public sealed class TransferTicketSignerMints tickets, and is the only thing that can tell a real one from a made-up one.
Remarks
HMAC-SHA256 over Canonical, with a symmetric key every realm in a cluster holds and no client ever does. Symmetric rather than a signature scheme because the verifier and the issuer are inside the same trust boundary — the orchestrator mints, the realms verify, and both are processes the operator runs. A public-key scheme would buy the ability to verify without being able to mint, which nothing here needs and which costs a key distribution story.
⚠ The key is a secret, and it is the whole of the security of admission. Anyone holding it can admit anyone to anything. It belongs in whatever the deployment already uses for secrets and never in a RealmSpec, which is visible in a process listing.
Fields and properties (1)
public const int MinimumKeyBytesThe shortest key this will accept — the hash's own output size.
Methods (4)
public TransferTicketSigner(ReadOnlySpan<byte> clusterKey)Holds a cluster key.
public TransferTicket Sign(TransferTicket ticket)Signs a ticket.
public TicketStatus Validate(TransferTicket ticket, ShardId shard, DateTimeOffset now)Decides whether a ticket admits its bearer to a given shard, right now.
public void Dispose()Releases the key.
Used by (14)
- ArrivalTestsVixen.Live.Transfer.Tests
- GateServiceVixen.Live.Gate
- GateServiceTestsVixen.Live.Gate.Tests
- PlayerAdmissionVixen.Live.Realm
- RealmVixen.Live.Realm
- RealmVixen.Live.Realm.Tests
- RealmClusterTestsVixen.Live.Realm.Cluster.Tests
- RealmFixtureVixen.Live.Realm.Tests
- RealmHostVixen.Live.Realm
- RealmHostTestsVixen.Live.Realm.Tests
- SourceTransferTestsVixen.Live.Transfer.Tests
- TransferFleetVixen.Live.Realm.Tests
- TransferMetricsTestsVixen.Live.Transfer.Tests
- TransferTicketTestsVixen.Live.Abstractions.Tests