Skip to content

v0.58.0 — verify-only credential field mode (WS-033)

Latest
Latest

Choose a tag to compare

View all tags
@daniel-garcia daniel-garcia released this 04 Jul 21:25
v0.58.0
3a76fc9

Verify-only credential field mode (WS-033)

A new field mode for API keys and tokens: credential — "hash, never encrypt". Unlike secret (which keeps a reversible cipher so the value can be read back), a credential is SDK-minted, returned to the client once, and only ever verified — there is no reversible copy at rest.

  • secret.CredentialMinter. Mints a prefixed split token <prefix>_<public_id>_<secret> and returns it to the caller exactly once; persists only public_id (UNIQUE lookup key) + salt + a salted one-way hash + a self-describing hash spec. Default SHA-512/256 over a 256-bit secret; SHA-384 and PBKDF2-SHA256 selectable for verify-time agility. Stdlib crypto only — FIPS-clean, no HMAC, no new dependencies.
  • credential: true codegen. The storage generators emit <field>_public_id / _salt / _hash / _hashspec (no plaintext, no cipher), mint on Create and return the token once, generate Verify<Field> for constant-time verification, and omit the field from every read response. Fails loud on credential+secret collision or a non-string credential field.
  • Consumes the canonical github.com/infobloxopen/apis/proto/infoblox/field v1.0.0-alpha.4 annotation.

Compatibility: additive (a new annotation). Switching a field from secret to credential is a schema change and old values cannot be migrated (the framework never held a safe copy) — re-issue those credentials.

Synchronized 10-module release (root + 9 adapters), all tagged at v0.58.0.

Assets 2
Loading