public

func AllowSensitivePasswordCheck ¶ added in v0.1.14

func AllowSensitivePasswordCheck(ip, account string) (bool, time.Duration)

Step-up password checks share the login buckets.

The 2FA re-enrollment endpoint asks the same question as login ("is this the account password?") for the same account, so it must spend the same budget: a stolen session must not turn re-enrollment into an unlimited password oracle that the login limiter cannot see.

func Login ¶

func Login(c *gin.Context)

func Logout ¶

func Logout(c *gin.Context)

func OAuth ¶

func OAuth(c *gin.Context)

/api/oauth

func OAuthCallback ¶

func OAuthCallback(c *gin.Context)

/api/oauth_callback

func RecordSensitivePasswordFailure ¶ added in v0.1.14

func RecordSensitivePasswordFailure(ip, account string)

RecordSensitivePasswordFailure consumes one token from both step-up buckets.

func ResetSensitivePasswordFailures ¶ added in v0.1.14

func ResetSensitivePasswordFailures(account string)

ResetSensitivePasswordFailures clears the account bucket after a correct password, exactly as a successful login does.

func ServePluginFile ¶

func ServePluginFile(c *gin.Context)

ServePluginFile serves a public iframe page declared in a plugin manifest (visibility=public). It is reachable without authentication; the plugin must be enabled and the requested file must be listed as a public page.