auth

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 12, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrForbidden = errors.New("forbidden")
View Source 
var ErrInvalid = errors.New("invalid input")
View Source 
var ErrUnauthorized = errors.New("unauthorized")

Functions

func Authorize 

func Authorize(p Principal, op Operation, ownerKeyID string) error

func ClearSessionCookie 

func ClearSessionCookie(allowInsecureHTTP bool) *http.Cookie

func SessionCookie 

func SessionCookie(value string, allowInsecureHTTP bool) *http.Cookie

func ValidateNewPassword added in v0.4.2 

func ValidateNewPassword(login, password string) error

ValidateNewPassword 校验新设口令；login 必须由服务端从账号取得或规范化。

Types

type Key 

type Key struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	IssuerID   string `json:"issuer_id"`
	IssuerName string `json:"issuer_name"`
	CreatedAt  string `json:"created_at"`
	ExpiresAt  string `json:"expires_at"`
	Note       string `json:"note"`
	LastUsedAt string `json:"last_used_at"`
	RevokedAt  string `json:"revoked_at"`
	Level      Level  `json:"level"`
}

type Level 

type Level string
const (
	Read    Level = "read"
	Propose Level = "propose"
	Write   Level = "write"
)

type LoginPolicy added in v0.3.0 

type LoginPolicy struct {
	Threshold    int
	MaxBackoff   time.Duration
	LockDuration time.Duration
}

LoginPolicy 控制账号和客户端 IP 的限速；零值使用默认配置。

type Operation 

type Operation string
const (
	View          Operation = "view"
	PutContext    Operation = "put_context"
	RecordNote    Operation = "record_note"
	ProposeChange Operation = "propose_change"
	Update        Operation = "update"
	MarkVerified  Operation = "mark_verified"
	CheckVersions Operation = "check_versions"
	Approve       Operation = "approve"
	Reject        Operation = "reject"
	Delete        Operation = "delete"
	ManageKeys    Operation = "manage_keys"
	Restore       Operation = "restore"
)

type PasswordError added in v0.4.2 

type PasswordError struct{ Reason PasswordFailure }

PasswordError 只携带失败代码，不保存口令或用户名。

func (*PasswordError) Error added in v0.4.2 

func (e *PasswordError) Error() string

func (*PasswordError) Is added in v0.4.2 

func (e *PasswordError) Is(target error) bool

type PasswordFailure added in v0.4.2 

type PasswordFailure string
const (
	PasswordTooShort      PasswordFailure = "too_short"
	PasswordTooLong       PasswordFailure = "too_long"
	PasswordTooSimple     PasswordFailure = "too_simple"
	PasswordContainsLogin PasswordFailure = "contains_login"
	PasswordCommon        PasswordFailure = "common"
)

type Principal 

type Principal struct {
	UserID, Login, KeyID, KeyName, IssuerID, IssuerName string
	Level                                               Level
}

func (Principal) IsUser 

func (p Principal) IsUser() bool

type Service 

type Service struct {
	DB          *sql.DB
	Pepper      []byte
	LoginPolicy LoginPolicy
}

func (Service) Authenticate 

func (s Service) Authenticate(ctx context.Context, bearer string) (Principal, error)

func (Service) BootstrapUser 

func (s Service) BootstrapUser(ctx context.Context, login, password string) (string, error)

BootstrapUser is for a local, one-time setup command; it refuses a second account.

func (Service) ChangePassword added in v0.3.0 

func (s Service) ChangePassword(ctx context.Context, p Principal, oldPassword, newPassword string) error

func (Service) IssueKey 

func (s Service) IssueKey(ctx context.Context, p Principal, name string, level Level, expires *time.Time, note string) (Key, string, error)

func (Service) Keys 

func (s Service) Keys(ctx context.Context, p Principal) ([]Key, error)

func (Service) Login 

func (s Service) Login(ctx context.Context, login, password string) (session, csrf string, p Principal, err error)

func (Service) LoginWithIP added in v0.3.0 

func (s Service) LoginWithIP(ctx context.Context, login, password, ip string) (session, csrf string, p Principal, err error)

LoginWithIP 使用 HTTP 层提供的连接对端 IP；调用方不得传入未验证的代理头。

func (Service) Logout 

func (s Service) Logout(ctx context.Context, session string) error

func (Service) LogoutAll added in v0.3.0 

func (s Service) LogoutAll(ctx context.Context, p Principal) error

func (Service) ResetPassword added in v0.3.0 

func (s Service) ResetPassword(ctx context.Context, login, newPassword string) error

func (Service) Revoke 

func (s Service) Revoke(ctx context.Context, p Principal, id string) error

func (Service) Session 

func (s Service) Session(ctx context.Context, session, csrf string, mutating bool) (Principal, error)

Session verifies the cookie and, for mutating methods, the double-submit CSRF token.

func (Service) SetLevel 

func (s Service) SetLevel(ctx context.Context, p Principal, id string, level Level) error

func (Service) UpdateKey added in v0.4.0 

func (s Service) UpdateKey(ctx context.Context, p Principal, id, name, note string, expires *time.Time) error

UpdateKey 只修改可编辑的元数据，已吊销的 Key 不可修改。

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.