auth

package

v1.0.0 Latest Latest Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Arylite/netprobe

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth handles UI accounts: password login and cookie sessions. Who may call what is a Policy given by the services; what is recorded goes to an Auditor.

Index ¶

Constants
func Actor(ctx context.Context) string
func HashPassword(ctx context.Context, password string) (string, error)
func NewUser(ctx context.Context, username, password string, role store.Role, now time.Time) (store.User, error)
func NormalizeUsername(u string) string
func Protect(apiPrefixes []string, next http.Handler) http.Handler
func RoleFromProto(r netprobev1.Role) (store.Role, bool)
func RoleProto(r store.Role) netprobev1.Role
func UserProto(u store.User) *netprobev1.User
func ValidatePassword(password, username string) error
func ValidateUsername(u string) error
func VerifyPassword(ctx context.Context, password, encoded string) (bool, error)
type Auditor
type Policy
type Principal
- func From(ctx context.Context) (Principal, bool)
type Service
- func New(st Store, secureCookie bool, allow Policy, audit Auditor) (*Service, error)
- func (s *Service) Authenticate(ctx context.Context, h http.Header) (Principal, error)
- func (s *Service) ChangePassword(ctx context.Context, req *connect.Request[netprobev1.ChangePasswordRequest]) (_ *connect.Response[netprobev1.ChangePasswordResponse], err error)
- func (s *Service) Interceptor() connect.UnaryInterceptorFunc
- func (s *Service) Login(ctx context.Context, req *connect.Request[netprobev1.LoginRequest]) (res *connect.Response[netprobev1.LoginResponse], err error)
- func (s *Service) Logout(ctx context.Context, req *connect.Request[netprobev1.LogoutRequest]) (*connect.Response[netprobev1.LogoutResponse], error)
- func (s *Service) Me(ctx context.Context, req *connect.Request[netprobev1.MeRequest]) (*connect.Response[netprobev1.MeResponse], error)
- func (s *Service) Purge(ctx context.Context)
type Store

Constants ¶

View Source

const (
	// A session ends after this long without a request...
	IdleTimeout = 12 * time.Hour
	// ...and after this long anyway.
	MaxAge = 7 * 24 * time.Hour
)

View Source

const (
	MinPasswordLen = 8 // characters

)

Variables ¶

This section is empty.

Functions ¶

func Actor ¶

func Actor(ctx context.Context) string

Actor is the username of the session in ctx, or "anonymous".

func HashPassword ¶

func HashPassword(ctx context.Context, password string) (string, error)

HashPassword returns an argon2id PHC string.

func NewUser ¶

func NewUser(ctx context.Context, username, password string, role store.Role, now time.Time) (store.User, error)

NewUser validates and hashes a new account.

func NormalizeUsername ¶

func NormalizeUsername(u string) string

NormalizeUsername is how usernames are compared and stored.

func Protect ¶

func Protect(apiPrefixes []string, next http.Handler) http.Handler

Protect adds security headers and refuses cross-site requests that change state (Sec-Fetch-Site and Origin checks), on top of the SameSite=Strict cookie.

func RoleFromProto ¶

func RoleFromProto(r netprobev1.Role) (store.Role, bool)

RoleFromProto returns false for an unknown role.

func RoleProto ¶

func RoleProto(r store.Role) netprobev1.Role

func UserProto ¶

func UserProto(u store.User) *netprobev1.User

UserProto never includes the password hash.

func ValidatePassword ¶

func ValidatePassword(password, username string) error

ValidatePassword checks the password policy.

func ValidateUsername ¶

func ValidateUsername(u string) error

ValidateUsername checks a username, already lowercased.

func VerifyPassword ¶

func VerifyPassword(ctx context.Context, password, encoded string) (bool, error)

VerifyPassword compares a password with a PHC string, in constant time.

Types ¶

type Auditor ¶

type Auditor interface {
	Record(ctx context.Context, actor, action string, err error, clientIP string, req proto.Message)
}

Auditor records sign ins, sign outs, password changes and refused calls.

type Policy ¶

type Policy func(role store.Role, procedure string) bool

Policy reports whether a role may call a procedure.

type Principal ¶

type Principal struct {
	User      store.User
	TokenHash []byte
}

Principal is the authenticated user of a request.

func From ¶

func From(ctx context.Context) (Principal, bool)

From returns the user set by the interceptor.

type Service ¶

type Service struct {
	Store Store
	// Secure cookies (HTTPS or localhost). Only false for plain HTTP tests.
	SecureCookie bool
	Allow        Policy
	Audit        Auditor
	// contains filtered or unexported fields
}

Service implements AuthService and checks the session of API requests.

func New ¶

func New(st Store, secureCookie bool, allow Policy, audit Auditor) (*Service, error)

func (*Service) Authenticate ¶

func (s *Service) Authenticate(ctx context.Context, h http.Header) (Principal, error)

Authenticate returns the user of the session cookie in h.

func (*Service) ChangePassword ¶

func (s *Service) ChangePassword(ctx context.Context, req *connect.Request[netprobev1.ChangePasswordRequest]) (_ *connect.Response[netprobev1.ChangePasswordResponse], err error)

func (*Service) Interceptor ¶

func (s *Service) Interceptor() connect.UnaryInterceptorFunc

Interceptor requires a session on every call and asks the policy.

func (s *Service) Login(ctx context.Context, req *connect.Request[netprobev1.LoginRequest]) (res *connect.Response[netprobev1.LoginResponse], err error)

func (*Service) Logout ¶

func (s *Service) Logout(ctx context.Context, req *connect.Request[netprobev1.LogoutRequest]) (*connect.Response[netprobev1.LogoutResponse], error)

func (*Service) Me ¶

func (s *Service) Me(ctx context.Context, req *connect.Request[netprobev1.MeRequest]) (*connect.Response[netprobev1.MeResponse], error)

func (*Service) Purge ¶

func (s *Service) Purge(ctx context.Context)

Purge deletes dead sessions every hour until ctx ends.

type Store ¶

type Store interface {
	UserByName(ctx context.Context, username string) (store.User, error)
	CreateSession(ctx context.Context, s store.Session) error
	SessionUser(ctx context.Context, tokenHash []byte, now, idleSince time.Time) (store.Session, store.User, error)
	TouchSession(ctx context.Context, tokenHash []byte, now time.Time) error
	DeleteSession(ctx context.Context, tokenHash []byte) error
	SetPassword(ctx context.Context, id uuid.UUID, hash string, keep []byte, now time.Time) error
	PurgeSessions(ctx context.Context, now, idleSince time.Time) (int64, error)
}

Store is what auth needs from the database.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL