Attesto.StatusList (Attesto v1.14.0)

IETF Token Status List construction and verification.

Status values are packed into a compact bit array, compressed with zlib, and carried in a signed statuslist+jwt. Fetching is deliberately supplied by the host through resolver functions, so this module has no HTTP or Plug dependency.

Summary

Types

bits()

verified()

Functions

build(statuses, opts \\ [])

Build an unsigned status_list claim.

issue(keystore, uri, statuses, opts \\ [])

Build and sign a Status List Token for uri.

pack(statuses, bits)

Pack status values into bytes, placing the first entry in each byte's least significant field.

reference(uri, idx)

Build the status claim carried by a token that references a status list.

resolve(status_claim, resolver, jwks_or_resolver, opts \\ [])

Resolve a referenced token's status without performing HTTP.

sign(keystore, claims, opts \\ [])

Sign a caller-supplied Status List Token claim set with the required type.

status_at(packed, bits, idx)

Read the status value at idx from a packed status array.

verify(token, jwks, opts \\ [])

Verify and decode a Status List Token.

Types

bits()

@type bits() :: 1 | 2 | 4 | 8

verified()

@type verified() :: %{
  bits: bits(),
  statuses_binary: binary(),
  sub: String.t(),
  claims: map()
}

Functions

build(statuses, opts \\ [])

@spec build(
  [non_neg_integer()],
  keyword()
) :: %{required(String.t()) => term()}

Build an unsigned status_list claim.

:bits defaults to 1.

issue(keystore, uri, statuses, opts \\ [])

@spec issue(module(), String.t(), [non_neg_integer()], keyword()) :: String.t()

Build and sign a Status List Token for uri.

Options are :bits (default 1), :exp, :ttl, and :now.

pack(statuses, bits)

@spec pack([non_neg_integer()], bits()) :: binary()

Pack status values into bytes, placing the first entry in each byte's least significant field.

reference(uri, idx)

@spec reference(String.t(), non_neg_integer()) :: %{required(String.t()) => term()}

Build the status claim carried by a token that references a status list.

resolve(status_claim, resolver, jwks_or_resolver, opts \\ [])

@spec resolve(
  map(),
  (String.t() -> {:ok, String.t()} | {:error, term()}),
  term(),
  keyword()
) ::
  {:ok, non_neg_integer()} | {:error, term()}

Resolve a referenced token's status without performing HTTP.

resolver fetches the Status List Token for a URI and returns {:ok, token}. The third argument may be trusted JWKS directly or a function that resolves the trusted JWKS for that URI.

sign(keystore, claims, opts \\ [])

@spec sign(module(), map(), keyword()) :: String.t()

Sign a caller-supplied Status List Token claim set with the required type.

status_at(packed, bits, idx)

@spec status_at(binary(), bits(), non_neg_integer()) :: non_neg_integer()

Read the status value at idx from a packed status array.

verify(token, jwks, opts \\ [])

@spec verify(String.t(), map() | [map()], keyword()) ::
  {:ok, verified()} | {:error, atom()}

Verify and decode a Status List Token.

:accepted_algs limits the trusted signing algorithms. By default all asymmetric algorithms supported by Attesto are accepted.