client

type Client struct {
	// Client is interface to use for raw RPC calls to the token server.
	//
	// Use minter.NewTokenMinterClient to create it. Note that transport-level
	// authentication is not needed.
	Client TokenMinterClient

	// Signer knows how to sign requests using some private key.
	Signer Signer
}

type Parameters struct {
	// PrivateKeyPath is a path to a file with a private key PEM file.
	//
	// Required.
	PrivateKeyPath string

	// CertificatePath is a path to a file with a corresponding certificate.
	//
	// Required. It must match the private key (this will be verified).
	CertificatePath string

	// Backend is a hostname of the token server to talk to.
	//
	// Required.
	Backend string

	// Insecure is true to use 'http' protocol instead of 'https'.
	//
	// Useful on localhost. Default is "secure".
	Insecure bool

	// Client is non-authenticating HTTP client to build pRPC transport on top of.
	//
	// Default is http.DefaultClient.
	Client *http.Client

	// Retry defines how to retry RPC requests on transient errors.
	//
	// Use retry.Default for default strategy. Default is "no retries".
	Retry retry.Factory
}

type RPCError struct {
	GrpcCode       codes.Code       // grpc-level status code
	ErrorCode      minter.ErrorCode // protocol-level status code
	ServiceVersion string           // version of the backend, if known
	// contains filtered or unexported fields
}

type Signer interface {
	// Algo returns an algorithm that the signer implements.
	Algo(ctx context.Context) (x509.SignatureAlgorithm, error)

	// Certificate returns ASN.1 DER blob with the certificate of the signer.
	Certificate(ctx context.Context) ([]byte, error)

	// Sign signs a blob using the private key.
	Sign(ctx context.Context, blob []byte) ([]byte, error)
}

type TokenMinterClient interface {
	// MintMachineToken generates a new token for an authenticated machine.
	MintMachineToken(context.Context, *minter.MintMachineTokenRequest, ...grpc.CallOption) (*minter.MintMachineTokenResponse, error)
}

type X509Signer struct {
	// PrivateKeyPEM is PEM-encoded ASN.1 PKCS#1 private key.
	//
	// See https://openssl.org/docs/manmaster/apps/rsa.html.
	PrivateKeyPEM []byte

	// CertificatePEM is PEM-encoded ASN.1 x509 certificate.
	//
	// It must contain a public key matching the private key specified by
	// PrivateKeyPEM (this will be verified).
	//
	// See https://openssl.org/docs/manmaster/apps/x509.html.
	CertificatePEM []byte
	// contains filtered or unexported fields
}