at_client_mixins library

Classes

AtClientSecretSharing

Ready-made composition of the same-atSign secret-sharing mixins, for apps that don't want to mix them into their own classes.

EnrollmentDirectory

The atServer-backed directory of per-enrollment key packages.

KeyPackage

The X-Wing recipient key(s) one APKAM keypair advertises so that other clients of the same atSign can seal secrets to it.

NamespaceMember

One enrollment authorised for a namespace, as returned by EnrollmentDirectory.listForNamespace: its access level and the key package of its APKAM keypair.

PackageKey

One public key advertised in a KeyPackage.

PersistedApkamKeys

This APKAM keypair's X-Wing enc keypair, persisted (by an app callback) across restarts. xWingSeed is the base64 of the 32-byte X-Wing secret seed; the public key re-derives from it deterministically.

ReceivedEnvelope

A decrypted, signature-verified payload received from another APKAM keypair of the same atSign.

ReceivedSecret

A Secret another APKAM keypair of this atSign shared with this client.

Secret

A named secret, scoped to an application namespace.

SecretEnvelope

The encrypted payload one client of an atSign sends to another (addressed to a specific APKAM keypair). The whole envelope is additionally wrapped in an APKAM signature (see EnvelopeSigning) which receivers verify before decrypting.

SecretSharingAlgos

Registry of the algorithm identifiers used in per-APKAM key packages and secret envelopes.

SecretStore

In-memory store of the secrets this atSign's APKAM keypair holds, keyed by (namespace, name).

SecretStorePersistence

Supplied by the app to persist the SecretStore beyond the process lifetime (platform keystore, biometric storage, etc. — the app's concern). Without one, the store is in-memory only.

VerbEnrollmentDirectory

EnrollmentDirectory backed by the atServer's enroll:listns verb.

Mixins

ApkamSigning

AtClientBindings

EnvelopeSigning

Wraps payloads in signed JSON envelopes, and verifies envelopes created by other clients of the same or another atSign.

KeyPackageRegistration

Maintains this APKAM keypair's KeyPackage for same-atSign secret sharing.

PairwiseSecretSharing

Pairwise encrypted payload exchange between APKAM keypairs of the same atSign.

Typedefs

SecretRequestPolicy = FutureOr<bool> Function(ReceivedEnvelope request, KeyPackage requester)

Decides whether to answer an inbound kind:'request' secret pull from requester (already resolved + authorized as a key package of the request's namespace). Return true to share the requested held secrets, false to ignore. Set PairwiseSecretSharing.answerSecretRequests to override the default (answer any authorized same-atSign requester — the atServer already gates deliverability by namespace).