admin

package

Go to main page

Versions in this module

v1

v1.3.0

Oct 23, 2026

Changes in this version

+ const ActionDeleteUser

+ const ActionDisableUser

+ const ActionEnableUser

+ const ActionInspectAccounts

+ const ActionInspectCredentials

+ const ActionListUsers

+ const ActionLookupUser

+ const ActionResetPassword

+ const ActionRevokeSessions

+ const ActionSetAdmin

+ const ActionVerifyEmail

+ const EventAdminRoleAssigned

+ const EventEmailVerified

+ const EventPasswordResetInitiated

+ const EventUserDisabled

+ const EventUserEnabled

+ const ModelAdminUsers

+ var ErrCannotDisableSelf = errors.New("admin: cannot disable own administrator account")

+ var ErrInvalidInput = errors.New("admin: invalid input parameters")

+ var ErrOrganizationsNotInstalled = errors.New("admin: organizations plugin not installed or configured")

+ var ErrStoreRequired = errors.New("admin: store is required")

+ var ErrUserAlreadyDisabled = errors.New("admin: user is already disabled")

+ var ErrUserDisabled = errors.New("admin: user account is disabled")

+ var ErrUserNotDisabled = errors.New("admin: user is not disabled")

+ var ErrUserNotInOrganization = errors.New("admin: target user does not belong to specified organization")

+ func RegisterSchema(s *schema.Schema) error

+ type AccountDetail struct

+ CreatedAt time.Time

+ ID string

+ Provider string

+ ProviderID string

+ UpdatedAt time.Time

+ UserID string

+ type Admin interface

+ DeleteUser func(ctx context.Context, p auth.Principal, targetUserID string) error

+ DisableUser func(ctx context.Context, p auth.Principal, targetUserID string, reason string) error

+ EnableUser func(ctx context.Context, p auth.Principal, targetUserID string) error

+ ForOrg func(orgID string) ScopedAdmin

+ InitiatePasswordReset func(ctx context.Context, p auth.Principal, targetUserID string) (string, error)

+ InspectAccounts func(ctx context.Context, p auth.Principal, targetUserID string) ([]AccountDetail, error)

+ InspectCredentials func(ctx context.Context, p auth.Principal, targetUserID string) ([]CredentialDetail, error)

+ IsUserDisabled func(ctx context.Context, userID string) (bool, error)

+ ListUsers func(ctx context.Context, p auth.Principal, filter ListFilter) (*UserListResult, error)

+ LookupUser func(ctx context.Context, p auth.Principal, userID string) (*UserDetail, error)

+ LookupUserByEmail func(ctx context.Context, p auth.Principal, email string) (*UserDetail, error)

+ RevokeUserSessions func(ctx context.Context, p auth.Principal, targetUserID string) error

+ SetAdminStatus func(ctx context.Context, p auth.Principal, targetUserID string, isAdmin bool, ...) error

+ VerifyUserEmail func(ctx context.Context, p auth.Principal, targetUserID string) error

+ type AdminRoleAssignedPayload struct

+ ActorID string

+ AssignedAt time.Time

+ IsAdmin bool

+ Role string

+ TargetUserID string

+ type Authorizer interface

+ Authorize func(ctx context.Context, p auth.Principal, action string, targetUserID string) error

+ type AuthorizerFunc func(ctx context.Context, p auth.Principal, action string, targetUserID string) error

+ func (f AuthorizerFunc) Authorize(ctx context.Context, p auth.Principal, action string, targetUserID string) error

+ type Capability = Admin

type Config

+ Authorizer Authorizer

+ CacheTTL time.Duration

+ Organizations organizations.Organization

+ type CredentialDetail struct

+ AccountID string

+ CreatedAt time.Time

+ ID string

+ RevokedAt *time.Time

+ Type string

+ UpdatedAt time.Time

+ UserID string

+ type EmailVerifiedPayload struct

+ ActorID string

+ TargetUserID string

+ VerifiedAt time.Time

+ type ListFilter struct

+ Limit int

+ Offset int

+ Search string

+ Status string

+ type Module struct

+ func (m *Module) ID() string

+ func (m *Module) Init(h *auth.Host) error

+ func (m *Module) RegisterSchema(s *schema.Schema) error

type Option

+ func WithAuthorizer(a Authorizer) Option

+ func WithAuthorizerFunc(...) Option

+ func WithCacheTTL(ttl time.Duration) Option

+ func WithOrganizations(orgs organizations.Organization) Option

+ type PasswordResetInitiatedPayload struct

+ ActorID string

+ InitiatedAt time.Time

+ TargetUserID string

+ type ScopedAdmin interface

+ DisableUser func(ctx context.Context, p auth.Principal, targetUserID string, reason string) error

+ EnableUser func(ctx context.Context, p auth.Principal, targetUserID string) error

+ InspectAccounts func(ctx context.Context, p auth.Principal, targetUserID string) ([]AccountDetail, error)

+ InspectCredentials func(ctx context.Context, p auth.Principal, targetUserID string) ([]CredentialDetail, error)

+ ListUsers func(ctx context.Context, p auth.Principal, filter ListFilter) (*UserListResult, error)

+ LookupUser func(ctx context.Context, p auth.Principal, userID string) (*UserDetail, error)

+ RemoveUser func(ctx context.Context, p auth.Principal, targetUserID string) error

+ RevokeUserSessions func(ctx context.Context, p auth.Principal, targetUserID string) error

+ type ScopedAdminPrincipal struct

+ OrganizationID string

+ Principal auth.Principal

+ type SessionDetail struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ RevokedAt *time.Time

+ UserID string

+ type SessionRevokedPayload struct

+ ActorID string

+ RevokedAt time.Time

+ TargetUserID string

+ type UserDeletedPayload struct

+ ActorID string

+ DeletedAt time.Time

+ TargetUserID string

+ type UserDetail struct

+ Accounts []AccountDetail

+ Credentials []CredentialDetail

+ Record *UserRecord

+ Sessions []SessionDetail

+ User *user.User

+ type UserDisabledPayload struct

+ ActorID string

+ DisabledAt time.Time

+ Reason string

+ TargetUserID string

+ type UserEnabledPayload struct

+ ActorID string

+ EnabledAt time.Time

+ TargetUserID string

+ type UserListResult struct

+ Limit int

+ Offset int

+ Total int

+ Users []*UserRecord

+ type UserRecord struct

+ CreatedAt time.Time

+ Disabled bool

+ DisabledAt *time.Time

+ DisabledReason string

+ Email string

+ IsAdmin bool

+ Metadata map[string]string

+ Role string

+ UpdatedAt time.Time

+ UserID string

+ func (r *UserRecord) Active() bool

v1.2.0

Sep 16, 2026

v1.1.0

Sep 14, 2026

Changes in this version

type CallerContext

+ SessionToken string

v1.0.1

Sep 8, 2026

v1.0.0

Sep 8, 2026

v0

v0.27.2

Aug 31, 2026

v0.27.1

Aug 31, 2026

v0.27.0

Aug 28, 2026

v0.26.0

Aug 28, 2026

v0.25.0

Aug 27, 2026

v0.24.0

Aug 27, 2026

v0.23.1

Aug 27, 2026

v0.23.0

Aug 26, 2026

v0.22.0

Aug 26, 2026

v0.21.0

Aug 26, 2026

v0.20.0

Aug 26, 2026

Changes in this version

+ const CallerContextKey

type Plugin

+ func (p *Plugin) RequireAdmin() func(next http.Handler) http.Handler

+ func (p *Plugin) RequirePermission(permissions Permissions, connector ...Connector) func(next http.Handler) http.Handler

v0.19.0

Aug 25, 2026

v0.18.0

Aug 24, 2026

v0.17.0

Aug 24, 2026

v0.16.0

Aug 24, 2026

v0.15.0

Aug 24, 2026

v0.14.0

Aug 20, 2026

v0.13.0

Aug 20, 2026

v0.12.0

Aug 19, 2026

v0.11.0

Aug 18, 2026

v0.10.0

Aug 18, 2026

v0.9.0

Aug 14, 2026

v0.8.0

Aug 13, 2026

Changes in this version

+ const ActionBan

+ const ActionCreate

+ const ActionDelete

+ const ActionGet

+ const ActionImpersonate

+ const ActionImpersonateAdmins

+ const ActionList

+ const ActionSessionDelete

+ const ActionSessionList

+ const ActionSessionRevoke

+ const ActionSetEmail

+ const ActionSetPassword

+ const ActionSetRole

+ const ActionUpdate

+ const EventAllSessionsRevoked

+ const EventImpersonationStopped

+ const EventSessionRevoked

+ const EventUserBanned

+ const EventUserCreated

+ const EventUserDeleted

+ const EventUserImpersonated

+ const EventUserPasswordChanged

+ const EventUserRoleChanged

+ const EventUserUnbanned

+ const EventUserUpdated

+ const ExtraKeyAdminSession

+ const ExtraKeyBanExpires

+ const ExtraKeyBanReason

+ const ExtraKeyImpersonatedBy

+ const ExtraKeyRole

+ const PluginID

+ const ResourceSession

+ const ResourceUser

+ const RoleAdmin

+ const RoleUser

+ var ErrAdminSessionNotFound = errors.New("admin: original admin session not found")

+ var ErrCannotBanSelf = errors.New("admin: you cannot ban yourself")

+ var ErrCannotDeleteSelf = errors.New("admin: you cannot remove yourself")

+ var ErrCannotImpersonateAdmin = errors.New("admin: you cannot impersonate admins without explicit permission")

+ var ErrCannotImpersonateSelf = errors.New("admin: you cannot impersonate yourself")

+ var ErrForbidden = errors.New("admin: forbidden - insufficient permissions")

+ var ErrInvalidEmail = errors.New("admin: invalid email address")

+ var ErrInvalidParameter = errors.New("admin: required parameter is missing or invalid")

+ var ErrInvalidRole = errors.New("admin: invalid or non-existent role")

+ var ErrNoDataToUpdate = errors.New("admin: no data provided for update")

+ var ErrNotImpersonating = errors.New("admin: session is not impersonated")

+ var ErrPasswordTooLong = errors.New("admin: password is too long")

+ var ErrPasswordTooShort = errors.New("admin: password is too short")

+ var ErrUnauthorized = errors.New("admin: unauthorized access")

+ var ErrUserAlreadyExists = errors.New("admin: user already exists")

+ var ErrUserBanned = errors.New("admin: user account is banned")

+ var ErrUserNotFound = errors.New("admin: user not found")

+ func CheckActionGranted(granted Statements, resource, action string) bool

+ func DefaultRoles() map[string]Role

+ func EvaluateStatements(granted Statements, requested Permissions, connector Connector) bool

+ func HasAction(actions []string, targetAction string) bool

+ func HasPermission(input HasPermissionInput) bool

+ type AccessControl struct

+ func NewAccessControl() *AccessControl

+ func (ac *AccessControl) GetRole(name string) (Role, bool)

+ func (ac *AccessControl) RegisterRole(role Role) *AccessControl

+ func (ac *AccessControl) Roles() map[string]Role

+ type AllSessionsRevokedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ UserID string

+ type AuthorizeResult struct

+ Error string

+ Success bool

+ type BanUserParams struct

+ BanExpiresIn *time.Duration

+ BanReason string

+ Caller CallerContext

+ UserID string

+ type CallerContext struct

+ Extra map[string]any

+ Role string

+ UserID string

+ type CheckPermissionParams struct

+ Caller CallerContext

+ Connector Connector

+ Permissions Permissions

+ type Config struct

+ AdminRoles []string

+ AdminUserIDs []string

+ AllowImpersonatingAdmins bool

+ BannedUserMessage string

+ DefaultBanExpiresIn time.Duration

+ DefaultBanReason string

+ DefaultRole string

+ ImpersonationSessionDuration time.Duration

+ MaxPasswordLength int

+ MinPasswordLength int

+ Roles map[string]Role

+ func DefaultConfig() Config

+ type Connector string

+ const ConnectorAND

+ const ConnectorOR

+ type CreateUserParams struct

+ Caller CallerContext

+ Email string

+ Extra map[string]any

+ Name string

+ Password string

+ Role string

+ type GetUserParams struct

+ Caller CallerContext

+ UserID string

+ type HasPermissionInput struct

+ AdminUserIDs []string

+ Connector Connector

+ DefaultRole string

+ Permissions Permissions

+ Role string

+ RolesConfig map[string]Role

+ UserID string

+ type ImpersonateResult struct

+ AdminSessionToken string

+ Session *entity.Session

+ User *entity.User

+ type ImpersonateUserParams struct

+ Caller CallerContext

+ Duration *time.Duration

+ IPAddress string

+ UserAgent string

+ UserID string

+ type ImpersonationStoppedEventPayload struct

+ AdminUserID string

+ Extra map[string]any

+ SessionToken string

+ TargetUserID string

+ type ListUserSessionsParams struct

+ Caller CallerContext

+ UserID string

+ type ListUsersFilter struct

+ FilterField string

+ FilterOperator string

+ FilterValue any

+ Limit int

+ Offset int

+ SearchField string

+ SearchOperator string

+ SearchValue string

+ SortBy string

+ SortDirection string

+ type ListUsersParams struct

+ Caller CallerContext

+ Filter ListUsersFilter

+ type ListUsersResult struct

+ Limit int

+ Offset int

+ Total int64

+ Users []*entity.User

+ type Option func(*Config)

+ func WithAdminRoles(roles ...string) Option

+ func WithAdminUserIDs(userIDs ...string) Option

+ func WithAllowImpersonatingAdmins(allow bool) Option

+ func WithBannedUserMessage(msg string) Option

+ func WithCustomRoles(roles map[string]Role) Option

+ func WithDefaultBanExpiresIn(d time.Duration) Option

+ func WithDefaultBanReason(reason string) Option

+ func WithDefaultRole(role string) Option

+ func WithImpersonationSessionDuration(d time.Duration) Option

+ func WithPasswordLength(minLen, maxLen int) Option

+ func WithRole(role Role) Option

+ type Permissions map[string][]string

+ type Plugin struct

+ func New(repo Repository, opts ...Option) *Plugin

+ func (p *Plugin) BanUser(ctx context.Context, params BanUserParams) (*entity.User, error)

+ func (p *Plugin) CheckPermission(ctx context.Context, params CheckPermissionParams) (bool, error)

+ func (p *Plugin) CheckUserBanStatus(ctx context.Context, user *entity.User) error

+ func (p *Plugin) Config() Config

+ func (p *Plugin) CreateUser(ctx context.Context, params CreateUserParams) (*entity.User, error)

+ func (p *Plugin) GetUser(ctx context.Context, params GetUserParams) (*entity.User, error)

+ func (p *Plugin) ID() string

+ func (p *Plugin) ImpersonateUser(ctx context.Context, params ImpersonateUserParams) (*ImpersonateResult, error)

+ func (p *Plugin) Init(ctx *plugin.Context) error

+ func (p *Plugin) ListUserSessions(ctx context.Context, params ListUserSessionsParams) ([]*entity.Session, error)

+ func (p *Plugin) ListUsers(ctx context.Context, params ListUsersParams) (*ListUsersResult, error)

+ func (p *Plugin) RemoveUser(ctx context.Context, params RemoveUserParams) error

+ func (p *Plugin) Repository() Repository

+ func (p *Plugin) RevokeUserSession(ctx context.Context, params RevokeUserSessionParams) error

+ func (p *Plugin) RevokeUserSessions(ctx context.Context, params RevokeUserSessionsParams) error

+ func (p *Plugin) SetRole(ctx context.Context, params SetRoleParams) (*entity.User, error)

+ func (p *Plugin) SetUserPassword(ctx context.Context, params SetUserPasswordParams) error

+ func (p *Plugin) StopImpersonating(ctx context.Context, params StopImpersonatingParams) (*StopImpersonatingResult, error)

+ func (p *Plugin) UnbanUser(ctx context.Context, params UnbanUserParams) (*entity.User, error)

+ func (p *Plugin) UpdateUser(ctx context.Context, params UpdateUserParams) (*entity.User, error)

+ type RemoveUserParams struct

+ Caller CallerContext

+ UserID string

+ type Repository interface

+ CreateSession func(ctx context.Context, session *dto.CreateSessionParams) (*entity.Session, error)

+ CreateUser func(ctx context.Context, params *dto.CreateUserParams) (*entity.User, error)

+ DeleteSession func(ctx context.Context, token string) error

+ DeleteSessionsByUserID func(ctx context.Context, userID string) error

+ DeleteUser func(ctx context.Context, id string) error

+ GetSessionByToken func(ctx context.Context, token string) (*entity.Session, error)

+ GetUserByEmail func(ctx context.Context, email string) (*entity.User, error)

+ GetUserByID func(ctx context.Context, id string) (*entity.User, error)

+ LinkCredentialAccount func(ctx context.Context, userID, passwordHash string) error

+ ListSessionsByUserID func(ctx context.Context, userID string) ([]*entity.Session, error)

+ ListUsers func(ctx context.Context, filter ListUsersFilter) ([]*entity.User, int64, error)

+ UpdateUser func(ctx context.Context, user *entity.User) error

+ type RevokeUserSessionParams struct

+ Caller CallerContext

+ SessionToken string

+ type RevokeUserSessionsParams struct

+ Caller CallerContext

+ UserID string

+ type Role struct

+ Name string

+ Statements Statements

+ func (r *Role) Authorize(requested Permissions, connector Connector) AuthorizeResult

+ type SessionRevokedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ SessionToken string

+ type SetRoleParams struct

+ Caller CallerContext

+ Role string

+ UserID string

+ type SetUserPasswordParams struct

+ Caller CallerContext

+ NewPassword string

+ UserID string

+ type Statements map[string][]string

+ func CloneStatements(s Statements) Statements

+ func MergeStatements(dst, src Statements) Statements

+ type StopImpersonatingParams struct

+ AdminSessionToken string

+ ImpersonatedSessionToken string

+ type StopImpersonatingResult struct

+ AdminSession *entity.Session

+ AdminUser *entity.User

+ type UnbanUserParams struct

+ Caller CallerContext

+ UserID string

+ type UpdateUserParams struct

+ BanExpires *time.Time

+ BanReason *string

+ Banned *bool

+ Caller CallerContext

+ Email *string

+ EmailVerified *bool

+ Extra map[string]any

+ Name *string

+ Role *string

+ UserID string

+ type UserBannedEventPayload struct

+ BanExpires *time.Time

+ BanReason string

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ User *entity.User

+ UserID string

+ type UserCreatedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ User *entity.User

+ type UserDeletedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ UserID string

+ type UserImpersonatedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ Session *entity.Session

+ TargetUserID string

+ type UserPasswordChangedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ UserID string

+ type UserRoleChangedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ NewRole string

+ OldRole string

+ User *entity.User

+ UserID string

+ type UserUnbannedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ User *entity.User

+ UserID string

+ type UserUpdatedEventPayload struct

+ CallerID string

+ CallerRole string

+ Extra map[string]any

+ User *entity.User

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL