Crypto.Paseto

This module is the recommended entry point for this library.

Mode

data Version

PASETO protocol version.

Constructors

V3

Version 3. Modern NIST cryptography.

V4

Version 4. Modern Sodium (libsodium) cryptography.

Instances

Show Version

Defined in Crypto.Paseto.Mode

Methods

showsPrec :: Int -> Version -> ShowS

show :: Version -> String

showList :: [Version] -> ShowS

Eq Version

Defined in Crypto.Paseto.Mode

Methods

(==) :: Version -> Version -> Bool

(/=) :: Version -> Version -> Bool

data Purpose

PASETO token purpose.

Constructors

Local

Shared-key authenticated encryption.

Public

Public-key digital signatures (not encrypted).

Instances

Show Purpose

Defined in Crypto.Paseto.Mode

Methods

showsPrec :: Int -> Purpose -> ShowS

show :: Purpose -> String

showList :: [Purpose] -> ShowS

Eq Purpose

Defined in Crypto.Paseto.Mode

Methods

(==) :: Purpose -> Purpose -> Bool

(/=) :: Purpose -> Purpose -> Bool

Keys

Symmetric keys

data SymmetricKey v where

Symmetric key.

Note that this type's Eq instance performs a constant-time equality check.

Constructors

SymmetricKeyV3 :: !ScrubbedBytes32 -> SymmetricKey V3

Version 3 symmetric key.

SymmetricKeyV4 :: !ScrubbedBytes32 -> SymmetricKey V4

Version 4 symmetric key.

Instances

Eq (SymmetricKey v)

Defined in Crypto.Paseto.Keys

Methods

(==) :: SymmetricKey v -> SymmetricKey v -> Bool

(/=) :: SymmetricKey v -> SymmetricKey v -> Bool

symmetricKeyToBytes :: SymmetricKey v -> ScrubbedBytes

Get the raw bytes associated with a symmetric key.

bytesToSymmetricKeyV3 :: ScrubbedBytes -> Maybe (SymmetricKey V3)

Construct a version 3 symmetric key from bytes.

If the provided byte string does not have a length of 32 (256 bits), Nothing is returned.

bytesToSymmetricKeyV4 :: ScrubbedBytes -> Maybe (SymmetricKey V4)

Construct a version 4 symmetric key from bytes.

If the provided byte string does not have a length of 32 (256 bits), Nothing is returned.

generateSymmetricKeyV3 :: IO (SymmetricKey V3)

Randomly generate a version 3 symmetric key.

generateSymmetricKeyV4 :: IO (SymmetricKey V4)

Randomly generate a version 4 symmetric key.

Asymmetric keys

Signing keys

data SigningKey v where

Signing key (also known as a private/secret key).

Note that this type's Eq instance performs a constant-time equality check.

Constructors

SigningKeyV3 :: !PrivateKeyP384 -> SigningKey V3

Version 3 signing key.

SigningKeyV4 :: !SecretKey -> SigningKey V4

Version 3 signing key.

Instances

Eq (SigningKey v)

Defined in Crypto.Paseto.Keys

Methods

(==) :: SigningKey v -> SigningKey v -> Bool

(/=) :: SigningKey v -> SigningKey v -> Bool

signingKeyToBytes :: SigningKey v -> ScrubbedBytes

Get the raw bytes associated with a signing key.

bytesToSigningKeyV3 :: ScrubbedBytes -> Either ScalarDecodingError (SigningKey V3)

Construct a version 3 signing key from bytes.

bytesToSigningKeyV4 :: ScrubbedBytes -> Maybe (SigningKey V4)

Construct a version 4 signing key from bytes.

generateSigningKeyV3 :: IO (SigningKey V3)

Randomly generate a version 3 signing key.

generateSigningKeyV4 :: IO (SigningKey V4)

Randomly generate a version 4 signing key.

Errors

data ScalarDecodingError

Error decoding a scalar value.

Constructors

ScalarDecodingInvalidLengthError

Invalid scalar length.

Fields

• !Int

  Expected length

• !Int

  Actual length

ScalarDecodingInvalidError

Decoded scalar is invalid for the curve.

Instances

Show ScalarDecodingError

Defined in Crypto.Paseto.Keys.V3.Internal

Methods

showsPrec :: Int -> ScalarDecodingError -> ShowS

show :: ScalarDecodingError -> String

showList :: [ScalarDecodingError] -> ShowS

Eq ScalarDecodingError

Defined in Crypto.Paseto.Keys.V3.Internal

Methods

(==) :: ScalarDecodingError -> ScalarDecodingError -> Bool

(/=) :: ScalarDecodingError -> ScalarDecodingError -> Bool

renderScalarDecodingError :: ScalarDecodingError -> Text

Render a ScalarDecodingError as Text.

Verification keys

data VerificationKey v where

Verification key (also known as a public key).

Constructors

VerificationKeyV3 :: !PublicKeyP384 -> VerificationKey V3

Version 3 verification key.

VerificationKeyV4 :: !PublicKey -> VerificationKey V4

Version 4 verification key.

Instances

Eq (VerificationKey v)

Defined in Crypto.Paseto.Keys

Methods

(==) :: VerificationKey v -> VerificationKey v -> Bool

(/=) :: VerificationKey v -> VerificationKey v -> Bool

verificationKeyToBytes :: VerificationKey v -> ByteString

Get the raw bytes associated with a verification key.

bytesToVerificationKeyV3 :: ByteString -> Either PublicKeyP384DecodingError (VerificationKey V3)

Construct a version 3 verification key from bytes.

The input ByteString is expected to be formatted as either a compressed or uncompressed elliptic curve public key as defined by SEC 1 and RFC 5480 section 2.2.

bytesToVerificationKeyV4 :: ByteString -> Maybe (VerificationKey V4)

Construct a version 4 verification key from bytes.

fromSigningKey :: SigningKey v -> VerificationKey v

Get the VerificationKey which corresponds to a given SigningKey.

Errors

data PublicKeyP384DecodingError

Error decoding a public key for curve SEC_p384r1.

Constructors

PublicKeyP384DecodingCompressedError !CompressedPointDecodingError

Error decoding a compressed public key.

PublicKeyP384DecodingUncompressedError !UncompressedPointDecodingError

Error decoding an uncompressed public key.

Instances

Show PublicKeyP384DecodingError

Defined in Crypto.Paseto.Keys.V3

Methods

showsPrec :: Int -> PublicKeyP384DecodingError -> ShowS

show :: PublicKeyP384DecodingError -> String

showList :: [PublicKeyP384DecodingError] -> ShowS

Eq PublicKeyP384DecodingError

Defined in Crypto.Paseto.Keys.V3

Methods

(==) :: PublicKeyP384DecodingError -> PublicKeyP384DecodingError -> Bool

(/=) :: PublicKeyP384DecodingError -> PublicKeyP384DecodingError -> Bool

renderPublicKeyP384DecodingError :: PublicKeyP384DecodingError -> Text

Render a PublicKeyP384DecodingError as Text.

Tokens

data Token v p where

PASETO token parameterized by its protocol Version and Purpose.

Constructors

TokenV3Local

PASETO version 3 local token.

Fields

• :: !Payload

  Encrypted token payload.

• -> !(Maybe Footer)

  Optional footer (associated data).

• -> Token V3 Local

TokenV3Public

PASETO version 3 public token.

Fields

• :: !Payload

  Signed token payload.

• -> !(Maybe Footer)

  Optional footer (associated data).

• -> Token V3 Public

TokenV4Local

PASETO version 4 local token.

Fields

• :: !Payload

  Encrypted token payload.

• -> !(Maybe Footer)

  Optional footer (associated data).

• -> Token V4 Local

TokenV4Public

PASETO version 4 public token.

Fields

• :: !Payload

  Signed token payload.

• -> !(Maybe Footer)

  Optional footer (associated data).

• -> Token V4 Public

Instances

Show (Token v p)

Defined in Crypto.Paseto.Token

Methods

showsPrec :: Int -> Token v p -> ShowS

show :: Token v p -> String

showList :: [Token v p] -> ShowS

Eq (Token v p)

Defined in Crypto.Paseto.Token

Methods

(==) :: Token v p -> Token v p -> Bool

(/=) :: Token v p -> Token v p -> Bool

newtype Payload

Raw PASETO token payload.

Note that this type's Eq instance performs a constant-time equality check.

Constructors

Payload

Fields

• unPayload :: ByteString

Instances

Show Payload

Defined in Crypto.Paseto.Token

Methods

showsPrec :: Int -> Payload -> ShowS

show :: Payload -> String

showList :: [Payload] -> ShowS

Eq Payload

Defined in Crypto.Paseto.Token

Methods

(==) :: Payload -> Payload -> Bool

(/=) :: Payload -> Payload -> Bool

newtype Footer

Footer consisting of unencrypted free-form data.

The footer's contents may be JSON or some other structured data, but it doesn't have to be.

When a PASETO token is constructed, the footer is authenticated, but not encrypted (i.e. its integrity is protected, but it is not made confidential). In authenticated encryption schemes, this is referred to as "associated data".

Note that this type's Eq instance performs a constant-time equality check.

Constructors

Footer

Fields

• unFooter :: ByteString

Instances

Show Footer

Defined in Crypto.Paseto.Token

Methods

showsPrec :: Int -> Footer -> ShowS

show :: Footer -> String

showList :: [Footer] -> ShowS

Eq Footer

Defined in Crypto.Paseto.Token

Methods

(==) :: Footer -> Footer -> Bool

(/=) :: Footer -> Footer -> Bool

newtype ImplicitAssertion

Unencrypted authenticated data which is not stored in the PASETO token.

When a PASETO token is constructed, the implicit assertion is authenticated, but it is not stored in the token. This is useful if one wants to associate some data that should remain confidential.

Note that this type's Eq instance performs a constant-time equality check.

Constructors

ImplicitAssertion

Fields

• unImplicitAssertion :: ByteString

Instances

Show ImplicitAssertion

Defined in Crypto.Paseto.Token

Methods

showsPrec :: Int -> ImplicitAssertion -> ShowS

show :: ImplicitAssertion -> String

showList :: [ImplicitAssertion] -> ShowS

Eq ImplicitAssertion

Defined in Crypto.Paseto.Token

Methods

(==) :: ImplicitAssertion -> ImplicitAssertion -> Bool

(/=) :: ImplicitAssertion -> ImplicitAssertion -> Bool

Construction

data BuildTokenParams

Parameters for building a PASETO token.

Constructors

BuildTokenParams

Fields

• btpClaims :: !Claims
• btpFooter :: !(Maybe Footer)
• btpImplicitAssertion :: !(Maybe ImplicitAssertion)

Instances

Show BuildTokenParams

Defined in Crypto.Paseto.Token.Build

Methods

showsPrec :: Int -> BuildTokenParams -> ShowS

show :: BuildTokenParams -> String

showList :: [BuildTokenParams] -> ShowS

Eq BuildTokenParams

Defined in Crypto.Paseto.Token.Build

Methods

(==) :: BuildTokenParams -> BuildTokenParams -> Bool

(/=) :: BuildTokenParams -> BuildTokenParams -> Bool

getDefaultBuildTokenParams :: IO BuildTokenParams

Get parameters for building a PASETO token which includes the recommended default claims.

This includes the following default claims:

• An ExpirationClaim of 1 hour from the current system time.
• An IssuedAtClaim of the current system time.
• A NotBeforeClaim of the current system time.

The default Footer and ImplicitAssertion is Nothing.

buildTokenV3Local :: BuildTokenParams -> SymmetricKey V3 -> ExceptT V3LocalBuildError IO (Token V3 Local)

Build a version 3 local token.

buildTokenV3Public :: BuildTokenParams -> SigningKey V3 -> ExceptT V3PublicBuildError IO (Token V3 Public)

Build a version 3 public token.

buildTokenV4Local :: BuildTokenParams -> SymmetricKey V4 -> IO (Token V4 Local)

Build a version 4 local token.

buildTokenV4Public :: BuildTokenParams -> SigningKey V4 -> Token V4 Public

Build a version 4 public token.

Errors

newtype V3LocalBuildError

Error building a version 3 local PASETO token.

Constructors

V3LocalBuildEncryptionError EncryptionError

Encryption error.

Instances

Show V3LocalBuildError

Defined in Crypto.Paseto.Token.Build

Methods

showsPrec :: Int -> V3LocalBuildError -> ShowS

show :: V3LocalBuildError -> String

showList :: [V3LocalBuildError] -> ShowS

Eq V3LocalBuildError

Defined in Crypto.Paseto.Token.Build

Methods

(==) :: V3LocalBuildError -> V3LocalBuildError -> Bool

(/=) :: V3LocalBuildError -> V3LocalBuildError -> Bool

renderV3LocalBuildError :: V3LocalBuildError -> Text

Render a V3LocalBuildError as Text.

newtype V3PublicBuildError

Error building a version 3 public PASETO token.

Constructors

V3PublicBuildSigningError SigningError

Cryptographic signing error.

Instances

Show V3PublicBuildError

Defined in Crypto.Paseto.Token.Build

Methods

showsPrec :: Int -> V3PublicBuildError -> ShowS

show :: V3PublicBuildError -> String

showList :: [V3PublicBuildError] -> ShowS

Eq V3PublicBuildError

Defined in Crypto.Paseto.Token.Build

Methods

(==) :: V3PublicBuildError -> V3PublicBuildError -> Bool

(/=) :: V3PublicBuildError -> V3PublicBuildError -> Bool

renderV3PublicBuildError :: V3PublicBuildError -> Text

Render a V3PublicBuildError as Text.

Encoding and decoding

encode :: Token v p -> Text

Encode a PASETO token as human-readable text according to the message format defined in the specification.

data ValidatedToken v p

PASETO token which has been decoded and validated.

Constructors

ValidatedToken

Fields

• vtToken :: !(Token v p)

  Validated token.

• vtClaims :: !Claims

  Validated token's claims.

Instances

Show (ValidatedToken v p)

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> ValidatedToken v p -> ShowS

show :: ValidatedToken v p -> String

showList :: [ValidatedToken v p] -> ShowS

Eq (ValidatedToken v p)

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: ValidatedToken v p -> ValidatedToken v p -> Bool

(/=) :: ValidatedToken v p -> ValidatedToken v p -> Bool

decodeTokenV3Local

Arguments

:: SymmetricKey V3

Symmetric key.

-> [ValidationRule]

Validation rules.

-> Maybe Footer

Optional footer to authenticate.

-> Maybe ImplicitAssertion

Optional implicit assertion to authenticate.

-> Text

Encoded PASETO token.

-> Either V3LocalDecodingError (ValidatedToken V3 Local)

Parse, decrypt, and validate a version 3 local PASETO token.

decodeTokenV3Public

Arguments

:: VerificationKey V3

Verification key.

-> [ValidationRule]

Validation rules.

-> Maybe Footer

Optional footer to authenticate.

-> Maybe ImplicitAssertion

Optional implicit assertion to authenticate.

-> Text

Encoded PASETO token.

-> Either V3PublicDecodingError (ValidatedToken V3 Public)

Parse, verify, and validate a version 3 public PASETO token.

decodeTokenV4Local

Arguments

:: SymmetricKey V4

Symmetric key.

-> [ValidationRule]

Validation rules.

-> Maybe Footer

Optional footer to authenticate.

-> Maybe ImplicitAssertion

Optional implicit assertion to authenticate.

-> Text

Encoded PASETO token.

-> Either V4LocalDecodingError (ValidatedToken V4 Local)

Parse, decrypt, and validate a version 4 local PASETO token.

decodeTokenV4Public

Arguments

:: VerificationKey V4

Verification key.

-> [ValidationRule]

Validation rules.

-> Maybe Footer

Optional footer to authenticate.

-> Maybe ImplicitAssertion

Optional implicit assertion to authenticate.

-> Text

Encoded PASETO token.

-> Either V4PublicDecodingError (ValidatedToken V4 Public)

Parse, verify, and validate a version 4 public PASETO token.

Errors

data CommonDecodingError

Common error decoding a PASETO token.

Constructors

CommonDecodingParseError !ParseError

Error parsing the token.

CommonDecodingClaimsValidationError !(NonEmpty ValidationError)

Token claims validation error.

Instances

Show CommonDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> CommonDecodingError -> ShowS

show :: CommonDecodingError -> String

showList :: [CommonDecodingError] -> ShowS

Eq CommonDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: CommonDecodingError -> CommonDecodingError -> Bool

(/=) :: CommonDecodingError -> CommonDecodingError -> Bool

renderCommonDecodingError :: CommonDecodingError -> Text

Render a CommonDecodingError as Text.

data V3LocalDecodingError

Error decoding a version 3 local PASETO token.

Constructors

V3LocalDecodingCommonError !CommonDecodingError

Common decoding error.

V3LocalDecodingDecryptionError !DecryptionError

Decryption error.

Instances

Show V3LocalDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> V3LocalDecodingError -> ShowS

show :: V3LocalDecodingError -> String

showList :: [V3LocalDecodingError] -> ShowS

Eq V3LocalDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: V3LocalDecodingError -> V3LocalDecodingError -> Bool

(/=) :: V3LocalDecodingError -> V3LocalDecodingError -> Bool

renderV3LocalDecodingError :: V3LocalDecodingError -> Text

Render a V3LocalDecodingError as Text.

data V3PublicDecodingError

Error decoding a version 3 public PASETO token.

Constructors

V3PublicDecodingCommonError !CommonDecodingError

Common decoding error.

V3PublicDecodingVerificationError !VerificationError

Cryptographic signature verification error.

Instances

Show V3PublicDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> V3PublicDecodingError -> ShowS

show :: V3PublicDecodingError -> String

showList :: [V3PublicDecodingError] -> ShowS

Eq V3PublicDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: V3PublicDecodingError -> V3PublicDecodingError -> Bool

(/=) :: V3PublicDecodingError -> V3PublicDecodingError -> Bool

renderV3PublicDecodingError :: V3PublicDecodingError -> Text

Render a V3PublicDecodingError as Text.

data V4LocalDecodingError

Error decoding a version 4 local PASETO token.

Constructors

V4LocalDecodingCommonError !CommonDecodingError

Common decoding error.

V4LocalDecodingDecryptionError !DecryptionError

Decryption error.

Instances

Show V4LocalDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> V4LocalDecodingError -> ShowS

show :: V4LocalDecodingError -> String

showList :: [V4LocalDecodingError] -> ShowS

Eq V4LocalDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: V4LocalDecodingError -> V4LocalDecodingError -> Bool

(/=) :: V4LocalDecodingError -> V4LocalDecodingError -> Bool

renderV4LocalDecodingError :: V4LocalDecodingError -> Text

Render a V4LocalDecodingError as Text.

data V4PublicDecodingError

Error decoding a version 4 public PASETO token.

Constructors

V4PublicDecodingCommonError !CommonDecodingError

Common decoding error.

V4PublicDecodingVerificationError !VerificationError

Cryptographic signature verification error.

Instances

Show V4PublicDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

showsPrec :: Int -> V4PublicDecodingError -> ShowS

show :: V4PublicDecodingError -> String

showList :: [V4PublicDecodingError] -> ShowS

Eq V4PublicDecodingError

Defined in Crypto.Paseto.Token.Encoding

Methods

(==) :: V4PublicDecodingError -> V4PublicDecodingError -> Bool

(/=) :: V4PublicDecodingError -> V4PublicDecodingError -> Bool

renderV4PublicDecodingError :: V4PublicDecodingError -> Text

Render a V4PublicDecodingError as Text.

Claims

Container type

Collection of PASETO token claims.

Note that we only re-export the Claims type from this module as the rest of the API contains functions which may conflict with those in Prelude and other container implementations such as Data.Map.

If you need access to those other functions, it's recommended to import Crypto.Paseto.Token.Claims qualified. For example:

import qualified Crypto.Paseto.Token.Claims as Claims

data Claims

Collection of Claims.

Instances

FromJSON Claims

Defined in Crypto.Paseto.Token.Claims

Methods

parseJSON :: Value -> Parser Claims

parseJSONList :: Value -> Parser [Claims]

omittedField :: Maybe Claims

ToJSON Claims

Defined in Crypto.Paseto.Token.Claims

Methods

toJSON :: Claims -> Value

toEncoding :: Claims -> Encoding

toJSONList :: [Claims] -> Value

toEncodingList :: [Claims] -> Encoding

omitField :: Claims -> Bool

Monoid Claims

Defined in Crypto.Paseto.Token.Claims

Methods

mempty :: Claims

mappend :: Claims -> Claims -> Claims

mconcat :: [Claims] -> Claims

Semigroup Claims

Defined in Crypto.Paseto.Token.Claims

Methods

(<>) :: Claims -> Claims -> Claims

sconcat :: NonEmpty Claims -> Claims

stimes :: Integral b => b -> Claims -> Claims

Show Claims

Defined in Crypto.Paseto.Token.Claims

Methods

showsPrec :: Int -> Claims -> ShowS

show :: Claims -> String

showList :: [Claims] -> ShowS

Eq Claims

Defined in Crypto.Paseto.Token.Claims

Methods

(==) :: Claims -> Claims -> Bool

(/=) :: Claims -> Claims -> Bool

Claim types

data Claim

Token claim.

Constructors

IssuerClaim !Issuer

SubjectClaim !Subject

AudienceClaim !Audience

ExpirationClaim !Expiration

NotBeforeClaim !NotBefore

IssuedAtClaim !IssuedAt

TokenIdentifierClaim !TokenIdentifier

CustomClaim

Fields

• !UnregisteredClaimKey

  Claim key.

• !Value

  Claim value.

Instances

Show Claim

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> Claim -> ShowS

show :: Claim -> String

showList :: [Claim] -> ShowS

Eq Claim

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: Claim -> Claim -> Bool

(/=) :: Claim -> Claim -> Bool

newtype Issuer

Issuer of a token.

Constructors

Issuer

Fields

• unIssuer :: Text

Instances

FromJSON Issuer

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser Issuer

parseJSONList :: Value -> Parser [Issuer]

omittedField :: Maybe Issuer

ToJSON Issuer

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: Issuer -> Value

toEncoding :: Issuer -> Encoding

toJSONList :: [Issuer] -> Value

toEncodingList :: [Issuer] -> Encoding

omitField :: Issuer -> Bool

Show Issuer

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> Issuer -> ShowS

show :: Issuer -> String

showList :: [Issuer] -> ShowS

Eq Issuer

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: Issuer -> Issuer -> Bool

(/=) :: Issuer -> Issuer -> Bool

newtype Subject

Subject of a token.

Constructors

Subject

Fields

• unSubject :: Text

Instances

FromJSON Subject

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser Subject

parseJSONList :: Value -> Parser [Subject]

omittedField :: Maybe Subject

ToJSON Subject

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: Subject -> Value

toEncoding :: Subject -> Encoding

toJSONList :: [Subject] -> Value

toEncodingList :: [Subject] -> Encoding

omitField :: Subject -> Bool

Show Subject

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> Subject -> ShowS

show :: Subject -> String

showList :: [Subject] -> ShowS

Eq Subject

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: Subject -> Subject -> Bool

(/=) :: Subject -> Subject -> Bool

newtype Audience

Recipient for which a token is intended.

Constructors

Audience

Fields

• unAudience :: Text

Instances

FromJSON Audience

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser Audience

parseJSONList :: Value -> Parser [Audience]

omittedField :: Maybe Audience

ToJSON Audience

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: Audience -> Value

toEncoding :: Audience -> Encoding

toJSONList :: [Audience] -> Value

toEncodingList :: [Audience] -> Encoding

omitField :: Audience -> Bool

Show Audience

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> Audience -> ShowS

show :: Audience -> String

showList :: [Audience] -> ShowS

Eq Audience

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: Audience -> Audience -> Bool

(/=) :: Audience -> Audience -> Bool

newtype Expiration

Time after which a token expires.

Constructors

Expiration

Fields

• unExpiration :: UTCTime

Instances

FromJSON Expiration

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser Expiration

parseJSONList :: Value -> Parser [Expiration]

omittedField :: Maybe Expiration

ToJSON Expiration

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: Expiration -> Value

toEncoding :: Expiration -> Encoding

toJSONList :: [Expiration] -> Value

toEncodingList :: [Expiration] -> Encoding

omitField :: Expiration -> Bool

Show Expiration

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> Expiration -> ShowS

show :: Expiration -> String

showList :: [Expiration] -> ShowS

Eq Expiration

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: Expiration -> Expiration -> Bool

(/=) :: Expiration -> Expiration -> Bool

renderExpiration :: Expiration -> Text

Render an Expiration as Text.

newtype NotBefore

Time from which a token should be considered valid.

Constructors

NotBefore

Fields

• unNotBefore :: UTCTime

Instances

FromJSON NotBefore

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser NotBefore

parseJSONList :: Value -> Parser [NotBefore]

omittedField :: Maybe NotBefore

ToJSON NotBefore

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: NotBefore -> Value

toEncoding :: NotBefore -> Encoding

toJSONList :: [NotBefore] -> Value

toEncodingList :: [NotBefore] -> Encoding

omitField :: NotBefore -> Bool

Show NotBefore

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> NotBefore -> ShowS

show :: NotBefore -> String

showList :: [NotBefore] -> ShowS

Eq NotBefore

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: NotBefore -> NotBefore -> Bool

(/=) :: NotBefore -> NotBefore -> Bool

renderNotBefore :: NotBefore -> Text

Render a NotBefore as Text.

newtype IssuedAt

Time at which a token was issued.

Constructors

IssuedAt

Fields

• unIssuedAt :: UTCTime

Instances

FromJSON IssuedAt

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser IssuedAt

parseJSONList :: Value -> Parser [IssuedAt]

omittedField :: Maybe IssuedAt

ToJSON IssuedAt

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: IssuedAt -> Value

toEncoding :: IssuedAt -> Encoding

toJSONList :: [IssuedAt] -> Value

toEncodingList :: [IssuedAt] -> Encoding

omitField :: IssuedAt -> Bool

Show IssuedAt

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> IssuedAt -> ShowS

show :: IssuedAt -> String

showList :: [IssuedAt] -> ShowS

Eq IssuedAt

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: IssuedAt -> IssuedAt -> Bool

(/=) :: IssuedAt -> IssuedAt -> Bool

renderIssuedAt :: IssuedAt -> Text

Render an IssuedAt as Text.

newtype TokenIdentifier

Token identifier.

Constructors

TokenIdentifier

Fields

• unTokenIdentifier :: Text

Instances

FromJSON TokenIdentifier

Defined in Crypto.Paseto.Token.Claim

Methods

parseJSON :: Value -> Parser TokenIdentifier

parseJSONList :: Value -> Parser [TokenIdentifier]

omittedField :: Maybe TokenIdentifier

ToJSON TokenIdentifier

Defined in Crypto.Paseto.Token.Claim

Methods

toJSON :: TokenIdentifier -> Value

toEncoding :: TokenIdentifier -> Encoding

toJSONList :: [TokenIdentifier] -> Value

toEncodingList :: [TokenIdentifier] -> Encoding

omitField :: TokenIdentifier -> Bool

Show TokenIdentifier

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> TokenIdentifier -> ShowS

show :: TokenIdentifier -> String

showList :: [TokenIdentifier] -> ShowS

Eq TokenIdentifier

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: TokenIdentifier -> TokenIdentifier -> Bool

(/=) :: TokenIdentifier -> TokenIdentifier -> Bool

Custom claim keys

data UnregisteredClaimKey

Unregistered claim key.

Instances

Show UnregisteredClaimKey

Defined in Crypto.Paseto.Token.Claim

Methods

showsPrec :: Int -> UnregisteredClaimKey -> ShowS

show :: UnregisteredClaimKey -> String

showList :: [UnregisteredClaimKey] -> ShowS

Eq UnregisteredClaimKey

Defined in Crypto.Paseto.Token.Claim

Methods

(==) :: UnregisteredClaimKey -> UnregisteredClaimKey -> Bool

(/=) :: UnregisteredClaimKey -> UnregisteredClaimKey -> Bool

mkUnregisteredClaimKey :: Text -> Maybe UnregisteredClaimKey

Construct an unregistered claim key.

If the provided Text key matches that of a registered claim (registeredClaimKeys), this function will return Nothing.

renderUnregisteredClaimKey :: UnregisteredClaimKey -> Text

Render an UnregisteredClaimKey as Text.

Validation

Rules

newtype ValidationRule

Token claim validation rule.

Constructors

ValidationRule

Fields

• unValidationRule :: Claims -> Either ValidationError ()

newtype ClaimMustExist

Whether a claim must exist.

Constructors

ClaimMustExist Bool

Default rules

getDefaultValidationRules :: IO [ValidationRule]

Get a list of recommended default validation rules.

At the moment, the only default rule is checking validAt for the current system time (getCurrentTime).

Simple rules

forAudience :: Audience -> ValidationRule

Validate that a token is intended for a given audience.

identifiedBy :: TokenIdentifier -> ValidationRule

Validate a token's identifier.

issuedBy :: Issuer -> ValidationRule

Validate a token's issuer.

notExpired :: UTCTime -> ValidationRule

Validate that a token is not expired at the given time.

That is, if the ExpirationClaim is present, check that it isn't in the past (relative to the given time).

subject :: Subject -> ValidationRule

Validate the subject of a token.

validAt :: UTCTime -> ValidationRule

Validate that a token is valid at the given time.

This involves the following checks (relative to the given time):

• If the ExpirationClaim is present, check that it isn't in the past.
• If the IssuedAtClaim is present, check that it isn't in the future.
• If the NotBeforeClaim is present, check that it isn't in the future.

customClaimEq

Arguments

:: ClaimMustExist

Whether the custom claim must exist.

-> UnregisteredClaimKey

Custom claim key to lookup.

-> Value

Custom claim value to validate (i.e. the expected value).

-> ValidationRule

Validate that a custom claim is equal to the given value.

Errors

data ValidationError

Validation error.

Constructors

ValidationClaimNotFoundError

Expected claim does not exist.

Fields

• !ClaimKey

  Claim key which could not be found.

ValidationInvalidClaimError

Token claim is invalid.

Fields

• !ClaimKey

  Claim key.

• !Text

  Expected claim value (rendered as Text).

• !Text

  Actual claim value (rendered as Text).

ValidationExpirationError !Expiration

Token is expired.

ValidationIssuedAtError !IssuedAt

Token's IssuedAt time is in the future.

ValidationNotBeforeError !NotBefore

Token is not yet valid as its NotBefore time is in the future.

ValidationCustomError !Text

Custom validation error.

Instances

Show ValidationError

Defined in Crypto.Paseto.Token.Validation

Methods

showsPrec :: Int -> ValidationError -> ShowS

show :: ValidationError -> String

showList :: [ValidationError] -> ShowS

Eq ValidationError

Defined in Crypto.Paseto.Token.Validation

Methods

(==) :: ValidationError -> ValidationError -> Bool

(/=) :: ValidationError -> ValidationError -> Bool

renderValidationError :: ValidationError -> Text

Render a ValidationError as Text.

renderValidationErrors :: NonEmpty ValidationError -> Text

Render a non-empty list of ValidationErrors as Text.

Unsafe parsers

Note that these parsers are considered unsafe as they do not perform any kind of token validation, cryptographic or otherwise. They simply ensure that the input looks like a well-formed token.

For typical usage, one should use the decoding functions that perform parsing, cryptographic verification, and validation from the encoding and decoding section.

As a result, you should only use these unsafe parsers in specific situations where you really know what you're doing. For example, they can be useful in situations where one wants to parse some information out of a token's footer without first needing to decrypt or verify the token. For more information on this particular scenario, see Key-ID Support in the PASETO specification.

parseTokenV3Local :: Text -> Either ParseError (Token V3 Local)

Parse a version 3 local PASETO token from human-readable text according to the message format defined in the specification.

Note that this function does not perform any kind of token validation, cryptographic or otherwise. It simply parses the token and ensures that it is well-formed.

parseTokenV3Public :: Text -> Either ParseError (Token V3 Public)

Parse a version 3 public PASETO token from human-readable text according to the message format defined in the specification.

Note that this function does not perform any kind of token validation, cryptographic or otherwise. It simply parses the token and ensures that it is well-formed.

parseTokenV4Local :: Text -> Either ParseError (Token V4 Local)

Parse a version 4 local PASETO token from human-readable text according to the message format defined in the specification.

Note that this function does not perform any kind of token validation, cryptographic or otherwise. It simply parses the token and ensures that it is well-formed.

parseTokenV4Public :: Text -> Either ParseError (Token V4 Public)

Parse a version 4 public PASETO token from human-readable text according to the message format defined in the specification.

Note that this function does not perform any kind of token validation, cryptographic or otherwise. It simply parses the token and ensures that it is well-formed.