Lightning.ServiceAccount (Lightning v2.20.1)

An identity that is not a person and proves who it is with an RSA key pair.

Its id is the RFC 7638 thumbprint of its public key, so a new key is a new service account. Its uuid, for places that need one such as an audit event's actor, is a UUIDv5 of the thumbprint's RFC 9278 URI in the RFC 4122 URL namespace, which any stock uuid5 implementation reproduces.

grants are the scopes of the access token the request came in with. The account registered at boot holds none, so it is refused every action that needs a grant.

Summary

Types

t()

Functions

from_pem(pem)

Reads the service account from its public key's PEM text.

Types

t()

@type t() :: %Lightning.ServiceAccount{
  grants: MapSet.t(String.t()),
  id: String.t(),
  public_key: JOSE.JWK.t(),
  uuid: Ecto.UUID.t()
}

Functions

from_pem(pem)

@spec from_pem(String.t()) ::
  {:ok, t()}
  | {:error, :private_key | :not_rsa | {:too_small, pos_integer()} | :not_a_key}

Reads the service account from its public key's PEM text.

Refuses anything but an RSA public key of at least 2048 bits: {:too_small, bits} for a shorter RSA key, :private_key for an RSA private key, :not_rsa for any other kind of key, and :not_a_key for text JOSE can't read as a key.