---

Class ::nsmcp::BearerAuthenticator

::nsmcp::BearerAuthenticator create ... \
           [ -store:required store:required ]

Only the table name enters the blueprint. Credential records live in nsv.

Defined in /usr/local/ns/tcl/nsmcp/lib/security.tcl

Class Relations

• class: ::nx::Class
• superclass: ::nsmcp::Authenticator

::nx::Class create ::nsmcp::BearerAuthenticator \
     -superclass ::nsmcp::Authenticator

Methods (to be applied on instances)

• authenticate (scripted, public)

   <instance of nsmcp::BearerAuthenticator> authenticate \
      authorization server

  Parameters:

  authorization (required)

  server (required)

  Testcases:

  No testcase defined.

  if {![regexp {^Bearer ([A-Za-z0-9._~+/-]+=*)$} $authorization -> token]} {
      return [next]
  }
  set digest [ns_crypto::md string -digest sha256 -- $token]
  if {![nsv_get ${:store} $digest record] ||
      ([dict get $record expires] != 0 && [dict get $record expires] <= [clock seconds])} {return [next]}
  return [::nsmcp::RequestContext new  -principal [dict get $record principal]  -permissions [dict get $record permissions]  -targets [dict get $record targets] -server $server]

• credentialInfo (scripted, public)

   <instance of nsmcp::BearerAuthenticator> credentialInfo digest

  Parameters:

  digest (required)

  Testcases:

  No testcase defined.

  if {![nsv_get ${:store} $digest record]} {return {}}
  return $record

• grant (scripted, public)

   <instance of nsmcp::BearerAuthenticator> grant token principal \
      permissions targets expires

  Parameters:

  token (required)

  principal (required)

  permissions (required)

  targets (required)

  expires (required)

  Testcases:

  No testcase defined.

  if {[string length $token] < 32 || $principal eq "" ||
      ![string is wideinteger -strict $expires] || ($expires != 0 && $expires <= [clock seconds])} {
      error "expected a high-entropy token, named principal and expiry of zero or a future timestamp"
  }
  set digest [ns_crypto::md string -digest sha256 -- $token]
  nsv_set ${:store} $digest [dict create principal $principal  permissions $permissions targets $targets expires $expires]
  return $digest

• issue (scripted, public)

   <instance of nsmcp::BearerAuthenticator> issue principal \
      permissions targets expires

  Explicit administrative operation; never called automatically at init. Return the secret once, without logging it or storing it in nsv.

  Parameters:

  principal (required)

  permissions (required)

  targets (required)

  expires (required)

  Testcases:

  No testcase defined.

  set token [ns_crypto::randombytes -encoding hex 32]
  set digest [:grant $token $principal $permissions $targets $expires]
  return [dict create token $token digest $digest expires $expires]

• revoke (scripted, public)

   <instance of nsmcp::BearerAuthenticator> revoke digest

  Parameters:

  digest (required)

  Testcases:

  No testcase defined.

  nsv_unset -nocomplain ${:store} $digest

---