims instance GHC.Base.Monoid Crypto.Paseto.Token.Claims.Claims instance GHC.Base.Semigroup Crypto.Paseto.Token.Claims.Claims instance GHC.Classes.Eq Crypto.Paseto.Token.Claims.Claims instance GHC.Show.Show Crypto.Paseto.Token.Claims.Claims instance Data.Aeson.Types.ToJSON.ToJSON Crypto.Paseto.Token.Claims.Claims instance Data.Aeson.Types.FromJSON.FromJSON Crypto.Paseto.Token.Claims.Claims -- | Implementation of PASETO version 4 (modern Sodium -- cryptography). -- -- Note that we're not actually using libsodium itself in this -- module but, instead, the equivalent algorithm implementations that are -- available in crypton. module Crypto.Paseto.Protocol.V4 v4LocalTokenHeader :: ByteString -- | PASETO version 4 encryption. -- -- This is an authenticated encryption with associated data (AEAD) -- algorithm which combines the XChaCha20 stream cipher with the -- Blake2b message authentication code. -- -- Note that this function essentially just calls encryptPure with -- a random 32-byte nonce generated from the operating system's CSPRNG. encrypt :: SymmetricKey V4 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> IO (Token V4 Local) -- | Pure variant of encrypt. -- -- For typical usage, please use encrypt. encryptPure :: ByteString -> SymmetricKey V4 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> Token V4 Local -- | PASETO version 4 decryption error. data DecryptionError -- | Invalid token footer. DecryptionInvalidFooterError :: !Maybe Footer -> !Maybe Footer -> DecryptionError -- | Invalid nonce size. DecryptionInvalidNonceSizeError :: !Int -> DecryptionError -- | Invalid Blake2b message authentication code size. DecryptionInvalidMacSizeError :: !Int -> DecryptionError -- | Invalid Blake2b message authenticartion code. DecryptionInvalidMacError :: !ByteString -> !ByteString -> DecryptionError -- | Error deserializing a decrypted collection of claims as JSON. DecryptionClaimsDeserializationError :: !String -> DecryptionError -- | Render a DecryptionError as Text. renderDecryptionError :: DecryptionError -> Text -- | PASETO version 4 decryption. decrypt :: SymmetricKey V4 -> Token V4 Local -> Maybe Footer -> Maybe ImplicitAssertion -> Either DecryptionError Claims v4PublicTokenHeader :: ByteString -- | PASETO version 4 cryptographic signing. -- -- This implementation produces a token which is signed using -- Ed25519. sign :: SigningKey V4 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> Token V4 Public -- | PASETO version 4 signature verification error. data VerificationError -- | Invalid token footer. VerificationInvalidFooterError :: !Maybe Footer -> !Maybe Footer -> VerificationError -- | CryptoError that occurred during verification. VerificationCryptoError :: !CryptoError -> VerificationError -- | Signature verification failed. VerificationInvalidSignatureError :: VerificationError -- | Error deserializing a verified collection of claims as JSON. VerificationClaimsDeserializationError :: !String -> VerificationError -- | Render a VerificationError as Text. renderVerificationError :: VerificationError -> Text -- | PASETO version 4 cryptographic signature verification. verify :: VerificationKey V4 -> Token V4 Public -> Maybe Footer -> Maybe ImplicitAssertion -> Either VerificationError Claims instance GHC.Classes.Eq Crypto.Paseto.Protocol.V4.DecryptionError instance GHC.Show.Show Crypto.Paseto.Protocol.V4.DecryptionError instance GHC.Classes.Eq Crypto.Paseto.Protocol.V4.VerificationError instance GHC.Show.Show Crypto.Paseto.Protocol.V4.VerificationError -- | Parsers for PASETO tokens according to the message format -- defined in the specification. -- -- Note that the parsers exported from this module do not perform -- any kind of token validation, cryptographic or otherwise. These -- parsers simply ensure that the input looks like a well-formed -- token. module Crypto.Paseto.Token.Parser -- | Parse a version 3 local PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV3Local :: Text -> Either ParseError (Token V3 Local) -- | Parse a version 3 public PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV3Public :: Text -> Either ParseError (Token V3 Public) -- | Parse a version 4 local PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV4Local :: Text -> Either ParseError (Token V4 Local) -- | Parse a version 4 public PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV4Public :: Text -> Either ParseError (Token V4 Public) -- | Parse some kind of PASETO token from human-readable text according to -- the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseSomeToken :: Text -> Either ParseError SomeToken -- | Parse a Version from its string representation. pVersion :: Parser Version -- | Parse the Version string v3. pVersionV3 :: Parser Version -- | Parse the Version string v4. pVersionV4 :: Parser Version -- | Parse a Purpose from its string representation. pPurpose :: Parser Purpose -- | Parse the Purpose string local. pPurposeLocal :: Parser Purpose -- | Parse the Purpose string public. pPurposePublic :: Parser Purpose -- | Parse a Payload from its string representation. pPayload :: Parser Payload -- | Parse a Footer from its string representation. pFooter :: Parser Footer -- | Parse a Payload along with an optional Footer. pPayloadAndFooter :: Parser (Payload, Maybe Footer) -- | Parse the parts of a PASETO token: version, purpose, payload, and an -- optional footer. pTokenParts :: Parser Version -> Parser Purpose -> Parser (Version, Purpose, Payload, Maybe Footer) -- | Parse a version 3 local PASETO token from its string representation. -- -- Accepted token format: -- -- -- -- Both the payload and optional footer are -- base64url-encoded values (unpadded). pTokenV3Local :: Parser (Token V3 Local) -- | Parse a version 3 public PASETO token from its string representation. -- -- Accepted token format: -- -- -- -- Both the payload and optional footer are -- base64url-encoded values (unpadded). pTokenV3Public :: Parser (Token V3 Public) -- | Parse a version 4 local PASETO token from its string representation. -- -- Accepted token format: -- -- -- -- Both the payload and optional footer are -- base64url-encoded values (unpadded). pTokenV4Local :: Parser (Token V4 Local) -- | Parse a version 4 public PASETO token from its string representation. -- -- Accepted token format: -- -- -- -- Both the payload and optional footer are -- base64url-encoded values (unpadded). pTokenV4Public :: Parser (Token V4 Public) -- | Parse some kind of PASETO token from its string representation. -- -- PASETO token format: -- -- -- -- Acceptable values for version are v3 and -- v4. v1 and v2 are deprecated, so they're -- not supported. -- -- Acceptable values for purpose are local and -- public. -- -- Both the payload and optional footer are -- base64url-encoded values (unpadded). pSomeToken :: Parser SomeToken -- | PASETO token claim validation. module Crypto.Paseto.Token.Validation -- | Validation error. data ValidationError -- | Expected claim does not exist. ValidationClaimNotFoundError :: !ClaimKey -> ValidationError -- | Token claim is invalid. ValidationInvalidClaimError :: !ClaimKey -> !Text -> !Text -> ValidationError -- | Token is expired. ValidationExpirationError :: !Expiration -> ValidationError -- | Token's IssuedAt time is in the future. ValidationIssuedAtError :: !IssuedAt -> ValidationError -- | Token is not yet valid as its NotBefore time is in the future. ValidationNotBeforeError :: !NotBefore -> ValidationError -- | Custom validation error. ValidationCustomError :: !Text -> ValidationError -- | Render a ValidationError as Text. renderValidationError :: ValidationError -> Text -- | Render a non-empty list of ValidationErrors as Text. renderValidationErrors :: NonEmpty ValidationError -> Text -- | Token claim validation rule. newtype ValidationRule ValidationRule :: (Claims -> Either ValidationError ()) -> ValidationRule [unValidationRule] :: ValidationRule -> Claims -> Either ValidationError () -- | Whether a claim must exist. newtype ClaimMustExist ClaimMustExist :: Bool -> ClaimMustExist -- | Validate that a token is intended for a given audience. forAudience :: Audience -> ValidationRule -- | Validate a token's identifier. identifiedBy :: TokenIdentifier -> ValidationRule -- | Validate a token's issuer. issuedBy :: Issuer -> ValidationRule -- | Validate that a token is not expired at the given time. -- -- That is, if the ExpirationClaim is present, check that it isn't -- in the past (relative to the given time). notExpired :: UTCTime -> ValidationRule -- | Validate the subject of a token. subject :: Subject -> ValidationRule -- | Validate that a token is valid at the given time. -- -- This involves the following checks (relative to the given time): -- -- validAt :: UTCTime -> ValidationRule -- | Validate that a custom claim is equal to the given value. customClaimEq :: ClaimMustExist -> UnregisteredClaimKey -> Value -> ValidationRule -- | Get a list of recommended default validation rules. -- -- At the moment, the only default rule is checking validAt for -- the current system time (getCurrentTime). getDefaultValidationRules :: IO [ValidationRule] -- | Validate a list of rules against a collection of claims. -- -- This function will run through all of the provided validation rules -- and collect all of the errors encountered, if any. If there are no -- validation errors, Right () is returned. validate :: [ValidationRule] -> Claims -> Either (NonEmpty ValidationError) () -- | Validate a collection of claims against the default validation rules -- (getDefaultValidationRules). validateDefault :: Claims -> IO (Either (NonEmpty ValidationError) ()) instance GHC.Classes.Eq Crypto.Paseto.Token.Validation.ValidationError instance GHC.Show.Show Crypto.Paseto.Token.Validation.ValidationError -- | Implementation of PASETO version 3 (modern NIST cryptography). module Crypto.Paseto.Protocol.V3 v3LocalTokenHeader :: ByteString -- | PASETO version 3 encryption error. data EncryptionError -- | CryptoError that occurred during encryption. EncryptionCryptoError :: !CryptoError -> EncryptionError -- | Initialization vector is of an invalid size. EncryptionInvalidInitializationVectorSizeError :: !Int -> !Int -> EncryptionError -- | Render an EncryptionError as Text. renderEncryptionError :: EncryptionError -> Text -- | PASETO version 3 encryption. -- -- This is an authenticated encryption with associated data (AEAD) -- algorithm which combines the AES-256-CTR block cipher with -- the HMAC-SHA384 message authentication code. -- -- Note that this function essentially just calls encryptPure with -- a random 32-byte nonce generated from the operating system's CSPRNG. encrypt :: SymmetricKey V3 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> ExceptT EncryptionError IO (Token V3 Local) -- | Pure variant of encrypt. -- -- For typical usage, please use encrypt. encryptPure :: ByteString -> SymmetricKey V3 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> Either EncryptionError (Token V3 Local) -- | PASETO version 3 decryption error. data DecryptionError -- | Invalid token footer. DecryptionInvalidFooterError :: !Maybe Footer -> !Maybe Footer -> DecryptionError -- | Invalid HKDF-HMAC-SHA384 nonce size. DecryptionInvalidHkdfNonceSizeError :: !Int -> DecryptionError -- | Invalid HMAC-SHA384 message authentication code size. DecryptionInvalidHmacSizeError :: !Int -> DecryptionError -- | Invalid HMAC-SHA384 message authentication code. DecryptionInvalidHmacError :: !ByteString -> !ByteString -> DecryptionError -- | CryptoError that occurred during decryption. DecryptionCryptoError :: !CryptoError -> DecryptionError -- | Initialization vector is of an invalid size. DecryptionInvalidInitializationVectorSizeError :: !Int -> !Int -> DecryptionError -- | Error deserializing a decrypted collection of claims as JSON. DecryptionClaimsDeserializationError :: !String -> DecryptionError -- | Render a DecryptionError as Text. renderDecryptionError :: DecryptionError -> Text -- | PASETO version 3 decryption. decrypt :: SymmetricKey V3 -> Token V3 Local -> Maybe Footer -> Maybe ImplicitAssertion -> Either DecryptionError Claims v3PublicTokenHeader :: ByteString -- | PASETO version 3 cryptographic signing error. data SigningError -- | Random number, k, is zero. SigningKIsZeroError :: SigningError -- | Render a SigningError as Text. renderSigningError :: SigningError -> Text -- | PASETO version 3 cryptographic signing. -- -- This implementation produces a token which is signed using -- ECDSA over P-384 and SHA-384. -- -- Note that this function essentially just calls signPure with a -- randomly-generated scalar multiple, k. sign :: SigningKey V3 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> ExceptT SigningError IO (Token V3 Public) -- | Pure variant of sign. -- -- For typical usage, please use sign. signPure :: Integer -> SigningKey V3 -> Claims -> Maybe Footer -> Maybe ImplicitAssertion -> Either SigningError (Token V3 Public) -- | PASETO version 3 signature verification error. data VerificationError -- | Invalid token footer. VerificationInvalidFooterError :: !Maybe Footer -> !Maybe Footer -> VerificationError -- | Signature size is invalid. VerificationInvalidSignatureSizeError :: VerificationError -- | Signature verification failed. VerificationInvalidSignatureError :: VerificationError -- | Error deserializing a verified collection of claims as JSON. VerificationClaimsDeserializationError :: !String -> VerificationError -- | Render a VerificationError as Text. renderVerificationError :: VerificationError -> Text -- | PASETO version 3 cryptographic signature verification. verify :: VerificationKey V3 -> Token V3 Public -> Maybe Footer -> Maybe ImplicitAssertion -> Either VerificationError Claims instance GHC.Classes.Eq Crypto.Paseto.Protocol.V3.EncryptionError instance GHC.Show.Show Crypto.Paseto.Protocol.V3.EncryptionError instance GHC.Classes.Eq Crypto.Paseto.Protocol.V3.DecryptionError instance GHC.Show.Show Crypto.Paseto.Protocol.V3.DecryptionError instance GHC.Classes.Eq Crypto.Paseto.Protocol.V3.SigningError instance GHC.Show.Show Crypto.Paseto.Protocol.V3.SigningError instance GHC.Classes.Eq Crypto.Paseto.Protocol.V3.VerificationError instance GHC.Show.Show Crypto.Paseto.Protocol.V3.VerificationError -- | PASETO token encoding and decoding in accordance with the message -- format defined in the specification. module Crypto.Paseto.Token.Encoding -- | Encode a PASETO token as human-readable text according to the -- message format defined in the specification. encode :: Token v p -> Text -- | Encode a PASETO token as human-readable text according to the -- message format defined in the specification. encodeSomeToken :: SomeToken -> Text -- | Common error decoding a PASETO token. data CommonDecodingError -- | Error parsing the token. CommonDecodingParseError :: !ParseError -> CommonDecodingError -- | Token claims validation error. CommonDecodingClaimsValidationError :: !NonEmpty ValidationError -> CommonDecodingError -- | Render a CommonDecodingError as Text. renderCommonDecodingError :: CommonDecodingError -> Text -- | Error decoding a version 3 local PASETO token. data V3LocalDecodingError -- | Common decoding error. V3LocalDecodingCommonError :: !CommonDecodingError -> V3LocalDecodingError -- | Decryption error. V3LocalDecodingDecryptionError :: !DecryptionError -> V3LocalDecodingError -- | Render a V3LocalDecodingError as Text. renderV3LocalDecodingError :: V3LocalDecodingError -> Text -- | Parse, decrypt, and validate a version 3 local PASETO -- token. decodeTokenV3Local :: SymmetricKey V3 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V3LocalDecodingError (ValidatedToken V3 Local) -- | Error decoding a version 3 public PASETO token. data V3PublicDecodingError -- | Common decoding error. V3PublicDecodingCommonError :: !CommonDecodingError -> V3PublicDecodingError -- | Cryptographic signature verification error. V3PublicDecodingVerificationError :: !VerificationError -> V3PublicDecodingError -- | Render a V3PublicDecodingError as Text. renderV3PublicDecodingError :: V3PublicDecodingError -> Text -- | Parse, verify, and validate a version 3 public PASETO -- token. decodeTokenV3Public :: VerificationKey V3 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V3PublicDecodingError (ValidatedToken V3 Public) -- | Error decoding a version 4 local PASETO token. data V4LocalDecodingError -- | Common decoding error. V4LocalDecodingCommonError :: !CommonDecodingError -> V4LocalDecodingError -- | Decryption error. V4LocalDecodingDecryptionError :: !DecryptionError -> V4LocalDecodingError -- | Render a V4LocalDecodingError as Text. renderV4LocalDecodingError :: V4LocalDecodingError -> Text -- | Parse, decrypt, and validate a version 4 local PASETO -- token. decodeTokenV4Local :: SymmetricKey V4 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V4LocalDecodingError (ValidatedToken V4 Local) -- | Error decoding a version 4 public PASETO token. data V4PublicDecodingError -- | Common decoding error. V4PublicDecodingCommonError :: !CommonDecodingError -> V4PublicDecodingError -- | Cryptographic signature verification error. V4PublicDecodingVerificationError :: !VerificationError -> V4PublicDecodingError -- | Render a V4PublicDecodingError as Text. renderV4PublicDecodingError :: V4PublicDecodingError -> Text -- | Parse, verify, and validate a version 4 public PASETO -- token. decodeTokenV4Public :: VerificationKey V4 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V4PublicDecodingError (ValidatedToken V4 Public) -- | PASETO token which has been decoded and validated. data ValidatedToken v p ValidatedToken :: !Token v p -> !Claims -> ValidatedToken v p -- | Validated token. [vtToken] :: ValidatedToken v p -> !Token v p -- | Validated token's claims. [vtClaims] :: ValidatedToken v p -> !Claims instance GHC.Classes.Eq (Crypto.Paseto.Token.Encoding.ValidatedToken v p) instance GHC.Show.Show (Crypto.Paseto.Token.Encoding.ValidatedToken v p) instance GHC.Classes.Eq Crypto.Paseto.Token.Encoding.CommonDecodingError instance GHC.Show.Show Crypto.Paseto.Token.Encoding.CommonDecodingError instance GHC.Classes.Eq Crypto.Paseto.Token.Encoding.V3LocalDecodingError instance GHC.Show.Show Crypto.Paseto.Token.Encoding.V3LocalDecodingError instance GHC.Classes.Eq Crypto.Paseto.Token.Encoding.V3PublicDecodingError instance GHC.Show.Show Crypto.Paseto.Token.Encoding.V3PublicDecodingError instance GHC.Classes.Eq Crypto.Paseto.Token.Encoding.V4LocalDecodingError instance GHC.Show.Show Crypto.Paseto.Token.Encoding.V4LocalDecodingError instance GHC.Classes.Eq Crypto.Paseto.Token.Encoding.V4PublicDecodingError instance GHC.Show.Show Crypto.Paseto.Token.Encoding.V4PublicDecodingError module Crypto.Paseto.Token.Build -- | Parameters for building a PASETO token. data BuildTokenParams BuildTokenParams :: !Claims -> !Maybe Footer -> !Maybe ImplicitAssertion -> BuildTokenParams [btpClaims] :: BuildTokenParams -> !Claims [btpFooter] :: BuildTokenParams -> !Maybe Footer [btpImplicitAssertion] :: BuildTokenParams -> !Maybe ImplicitAssertion -- | Get parameters for building a PASETO token which includes the -- recommended default claims. -- -- This includes the following default claims: -- -- -- -- The default Footer and ImplicitAssertion is -- Nothing. getDefaultBuildTokenParams :: IO BuildTokenParams -- | Error building a version 3 local PASETO token. newtype V3LocalBuildError -- | Encryption error. V3LocalBuildEncryptionError :: EncryptionError -> V3LocalBuildError -- | Render a V3LocalBuildError as Text. renderV3LocalBuildError :: V3LocalBuildError -> Text -- | Build a version 3 local token. buildTokenV3Local :: BuildTokenParams -> SymmetricKey V3 -> ExceptT V3LocalBuildError IO (Token V3 Local) -- | Error building a version 3 public PASETO token. newtype V3PublicBuildError -- | Cryptographic signing error. V3PublicBuildSigningError :: SigningError -> V3PublicBuildError -- | Render a V3PublicBuildError as Text. renderV3PublicBuildError :: V3PublicBuildError -> Text -- | Build a version 3 public token. buildTokenV3Public :: BuildTokenParams -> SigningKey V3 -> ExceptT V3PublicBuildError IO (Token V3 Public) -- | Build a version 4 local token. buildTokenV4Local :: BuildTokenParams -> SymmetricKey V4 -> IO (Token V4 Local) -- | Build a version 4 public token. buildTokenV4Public :: BuildTokenParams -> SigningKey V4 -> Token V4 Public instance GHC.Classes.Eq Crypto.Paseto.Token.Build.BuildTokenParams instance GHC.Show.Show Crypto.Paseto.Token.Build.BuildTokenParams instance GHC.Classes.Eq Crypto.Paseto.Token.Build.V3LocalBuildError instance GHC.Show.Show Crypto.Paseto.Token.Build.V3LocalBuildError instance GHC.Classes.Eq Crypto.Paseto.Token.Build.V3PublicBuildError instance GHC.Show.Show Crypto.Paseto.Token.Build.V3PublicBuildError -- | This module is the recommended entry point for this library. module Crypto.Paseto -- | PASETO protocol version. data Version -- | Version 3. Modern NIST cryptography. V3 :: Version -- | Version 4. Modern Sodium (libsodium) cryptography. V4 :: Version -- | PASETO token purpose. data Purpose -- | Shared-key authenticated encryption. Local :: Purpose -- | Public-key digital signatures (not encrypted). Public :: Purpose -- | Symmetric key. -- -- Note that this type's Eq instance performs a constant-time -- equality check. data SymmetricKey v -- | Version 3 symmetric key. [SymmetricKeyV3] :: !ScrubbedBytes32 -> SymmetricKey V3 -- | Version 4 symmetric key. [SymmetricKeyV4] :: !ScrubbedBytes32 -> SymmetricKey V4 -- | Get the raw bytes associated with a symmetric key. symmetricKeyToBytes :: SymmetricKey v -> ScrubbedBytes -- | Construct a version 3 symmetric key from bytes. -- -- If the provided byte string does not have a length of 32 -- (256 bits), Nothing is returned. bytesToSymmetricKeyV3 :: ScrubbedBytes -> Maybe (SymmetricKey V3) -- | Construct a version 4 symmetric key from bytes. -- -- If the provided byte string does not have a length of 32 -- (256 bits), Nothing is returned. bytesToSymmetricKeyV4 :: ScrubbedBytes -> Maybe (SymmetricKey V4) -- | Randomly generate a version 3 symmetric key. generateSymmetricKeyV3 :: IO (SymmetricKey V3) -- | Randomly generate a version 4 symmetric key. generateSymmetricKeyV4 :: IO (SymmetricKey V4) -- | Signing key (also known as a private/secret key). -- -- Note that this type's Eq instance performs a constant-time -- equality check. data SigningKey v -- | Version 3 signing key. [SigningKeyV3] :: !PrivateKeyP384 -> SigningKey V3 -- | Version 3 signing key. [SigningKeyV4] :: !SecretKey -> SigningKey V4 -- | Get the raw bytes associated with a signing key. signingKeyToBytes :: SigningKey v -> ScrubbedBytes -- | Construct a version 3 signing key from bytes. bytesToSigningKeyV3 :: ScrubbedBytes -> Either ScalarDecodingError (SigningKey V3) -- | Construct a version 4 signing key from bytes. bytesToSigningKeyV4 :: ScrubbedBytes -> Maybe (SigningKey V4) -- | Randomly generate a version 3 signing key. generateSigningKeyV3 :: IO (SigningKey V3) -- | Randomly generate a version 4 signing key. generateSigningKeyV4 :: IO (SigningKey V4) -- | Error decoding a scalar value. data ScalarDecodingError -- | Invalid scalar length. ScalarDecodingInvalidLengthError :: !Int -> !Int -> ScalarDecodingError -- | Decoded scalar is invalid for the curve. ScalarDecodingInvalidError :: ScalarDecodingError -- | Render a ScalarDecodingError as Text. renderScalarDecodingError :: ScalarDecodingError -> Text -- | Verification key (also known as a public key). data VerificationKey v -- | Version 3 verification key. [VerificationKeyV3] :: !PublicKeyP384 -> VerificationKey V3 -- | Version 4 verification key. [VerificationKeyV4] :: !PublicKey -> VerificationKey V4 -- | Get the raw bytes associated with a verification key. verificationKeyToBytes :: VerificationKey v -> ByteString -- | Construct a version 3 verification key from bytes. -- -- The input ByteString is expected to be formatted as either a -- compressed or uncompressed elliptic curve public key as defined by -- SEC 1 and RFC 5480 section 2.2. bytesToVerificationKeyV3 :: ByteString -> Either PublicKeyP384DecodingError (VerificationKey V3) -- | Construct a version 4 verification key from bytes. bytesToVerificationKeyV4 :: ByteString -> Maybe (VerificationKey V4) -- | Get the VerificationKey which corresponds to a given -- SigningKey. fromSigningKey :: SigningKey v -> VerificationKey v -- | Error decoding a public key for curve SEC_p384r1. data PublicKeyP384DecodingError -- | Error decoding a compressed public key. PublicKeyP384DecodingCompressedError :: !CompressedPointDecodingError -> PublicKeyP384DecodingError -- | Error decoding an uncompressed public key. PublicKeyP384DecodingUncompressedError :: !UncompressedPointDecodingError -> PublicKeyP384DecodingError -- | Render a PublicKeyP384DecodingError as Text. renderPublicKeyP384DecodingError :: PublicKeyP384DecodingError -> Text -- | PASETO token parameterized by its protocol Version and -- Purpose. data Token v p -- | PASETO version 3 local token. [TokenV3Local] :: !Payload -> !Maybe Footer -> Token V3 Local -- | PASETO version 3 public token. [TokenV3Public] :: !Payload -> !Maybe Footer -> Token V3 Public -- | PASETO version 4 local token. [TokenV4Local] :: !Payload -> !Maybe Footer -> Token V4 Local -- | PASETO version 4 public token. [TokenV4Public] :: !Payload -> !Maybe Footer -> Token V4 Public -- | Raw PASETO token payload. -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype Payload Payload :: ByteString -> Payload [unPayload] :: Payload -> ByteString -- | Footer consisting of unencrypted free-form data. -- -- The footer's contents may be JSON or some other structured data, but -- it doesn't have to be. -- -- When a PASETO token is constructed, the footer is authenticated, but -- not encrypted (i.e. its integrity is protected, but it is not made -- confidential). In authenticated encryption schemes, this is referred -- to as "associated data". -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype Footer Footer :: ByteString -> Footer [unFooter] :: Footer -> ByteString -- | Unencrypted authenticated data which is not stored in the PASETO -- token. -- -- When a PASETO token is constructed, the implicit assertion is -- authenticated, but it is not stored in the token. This is useful if -- one wants to associate some data that should remain confidential. -- -- Note that this type's Eq instance performs a constant-time -- equality check. newtype ImplicitAssertion ImplicitAssertion :: ByteString -> ImplicitAssertion [unImplicitAssertion] :: ImplicitAssertion -> ByteString -- | Parameters for building a PASETO token. data BuildTokenParams BuildTokenParams :: !Claims -> !Maybe Footer -> !Maybe ImplicitAssertion -> BuildTokenParams [btpClaims] :: BuildTokenParams -> !Claims [btpFooter] :: BuildTokenParams -> !Maybe Footer [btpImplicitAssertion] :: BuildTokenParams -> !Maybe ImplicitAssertion -- | Get parameters for building a PASETO token which includes the -- recommended default claims. -- -- This includes the following default claims: -- -- -- -- The default Footer and ImplicitAssertion is -- Nothing. getDefaultBuildTokenParams :: IO BuildTokenParams -- | Build a version 3 local token. buildTokenV3Local :: BuildTokenParams -> SymmetricKey V3 -> ExceptT V3LocalBuildError IO (Token V3 Local) -- | Build a version 3 public token. buildTokenV3Public :: BuildTokenParams -> SigningKey V3 -> ExceptT V3PublicBuildError IO (Token V3 Public) -- | Build a version 4 local token. buildTokenV4Local :: BuildTokenParams -> SymmetricKey V4 -> IO (Token V4 Local) -- | Build a version 4 public token. buildTokenV4Public :: BuildTokenParams -> SigningKey V4 -> Token V4 Public -- | Error building a version 3 local PASETO token. newtype V3LocalBuildError -- | Encryption error. V3LocalBuildEncryptionError :: EncryptionError -> V3LocalBuildError -- | Render a V3LocalBuildError as Text. renderV3LocalBuildError :: V3LocalBuildError -> Text -- | Error building a version 3 public PASETO token. newtype V3PublicBuildError -- | Cryptographic signing error. V3PublicBuildSigningError :: SigningError -> V3PublicBuildError -- | Render a V3PublicBuildError as Text. renderV3PublicBuildError :: V3PublicBuildError -> Text -- | Encode a PASETO token as human-readable text according to the -- message format defined in the specification. encode :: Token v p -> Text -- | PASETO token which has been decoded and validated. data ValidatedToken v p ValidatedToken :: !Token v p -> !Claims -> ValidatedToken v p -- | Validated token. [vtToken] :: ValidatedToken v p -> !Token v p -- | Validated token's claims. [vtClaims] :: ValidatedToken v p -> !Claims -- | Parse, decrypt, and validate a version 3 local PASETO -- token. decodeTokenV3Local :: SymmetricKey V3 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V3LocalDecodingError (ValidatedToken V3 Local) -- | Parse, verify, and validate a version 3 public PASETO -- token. decodeTokenV3Public :: VerificationKey V3 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V3PublicDecodingError (ValidatedToken V3 Public) -- | Parse, decrypt, and validate a version 4 local PASETO -- token. decodeTokenV4Local :: SymmetricKey V4 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V4LocalDecodingError (ValidatedToken V4 Local) -- | Parse, verify, and validate a version 4 public PASETO -- token. decodeTokenV4Public :: VerificationKey V4 -> [ValidationRule] -> Maybe Footer -> Maybe ImplicitAssertion -> Text -> Either V4PublicDecodingError (ValidatedToken V4 Public) -- | Common error decoding a PASETO token. data CommonDecodingError -- | Error parsing the token. CommonDecodingParseError :: !ParseError -> CommonDecodingError -- | Token claims validation error. CommonDecodingClaimsValidationError :: !NonEmpty ValidationError -> CommonDecodingError -- | Render a CommonDecodingError as Text. renderCommonDecodingError :: CommonDecodingError -> Text -- | Error decoding a version 3 local PASETO token. data V3LocalDecodingError -- | Common decoding error. V3LocalDecodingCommonError :: !CommonDecodingError -> V3LocalDecodingError -- | Decryption error. V3LocalDecodingDecryptionError :: !DecryptionError -> V3LocalDecodingError -- | Render a V3LocalDecodingError as Text. renderV3LocalDecodingError :: V3LocalDecodingError -> Text -- | Error decoding a version 3 public PASETO token. data V3PublicDecodingError -- | Common decoding error. V3PublicDecodingCommonError :: !CommonDecodingError -> V3PublicDecodingError -- | Cryptographic signature verification error. V3PublicDecodingVerificationError :: !VerificationError -> V3PublicDecodingError -- | Render a V3PublicDecodingError as Text. renderV3PublicDecodingError :: V3PublicDecodingError -> Text -- | Error decoding a version 4 local PASETO token. data V4LocalDecodingError -- | Common decoding error. V4LocalDecodingCommonError :: !CommonDecodingError -> V4LocalDecodingError -- | Decryption error. V4LocalDecodingDecryptionError :: !DecryptionError -> V4LocalDecodingError -- | Render a V4LocalDecodingError as Text. renderV4LocalDecodingError :: V4LocalDecodingError -> Text -- | Error decoding a version 4 public PASETO token. data V4PublicDecodingError -- | Common decoding error. V4PublicDecodingCommonError :: !CommonDecodingError -> V4PublicDecodingError -- | Cryptographic signature verification error. V4PublicDecodingVerificationError :: !VerificationError -> V4PublicDecodingError -- | Render a V4PublicDecodingError as Text. renderV4PublicDecodingError :: V4PublicDecodingError -> Text -- | Collection of Claims. data Claims -- | Token claim. data Claim IssuerClaim :: !Issuer -> Claim SubjectClaim :: !Subject -> Claim AudienceClaim :: !Audience -> Claim ExpirationClaim :: !Expiration -> Claim NotBeforeClaim :: !NotBefore -> Claim IssuedAtClaim :: !IssuedAt -> Claim TokenIdentifierClaim :: !TokenIdentifier -> Claim CustomClaim :: !UnregisteredClaimKey -> !Value -> Claim -- | Issuer of a token. newtype Issuer Issuer :: Text -> Issuer [unIssuer] :: Issuer -> Text -- | Subject of a token. newtype Subject Subject :: Text -> Subject [unSubject] :: Subject -> Text -- | Recipient for which a token is intended. newtype Audience Audience :: Text -> Audience [unAudience] :: Audience -> Text -- | Time after which a token expires. newtype Expiration Expiration :: UTCTime -> Expiration [unExpiration] :: Expiration -> UTCTime -- | Render an Expiration as Text. renderExpiration :: Expiration -> Text -- | Time from which a token should be considered valid. newtype NotBefore NotBefore :: UTCTime -> NotBefore [unNotBefore] :: NotBefore -> UTCTime -- | Render a NotBefore as Text. renderNotBefore :: NotBefore -> Text -- | Time at which a token was issued. newtype IssuedAt IssuedAt :: UTCTime -> IssuedAt [unIssuedAt] :: IssuedAt -> UTCTime -- | Render an IssuedAt as Text. renderIssuedAt :: IssuedAt -> Text -- | Token identifier. newtype TokenIdentifier TokenIdentifier :: Text -> TokenIdentifier [unTokenIdentifier] :: TokenIdentifier -> Text -- | Unregistered claim key. data UnregisteredClaimKey -- | Construct an unregistered claim key. -- -- If the provided Text key matches that of a registered claim -- (registeredClaimKeys), this function will return -- Nothing. mkUnregisteredClaimKey :: Text -> Maybe UnregisteredClaimKey -- | Render an UnregisteredClaimKey as Text. renderUnregisteredClaimKey :: UnregisteredClaimKey -> Text -- | Token claim validation rule. newtype ValidationRule ValidationRule :: (Claims -> Either ValidationError ()) -> ValidationRule [unValidationRule] :: ValidationRule -> Claims -> Either ValidationError () -- | Whether a claim must exist. newtype ClaimMustExist ClaimMustExist :: Bool -> ClaimMustExist -- | Get a list of recommended default validation rules. -- -- At the moment, the only default rule is checking validAt for -- the current system time (getCurrentTime). getDefaultValidationRules :: IO [ValidationRule] -- | Validate that a token is intended for a given audience. forAudience :: Audience -> ValidationRule -- | Validate a token's identifier. identifiedBy :: TokenIdentifier -> ValidationRule -- | Validate a token's issuer. issuedBy :: Issuer -> ValidationRule -- | Validate that a token is not expired at the given time. -- -- That is, if the ExpirationClaim is present, check that it isn't -- in the past (relative to the given time). notExpired :: UTCTime -> ValidationRule -- | Validate the subject of a token. subject :: Subject -> ValidationRule -- | Validate that a token is valid at the given time. -- -- This involves the following checks (relative to the given time): -- -- validAt :: UTCTime -> ValidationRule -- | Validate that a custom claim is equal to the given value. customClaimEq :: ClaimMustExist -> UnregisteredClaimKey -> Value -> ValidationRule -- | Validation error. data ValidationError -- | Expected claim does not exist. ValidationClaimNotFoundError :: !ClaimKey -> ValidationError -- | Token claim is invalid. ValidationInvalidClaimError :: !ClaimKey -> !Text -> !Text -> ValidationError -- | Token is expired. ValidationExpirationError :: !Expiration -> ValidationError -- | Token's IssuedAt time is in the future. ValidationIssuedAtError :: !IssuedAt -> ValidationError -- | Token is not yet valid as its NotBefore time is in the future. ValidationNotBeforeError :: !NotBefore -> ValidationError -- | Custom validation error. ValidationCustomError :: !Text -> ValidationError -- | Render a ValidationError as Text. renderValidationError :: ValidationError -> Text -- | Render a non-empty list of ValidationErrors as Text. renderValidationErrors :: NonEmpty ValidationError -> Text -- | Parse a version 3 local PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV3Local :: Text -> Either ParseError (Token V3 Local) -- | Parse a version 3 public PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV3Public :: Text -> Either ParseError (Token V3 Public) -- | Parse a version 4 local PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV4Local :: Text -> Either ParseError (Token V4 Local) -- | Parse a version 4 public PASETO token from human-readable text -- according to the message format defined in the specification. -- -- Note that this function does not perform any kind of token validation, -- cryptographic or otherwise. It simply parses the token and ensures -- that it is well-formed. parseTokenV4Public :: Text -> Either ParseError (Token V4 Public)