Documentation
¶
Overview ¶
Package authtoken implements the one-time session token store used by yarilo-auth to hand off authenticated sessions to backend pods without replaying credentials.
Flow:
- Login pod authenticates the client via the yarilo-auth AUTH command.
- On success yarilo-auth issues a token (Store.Issue) and returns it in the OK response as "token=<hex>".
- Login pod forwards the token to the backend in the preamble (XCLIENT TOKEN=<hex>).
- Backend calls yarilo-auth VERIFY <id> <token>.
- Store.Validate consumes the token (one-time) and returns the bound username and session ID so the backend can enter authenticated state without running passdb again.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type RedisStore ¶ added in v1.66.0
type RedisStore struct {
// contains filtered or unexported fields
}
RedisStore is a Redis-backed one-time token store. GETDEL provides atomic consume; Redis TTL replaces the background sweeper.
func NewRedis ¶ added in v1.66.0
func NewRedis(client *redis.Client, ttl time.Duration) *RedisStore
NewRedis returns a RedisStore. The caller owns the client lifecycle; Close is a no-op.
func (*RedisStore) Close ¶ added in v1.66.0
func (s *RedisStore) Close()
Close is a no-op; the caller manages the Redis client lifecycle.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store issues and validates one-time session tokens. Each token is a 32-byte random value encoded as a 64-char hex string. It is valid for the configured TTL and consumed on the first successful Validate call.
The background sweeper purges tokens that expire before they are consumed (e.g. backend died mid-handshake).
Source Files