BoundedAuthorityProtocol.V3.Grant (Bounded Authority Protocol v1.0.0)

Copy Markdown View Source

Closed deterministic grant producer input.

Fields

  • key_id - the issuer key identifier written to the protected kid header: 1 to kid_bytes (128) bytes of ASCII letters, digits, -, ., _ or ~. An untrusted lookup hint, never a trust selector.
  • issuer - the iss claim: non-empty StringOrURI of at most identifier_bytes (512) UTF-8 bytes, compared byte-for-byte.
  • grant_id - the jti claim: non-empty StringOrURI of at most identifier_bytes (512) UTF-8 bytes.
  • audiences - the aud claim: a nonempty list of unique StringOrURI values, at most audiences (64) entries of at most identifier_bytes bytes each.
  • issued_at - the iat claim, integer Unix time in seconds.
  • not_before - the nbf claim, integer Unix time in seconds.
  • expires_at - the exp claim, integer Unix time in seconds; it must be after both issued_at and not_before (issued_at <= not_before is not required).
  • holder_thumbprint - the holder confirmation (cnf.jkt) as the raw 32-byte RFC 7638 SHA-256 thumbprint of the holder's public JWK, not base64url; compute it with BoundedAuthorityProtocol.V3.EcJwk.public_key_thumbprint_raw/2.
  • operations - a nonempty list of at most operations (64) BoundedAuthorityProtocol.V3.Operation structs with unique names.

Summary

Types

t()

Producer input for BoundedAuthorityProtocol.V3.grant_signing_input/2.

Types

t()

@type t() :: %BoundedAuthorityProtocol.V3.Grant{
  audiences: [binary()],
  expires_at: integer(),
  grant_id: binary(),
  holder_thumbprint: binary(),
  issued_at: integer(),
  issuer: binary(),
  key_id: binary(),
  not_before: integer(),
  operations: [BoundedAuthorityProtocol.V3.Operation.t()]
}

Producer input for BoundedAuthorityProtocol.V3.grant_signing_input/2.