Documentation
¶
Overview ¶
Package authkit holds the stateless auth helpers shared by the CSuit apps: one-time token generation and hashing, recovery codes, HS256 JWT signing and verification, the 2FA-pending token, and HMAC payload signatures. Anything that touches a database (refresh rotation, sessions) stays in each app.
Index ¶
- Constants
- func CheckSecret(secret string) error
- func ClaimInt64(v any) (int64, error)
- func DeviceTag(userAgent string) string
- func HashToken(token string) string
- func New2FAPendingToken(secret string, userID int64, ttl time.Duration) (string, error)
- func NewMagicToken(ttl time.Duration) (string, time.Time, error)
- func NewRecoveryCode() (code, hash string, err error)
- func Parse2FAPendingToken(secret, tokenString string) (int64, error)
- func ParseHS256(secret, tokenString string) (jwt.MapClaims, error)
- func SignHS256(secret string, claims jwt.MapClaims) (string, error)
- func SignPayload(secret, body string) string
- func UnverifiedClaims(tokenString string) (jwt.MapClaims, error)
- func VerifyPayload(secret, body, signature string) bool
Constants ¶
const MinSecretLen = 32
Variables ¶
This section is empty.
Functions ¶
func CheckSecret ¶
CheckSecret reports whether secret is long enough to sign tokens with.
func ClaimInt64 ¶
ClaimInt64 reads a numeric claim that may arrive as float64, int or a string.
func HashToken ¶
HashToken is the stored form of an emailed one-time token: its SHA-256 in hex. The link carries the raw token; the database only holds this.
func New2FAPendingToken ¶
New2FAPendingToken is the short-lived token issued between password and second factor.
func NewMagicToken ¶
NewMagicToken returns 32 random bytes in hex and the time it expires. It retries a few times on a crypto/rand failure and returns an error rather than a predictable token.
func NewRecoveryCode ¶
NewRecoveryCode returns a code like "A1B2C3D4-E5F60718" and the hash to store.
func Parse2FAPendingToken ¶
Parse2FAPendingToken verifies the token and returns the user id.
func ParseHS256 ¶
ParseHS256 verifies a token signed with exactly HS256 and returns its claims.
func SignPayload ¶
SignPayload returns the hex HMAC-SHA256 of body under secret.
func UnverifiedClaims ¶
UnverifiedClaims reads claims without checking the signature. Use it only to pick out ids from a token that is being discarded anyway (logout).
func VerifyPayload ¶
VerifyPayload compares a hex signature with the expected one in constant time.
Types ¶
This section is empty.
Source Files