Documentation
¶
Overview ¶
Package sessionx implements FedRAMP AC-7 account lockout, AC-11 inactivity timeout, and AC-12 session termination tracking. The runtime is decoupled from the audit pipeline: callers wire the tracker into middleware (see middleware.go) and emit audit events via the auditx package.
Index ¶
- Variables
- type Config
- type State
- type Store
- type Tracker
- func (t *Tracker) AssertActive(ctx context.Context, subject string) error
- func (t *Tracker) AssertNotLocked(ctx context.Context, subject string) error
- func (t *Tracker) RecordFailure(ctx context.Context, subject string) error
- func (t *Tracker) RecordSuccess(ctx context.Context, subject string) error
- func (t *Tracker) Terminate(ctx context.Context, subject string) error
- func (t *Tracker) Touch(ctx context.Context, subject string) error
Constants ¶
This section is empty.
Variables ¶
var ( ErrAccountLocked = errors.New("sessionx: account locked") ErrInactive = errors.New("sessionx: session inactive (AC-11)") ErrTerminated = errors.New("sessionx: session terminated (AC-12)") )
Sentinel errors.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// MaxFailures is the AC-7 threshold; 0 disables lockout.
MaxFailures int
// LockoutDuration is the AC-7 cooldown.
LockoutDuration time.Duration
// InactivityWindow is the AC-11 idle timeout; 0 disables.
InactivityWindow time.Duration
// AbsoluteSessionLifetime is the AC-12 hard cap on session age; 0 disables.
AbsoluteSessionLifetime time.Duration
// Store backs persistence; required.
Store Store
}
Config tunes the Tracker.
type Store ¶
type Store interface {
Load(ctx context.Context, subject string) (State, error)
Save(ctx context.Context, subject string, st State) error
}
Store is the pluggable persistence layer. Implementations MUST be safe for concurrent calls. The memory implementation is suitable for single-instance deployments; horizontally-scaled deployments need a Redis-backed store (out of scope for this commit).
func NewMemoryStore ¶
func NewMemoryStore() Store
NewMemoryStore returns a non-persistent Store for tests and single-instance dev. Production deployments behind a load balancer MUST plug in a Redis-backed Store implementation (out of scope here).
type Tracker ¶
type Tracker struct {
// contains filtered or unexported fields
}
Tracker is the public façade.
func NewTracker ¶
NewTracker validates cfg and constructs a Tracker.
func (*Tracker) AssertActive ¶
AssertActive returns ErrInactive when the subject has been idle longer than InactivityWindow, and ErrTerminated when SessionStart is older than AbsoluteSessionLifetime.
func (*Tracker) AssertNotLocked ¶
AssertNotLocked returns ErrAccountLocked when the subject is still in the lockout window. Used before authentication attempts.
func (*Tracker) RecordFailure ¶
RecordFailure increments the failure counter for subject. When the counter reaches MaxFailures, the subject is locked until LockoutDuration elapses. APPSEC-07: uses Store.Modify when available to make the load-mutate-save atomic; falls back to the legacy load/save pattern only for stores that have not adopted Modify yet.
func (*Tracker) RecordSuccess ¶
RecordSuccess clears the failure counter and refreshes session timestamps.
A-S7 defensive guard: if the subject is still inside an active lockout window, RecordSuccess MUST NOT clear LockedUntil. AC-7 lockout depends on callers invoking AssertNotLocked first, but a misordered call site could otherwise "rescue" a locked account by recording a fabricated success. Failures are still cleared (the success itself is a fresh signal) but the lock countdown stays intact until time.Now() crosses it.
Source Files