func decodeCaveatV1(key *KeyPair, caveat []byte) (*ThirdPartyCaveatInfo, error) {
	data := make([]byte, (3*len(caveat)+3)/4)
	n, err := base64.StdEncoding.Decode(data, caveat)
	if err != nil {
		return nil, errgo.Notef(err, "cannot base64-decode caveat")
	}
	data = data[:n]
	var wrapper caveatJSON
	if err := json.Unmarshal(data, &wrapper); err != nil {
		return nil, errgo.Notef(err, "cannot unmarshal caveat %q", data)
	}
	if !bytes.Equal(key.Public.Key[:], wrapper.ThirdPartyPublicKey.Key[:]) {
		return nil, errgo.New("public key mismatch")
	}
	if wrapper.FirstPartyPublicKey == nil {
		return nil, errgo.New("target service public key not specified")
	}
	// The encrypted string is base64 encoded in the JSON representation.
	secret, err := base64.StdEncoding.DecodeString(wrapper.Id)
	if err != nil {
		return nil, errgo.Notef(err, "cannot base64-decode encrypted data")
	}
	var nonce [NonceLen]byte
	if copy(nonce[:], wrapper.Nonce) < NonceLen {
		return nil, errgo.Newf("nonce too short %x", wrapper.Nonce)
	}
	c, ok := box.Open(nil, secret, &nonce, wrapper.FirstPartyPublicKey.boxKey(), key.Private.boxKey())
	if !ok {
		return nil, errgo.Newf("cannot decrypt caveat %#v", wrapper)
	}
	var record caveatRecord
	if err := json.Unmarshal(c, &record); err != nil {
		return nil, errgo.Notef(err, "cannot decode third party caveat record")
	}
	return &ThirdPartyCaveatInfo{
		Condition:           []byte(record.Condition),
		FirstPartyPublicKey: *wrapper.FirstPartyPublicKey,
		ThirdPartyKeyPair:   *key,
		RootKey:             record.RootKey,
		Caveat:              caveat,
		Version:             Version1,
		Namespace:           legacyNamespace(),
	}, nil
}
// decodeCaveatV1 attempts to decode a base64 encoded JSON id. This
// encoding is nominally version -1.
decodeCaveatV1 attempts to decode a base64 encoded JSON id. This
encoding is nominally version -1.
// decodeCaveatV1 attempts to decode a base64 encoded JSON id . This // encoding is nominally version - 1 .
func decodeCaveatV1(key *KeyPair, caveat []byte) (*ThirdPartyCaveatInfo, error) {
	data := make([]byte, (3*len(caveat)+3)/4)
	n, err := base64.StdEncoding.Decode(data, caveat)
	if err != nil {
		return nil, errgo.Notef(err, "cannot base64-decode caveat")
	}
	data = data[:n]
	var wrapper caveatJSON
	if err := json.Unmarshal(data, &wrapper); err != nil {
		return nil, errgo.Notef(err, "cannot unmarshal caveat %q", data)
	}
	if !bytes.Equal(key.Public.Key[:], wrapper.ThirdPartyPublicKey.Key[:]) {
		return nil, errgo.New("public key mismatch")
	}
	if wrapper.FirstPartyPublicKey == nil {
		return nil, errgo.New("target service public key not specified")
	}
	secret, err := base64.StdEncoding.DecodeString(wrapper.Id)
	if err != nil {
		return nil, errgo.Notef(err, "cannot base64-decode encrypted data")
	}
	var nonce [NonceLen]byte
	if copy(nonce[:], wrapper.Nonce) < NonceLen {
		return nil, errgo.Newf("nonce too short %x", wrapper.Nonce)
	}
	c, ok := box.Open(nil, secret, &nonce, wrapper.FirstPartyPublicKey.boxKey(), key.Private.boxKey())
	if !ok {
		return nil, errgo.Newf("cannot decrypt caveat %#v", wrapper)
	}
	var record caveatRecord
	if err := json.Unmarshal(c, &record); err != nil {
		return nil, errgo.Notef(err, "cannot decode third party caveat record")
	}
	return &ThirdPartyCaveatInfo{
		Condition:           []byte(record.Condition),
		FirstPartyPublicKey: *wrapper.FirstPartyPublicKey,
		ThirdPartyKeyPair:   *key,
		RootKey:             record.RootKey,
		Caveat:              caveat,
		Version:             Version1,
		Namespace:           legacyNamespace(),
	}, nil
}
func decodeCaveatV1 ( key * KeyPair , caveat [ ] byte ) ( * ThirdPartyCaveatInfo , error ) { data := make ( [ ] byte , ( 3 * len ( caveat ) + 3 ) / 4 ) n , err := base64 . StdEncoding . Decode ( data , caveat ) if err != nil { return nil , errgo . Notef ( err , " " ) } data = data [ : n ] var wrapper caveatJSON if err := json . Unmarshal ( data , & wrapper ) ; err != nil { return nil , errgo . Notef ( err , " " , data ) } if ! bytes . Equal ( key . Public . Key [ : ] , wrapper . ThirdPartyPublicKey . Key [ : ] ) { return nil , errgo . New ( " " ) } if wrapper . FirstPartyPublicKey == nil { return nil , errgo . New ( " " ) } secret , err := base64 . StdEncoding . DecodeString ( wrapper . Id ) if err != nil { return nil , errgo . Notef ( err , " " ) } var nonce [ NonceLen ] byte if copy ( nonce [ : ] , wrapper . Nonce ) < NonceLen { return nil , errgo . Newf ( " " , wrapper . Nonce ) } c , ok := box . Open ( nil , secret , & nonce , wrapper . FirstPartyPublicKey . boxKey ( ) , key . Private . boxKey ( ) ) if ! ok { return nil , errgo . Newf ( " " , wrapper ) } var record caveatRecord if err := json . Unmarshal ( c , & record ) ; err != nil { return nil , errgo . Notef ( err , " " ) } return & ThirdPartyCaveatInfo { Condition : [ ] byte ( record . Condition ) , FirstPartyPublicKey : * wrapper . FirstPartyPublicKey , ThirdPartyKeyPair : * key , RootKey : record . RootKey , Caveat : caveat , Version : Version1 , Namespace : legacyNamespace ( ) , } , nil }
decodeCaveatV1 attempts to decode a base64 encoded JSON id.
decodeCaveatV1 attempts to decode a base64 encoded JSON id .
// The encrypted string is base64 encoded in the JSON representation.