Documentation
¶
Index ¶
- func AddDevice(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, deviceID string, ...) error
- func ChangePassword(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, ...) error
- func CountIdentities(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID) (int, error)
- func IsCommonPassword(password string) bool
- func LinkEmail(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, ...) error
- func LinkProvider(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, provider string, ...) error
- func Logout(ctx context.Context, store SessionStore, tm *TokenManager, ...) error
- func LogoutAll(ctx context.Context, store SessionStore, tm *TokenManager, ...) error
- func RedisRefreshKey(token string) string
- func SetSocialConfig(cfg SocialConfig)
- func SoftDeleteUser(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID) error
- func UnlinkDevice(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, deviceID string) error
- func UnlinkProvider(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, provider string) error
- func UpdateAccount(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, upd AccountUpdate) error
- func UpdateAccountsTx(ctx context.Context, tx pgx.Tx, updates []AccountUpdateParams) error
- func ValidateEmailAddress(email string) bool
- func ValidatePasswordPolicy(password string) error
- func VerifyAppleToken(ctx context.Context, token string) (string, error)
- func VerifyFacebookInstantGame(ctx context.Context, signedPlayerInfo string) (string, error)
- func VerifyFacebookToken(ctx context.Context, token string) (string, error)
- func VerifyGameCenterSignature(ctx context.Context, cred GameCenterCredentials) (string, error)
- func VerifyGoogleToken(ctx context.Context, token string) (string, error)
- func VerifySteamTicket(ctx context.Context, ticket string) (string, error)
- type AccountUpdate
- type AccountUpdateParams
- type AuthOptions
- type Claims
- type GameCenterCredentials
- type LoginLockout
- type MemorySessionStore
- func (m *MemorySessionStore) BlacklistAccessJTI(ctx context.Context, jti string, until time.Time) error
- func (m *MemorySessionStore) IsAccessJTIBlacklisted(ctx context.Context, jti string) (bool, error)
- func (m *MemorySessionStore) IsUserRevoked(ctx context.Context, userID string) (bool, error)
- func (m *MemorySessionStore) RegisterSession(ctx context.Context, userID, token, parentToken string) error
- func (m *MemorySessionStore) RevokeAllSessions(ctx context.Context, userID string) error
- func (m *MemorySessionStore) RevokeRefreshToken(ctx context.Context, token string) error
- func (m *MemorySessionStore) ValidateAndRotateSession(ctx context.Context, token string) (string, bool, error)
- type RedisSessionStore
- func (r *RedisSessionStore) BlacklistAccessJTI(ctx context.Context, jti string, until time.Time) error
- func (r *RedisSessionStore) IsAccessJTIBlacklisted(ctx context.Context, jti string) (bool, error)
- func (r *RedisSessionStore) IsUserRevoked(ctx context.Context, userID string) (bool, error)
- func (r *RedisSessionStore) RegisterSession(ctx context.Context, userID, token, parentToken string) error
- func (r *RedisSessionStore) RevokeAllSessions(ctx context.Context, userID string) error
- func (r *RedisSessionStore) RevokeRefreshToken(ctx context.Context, token string) error
- func (r *RedisSessionStore) ValidateAndRotateSession(ctx context.Context, token string) (string, bool, error)
- type SessionRegistry
- type SessionStore
- type SocialConfig
- type TokenManager
- func (tm *TokenManager) Expiry() time.Duration
- func (tm *TokenManager) GenerateAccessToken(userID, username string, expiresAt int64, vars map[string]string) (string, int64, error)
- func (tm *TokenManager) GenerateSession(userID string, username string) (string, string, error)
- func (tm *TokenManager) GenerateSessionWithVars(userID, username string, vars map[string]string) (string, string, error)
- func (tm *TokenManager) VerifyToken(tokenStr string) (*Claims, error)
- func (tm *TokenManager) VerifyTokenIgnoreExpiry(tokenStr string) (*Claims, error)
- type User
- func AuthenticateCustom(ctx context.Context, pool *pgxpool.Pool, customID string) (*User, error)
- func AuthenticateCustomWithOpts(ctx context.Context, pool *pgxpool.Pool, customID string, opts AuthOptions) (*User, bool, error)
- func AuthenticateDevice(ctx context.Context, pool *pgxpool.Pool, deviceID string, opts AuthOptions) (*User, bool, error)
- func AuthenticateEmail(ctx context.Context, pool *pgxpool.Pool, email, password string) (*User, error)
- func AuthenticateSocial(ctx context.Context, pool *pgxpool.Pool, provider string, providerID string) (*User, error)
- func AuthenticateSocialWithOpts(ctx context.Context, pool *pgxpool.Pool, provider, providerID string, ...) (*User, bool, error)
- func GetAccount(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID) (*User, error)
- func GetUsersPublic(ctx context.Context, pool *pgxpool.Pool, ids, usernames, facebookIDs []string) ([]*User, error)
- func RegisterEmail(ctx context.Context, pool *pgxpool.Pool, ...) (*User, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddDevice ¶
func AddDevice(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, deviceID string, preferences string, pushTokens map[string]string) error
AddDevice registers a device ID associated with a user.
func ChangePassword ¶
func ChangePassword(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, oldPassword, newPassword string) error
ChangePassword updates password and is intended to be paired with JWT revocation by the caller.
func CountIdentities ¶
CountIdentities returns how many login methods the user currently has.
func IsCommonPassword ¶
IsCommonPassword returns true if password is on the deny list (case-insensitive).
func LinkEmail ¶
func LinkEmail(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, email, password string) error
LinkEmail sets email+password on an existing account.
func LinkProvider ¶
func LinkProvider(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, provider string, providerID string) error
LinkProvider links a social provider ID to an existing user profile.
func Logout ¶
func Logout(ctx context.Context, store SessionStore, tm *TokenManager, accessToken, refreshToken string) error
Logout clears refresh token and optionally blacklists access JWT by jti.
func LogoutAll ¶
func LogoutAll(ctx context.Context, store SessionStore, tm *TokenManager, userID, accessToken string) error
LogoutAll revokes every refresh for the user and blacklists the current access jti.
func RedisRefreshKey ¶
Format helper kept for redis key introspection in tests.
func SetSocialConfig ¶
func SetSocialConfig(cfg SocialConfig)
SetSocialConfig overrides the package-level social verification config (tests/bootstrap).
func SoftDeleteUser ¶
SoftDeleteUser soft deletes a user account by disabling the profile and writing a tombstone.
func UnlinkDevice ¶
UnlinkDevice removes a device identity with last-identity guard.
func UnlinkProvider ¶
func UnlinkProvider(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, provider string) error
UnlinkProvider clears a provider column after enforcing last-identity guard.
func UpdateAccount ¶
func UpdateAccount(ctx context.Context, pool *pgxpool.Pool, userID uuid.UUID, upd AccountUpdate) error
UpdateAccount updates profile fields for a user.
func UpdateAccountsTx ¶
UpdateAccountsTx applies account profile updates inside a transaction.
func ValidateEmailAddress ¶
ValidateEmailAddress checks RFC 5322-ish email via net/mail.
func ValidatePasswordPolicy ¶
ValidatePasswordPolicy enforces length, complexity, and common-password checks.
func VerifyAppleToken ¶
VerifyAppleToken verifies an Apple Identity Token (JWT) against Apple JWKS. Tokens prefixed with "mock_" bypass network verification for hermetic tests.
func VerifyFacebookInstantGame ¶
VerifyFacebookInstantGame verifies a signed player info token. Tokens prefixed with mock_ are accepted for hermetic tests.
func VerifyFacebookToken ¶
VerifyFacebookToken verifies a Facebook access token via Graph API debug_token / me.
func VerifyGameCenterSignature ¶
func VerifyGameCenterSignature(ctx context.Context, cred GameCenterCredentials) (string, error)
VerifyGameCenterSignature verifies Game Center player identity. Mock mode: PublicKeyURL "mock" returns PlayerID without crypto verification.
func VerifyGoogleToken ¶
VerifyGoogleToken verifies a Google ID token via Google's tokeninfo endpoint (or mock_ bypass). Optionally checks aud against GOOGLE_CLIENT_IDS.
Types ¶
type AccountUpdate ¶
type AccountUpdate struct {
Username *string
DisplayName *string
AvatarURL *string
LangTag *string
Location *string
Timezone *string
Metadata *string
}
AccountUpdate holds mutable account profile fields.
type AccountUpdateParams ¶
type AccountUpdateParams struct {
UserID string
Username *string
DisplayName *string
AvatarURL *string
LangTag *string
Location *string
Timezone *string
Metadata *string
}
AccountUpdateParams is a single account mutation for MultiUpdate.
type AuthOptions ¶
AuthOptions controls create-or-login semantics shared by authenticate endpoints.
type Claims ¶
type Claims struct {
UserID string `json:"sub"`
Username string `json:"usn"`
Vars map[string]string `json:"vrs,omitempty"`
jwt.RegisteredClaims
}
Claims defines the custom JWT claims structure.
type GameCenterCredentials ¶
type GameCenterCredentials struct {
PlayerID string
BundleID string
Timestamp int64
Salt string
Signature string
PublicKeyURL string
}
GameCenterCredentials holds Apple Game Center identity verification fields.
type LoginLockout ¶
type LoginLockout struct {
// contains filtered or unexported fields
}
LoginLockout tracks failed authentication attempts per account and IP.
func NewLoginLockout ¶
func NewLoginLockout() *LoginLockout
NewLoginLockout creates an in-memory lockout tracker.
func (*LoginLockout) Check ¶
func (l *LoginLockout) Check(identityKey, ip string) error
Check returns an error if the identity or IP is currently locked out.
func (*LoginLockout) ClearSuccess ¶
func (l *LoginLockout) ClearSuccess(identityKey, ip string)
ClearSuccess resets counters after a successful authentication.
func (*LoginLockout) RecordFailure ¶
func (l *LoginLockout) RecordFailure(identityKey, ip string)
RecordFailure increments fail counters; locks when thresholds are exceeded.
type MemorySessionStore ¶
type MemorySessionStore struct {
// contains filtered or unexported fields
}
MemorySessionStore is the in-process implementation (tests / no Redis).
func NewMemorySessionStore ¶
func NewMemorySessionStore() *MemorySessionStore
func (*MemorySessionStore) BlacklistAccessJTI ¶
func (*MemorySessionStore) IsAccessJTIBlacklisted ¶
func (*MemorySessionStore) IsUserRevoked ¶
func (*MemorySessionStore) RegisterSession ¶
func (m *MemorySessionStore) RegisterSession(ctx context.Context, userID, token, parentToken string) error
func (*MemorySessionStore) RevokeAllSessions ¶
func (m *MemorySessionStore) RevokeAllSessions(ctx context.Context, userID string) error
func (*MemorySessionStore) RevokeRefreshToken ¶
func (m *MemorySessionStore) RevokeRefreshToken(ctx context.Context, token string) error
func (*MemorySessionStore) ValidateAndRotateSession ¶
type RedisSessionStore ¶
type RedisSessionStore struct {
// contains filtered or unexported fields
}
RedisSessionStore persists refresh tokens and JWT deny list in Redis.
func NewRedisSessionStore ¶
func NewRedisSessionStore(rdb *redis.Client, ttl time.Duration) *RedisSessionStore
NewRedisSessionStore creates a Redis-backed store. Falls back operations return error if rdb nil.
func (*RedisSessionStore) BlacklistAccessJTI ¶
func (*RedisSessionStore) IsAccessJTIBlacklisted ¶
func (*RedisSessionStore) IsUserRevoked ¶
func (*RedisSessionStore) RegisterSession ¶
func (r *RedisSessionStore) RegisterSession(ctx context.Context, userID, token, parentToken string) error
func (*RedisSessionStore) RevokeAllSessions ¶
func (r *RedisSessionStore) RevokeAllSessions(ctx context.Context, userID string) error
func (*RedisSessionStore) RevokeRefreshToken ¶
func (r *RedisSessionStore) RevokeRefreshToken(ctx context.Context, token string) error
func (*RedisSessionStore) ValidateAndRotateSession ¶
type SessionRegistry ¶
type SessionRegistry struct {
// contains filtered or unexported fields
}
SessionRegistry wraps SessionStore with the historical sync API used by handlers/tests.
func NewSessionRegistry ¶
func NewSessionRegistry() *SessionRegistry
NewSessionRegistry returns a memory-backed store compatible with historical API.
func NewSessionRegistryWithStore ¶
func NewSessionRegistryWithStore(store SessionStore) *SessionRegistry
NewSessionRegistryWithStore builds a registry over an arbitrary store.
func (*SessionRegistry) RegisterSession ¶
func (sr *SessionRegistry) RegisterSession(userID, token string, parentToken string)
func (*SessionRegistry) RevokeAllSessions ¶
func (sr *SessionRegistry) RevokeAllSessions(userID string)
func (*SessionRegistry) Store ¶
func (sr *SessionRegistry) Store() SessionStore
func (*SessionRegistry) ValidateAndRotateSession ¶
func (sr *SessionRegistry) ValidateAndRotateSession(token string) (string, bool, error)
type SessionStore ¶
type SessionStore interface {
RegisterSession(ctx context.Context, userID, token, parentToken string) error
ValidateAndRotateSession(ctx context.Context, token string) (userID string, theftDetected bool, err error)
RevokeAllSessions(ctx context.Context, userID string) error
RevokeRefreshToken(ctx context.Context, token string) error
BlacklistAccessJTI(ctx context.Context, jti string, until time.Time) error
IsAccessJTIBlacklisted(ctx context.Context, jti string) (bool, error)
IsUserRevoked(ctx context.Context, userID string) (bool, error)
}
SessionStore abstracts refresh-token + JWT denial storage.
func NewSessionStoreFromRedis ¶
func NewSessionStoreFromRedis(rdb *redis.Client) SessionStore
NewSessionStoreFromRedis picks Redis when available, else memory.
type SocialConfig ¶
type SocialConfig struct {
AppleClientIDs []string // allowed aud / bundle IDs
GoogleClientIDs []string
FacebookAppID string
FacebookAppSecret string
SteamAppID string
SteamPublisherKey string
HTTPClient *http.Client
}
SocialConfig holds provider verification settings (env-overridable).
func DefaultSocialConfig ¶
func DefaultSocialConfig() SocialConfig
DefaultSocialConfig loads from environment variables.
type TokenManager ¶
type TokenManager struct {
// contains filtered or unexported fields
}
TokenManager handles JWT signing, verification, and key management.
func NewTokenManager ¶
func NewTokenManager(secretKey []byte, expiry time.Duration) (*TokenManager, error)
NewTokenManager creates a new instance of TokenManager.
func (*TokenManager) Expiry ¶
func (tm *TokenManager) Expiry() time.Duration
Expiry returns the configured access-token lifetime.
func (*TokenManager) GenerateAccessToken ¶
func (tm *TokenManager) GenerateAccessToken(userID, username string, expiresAt int64, vars map[string]string) (string, int64, error)
GenerateAccessToken mints an access JWT with optional custom expiry (unix seconds). If expiresAt is 0, the configured TokenManager expiry is used.
func (*TokenManager) GenerateSession ¶
GenerateSession generates a JWT access token (with jti) and opaque refresh token.
func (*TokenManager) GenerateSessionWithVars ¶
func (tm *TokenManager) GenerateSessionWithVars(userID, username string, vars map[string]string) (string, string, error)
GenerateSessionWithVars embeds optional session vars into the access JWT.
func (*TokenManager) VerifyToken ¶
func (tm *TokenManager) VerifyToken(tokenStr string) (*Claims, error)
VerifyToken parses and validates a JWT access token.
func (*TokenManager) VerifyTokenIgnoreExpiry ¶
func (tm *TokenManager) VerifyTokenIgnoreExpiry(tokenStr string) (*Claims, error)
VerifyTokenIgnoreExpiry validates signature/claims but ignores expiry (logout/blacklist).
type User ¶
type User struct {
ID uuid.UUID
Username string
DisplayName string
AvatarURL string
LangTag string
Location string
Timezone string
Metadata string
Email *string
CustomID *string
AppleID *string
GoogleID *string
FacebookID *string
GamecenterID *string
SteamID *string
FacebookIGID *string
DisableTime time.Time
CreateTime time.Time
UpdateTime time.Time
Devices []string
}
User represents a user profile retrieved from database.
func AuthenticateCustom ¶
AuthenticateCustom authenticates a custom ID, creating a user if they do not exist.
func AuthenticateCustomWithOpts ¶
func AuthenticateCustomWithOpts(ctx context.Context, pool *pgxpool.Pool, customID string, opts AuthOptions) (*User, bool, error)
AuthenticateCustomWithOpts supports create=false and optional username.
func AuthenticateDevice ¶
func AuthenticateDevice(ctx context.Context, pool *pgxpool.Pool, deviceID string, opts AuthOptions) (*User, bool, error)
AuthenticateDevice finds or creates a user via user_device.
func AuthenticateEmail ¶
func AuthenticateEmail(ctx context.Context, pool *pgxpool.Pool, email, password string) (*User, error)
AuthenticateEmail verifies a user email and password.
func AuthenticateSocial ¶
func AuthenticateSocial(ctx context.Context, pool *pgxpool.Pool, provider string, providerID string) (*User, error)
AuthenticateSocial authenticates a social provider ID, creating a user if they do not exist.
func AuthenticateSocialWithOpts ¶
func AuthenticateSocialWithOpts(ctx context.Context, pool *pgxpool.Pool, provider, providerID string, opts AuthOptions) (*User, bool, error)
AuthenticateSocialWithOpts supports create=false and optional username.
func GetAccount ¶
GetAccount loads the full account profile including linked devices.
func GetUsersPublic ¶
func GetUsersPublic(ctx context.Context, pool *pgxpool.Pool, ids, usernames, facebookIDs []string) ([]*User, error)
GetUsersPublic returns public profile fields for users matching ids, usernames, or facebook IDs. Disabled accounts are omitted. Metadata is returned as stored JSON text.
Source Files