auth

package

Go to main page

Versions in this module

v0

v0.4.0

Sep 6, 2026

Changes in this version

+ const PermAddonsManage

+ var ErrAlreadySignedIn = errors.New("auth: this request is already signed in")

+ var ErrAssertionIncomplete = errors.New("auth: the assertion names no subject or no issuer")

+ var ErrSubjectLinkedElsewhere = errors.New("auth: that external identity is connected to another account")

+ var ErrSubjectNotLinked = errors.New("auth: no account has connected this external identity")

+ func MintedByLabel(addon string) string

+ type AddonAssertion struct

+ Addon string

+ AlreadySignedIn bool

+ DisplayName string

+ Email string

+ EmailVerified bool

+ Groups []string

+ IP netip.Addr

+ Issuer string

+ SatisfiesSecondFactor bool

+ Subject string

+ UserAgent string

+ type AddonIdentityLink struct

+ Addon string

+ ByOperator bool

+ Issuer string

+ Linked bool

+ UserID uuid.UUID

+ type AddonMint struct

+ ExpiresAt time.Time

+ Login *LoginResult

+ Pending *PendingSecondFactor

+ func (m *AddonMint) SecondFactorRequired() bool

+ type AddonSessionMint struct

+ Addon string

+ Issuer string

+ MintedBy string

+ SecondFactorRequired bool

+ type ConnectedIdentity struct

+ Addon string

+ CreatedAt time.Time

+ Email string

+ ID uuid.UUID

+ Issuer string

+ LastUsedAt *time.Time

+ Name string

+ UserID uuid.UUID

type Service

+ func (s *Service) ConnectedIdentities(ctx context.Context, actor *Identity) ([]ConnectedIdentity, error)

+ func (s *Service) DisconnectIdentity(ctx context.Context, actor *Identity, id uuid.UUID) error

+ func (s *Service) DisconnectIdentityFor(ctx context.Context, actor *Identity, addon string, id uuid.UUID) error

+ func (s *Service) IdentitiesForAddon(ctx context.Context, addon string) ([]ConnectedIdentity, error)

+ func (s *Service) LinkAddonIdentity(ctx context.Context, actor *Identity, addon, issuer, subject string) error

+ func (s *Service) MintFromAddonAssertion(ctx context.Context, in AddonAssertion) (*AddonMint, error)

+ func (s *Service) SetLogger(log *slog.Logger)

+ func (s *Service) SetSessionAuditor(a SessionAuditor)

+ type SessionAuditor interface

+ RecordAddonIdentityLink func(ctx context.Context, actor *Identity, ev AddonIdentityLink) error

+ RecordAddonSessionMint func(ctx context.Context, actor *Identity, ev AddonSessionMint) error

v0.3.0

Aug 18, 2026

Changes in this version

+ const MFAKeyMinBytes

+ const MFAPendingTTL

+ const MFARecoveryCodeCount

+ const TOTPDigits

+ const TOTPPeriod

+ const TOTPSecretBytes

+ const TOTPSkew

+ var ErrMFAAlreadyEnabled = errors.New("auth: this account already has a second factor")

+ var ErrMFAChallengeInvalid = errors.New("auth: this sign-in can no longer be completed")

+ var ErrMFACodeInvalid = errors.New("auth: that code is not valid")

+ var ErrMFAKeyMissing = errors.New("auth: this instance has no MFA_SECRET_KEY configured")

+ var ErrMFANotEnabled = errors.New("auth: this account has no second factor")

+ var ErrMFASecretUnreadable = errors.New("auth: the stored second-factor secret cannot be read")

+ var ErrMFAUnavailable = fmt.Errorf("auth: the second factor is not available on this instance: %w", ...)

+ func NewTOTPSecret() (string, error)

+ func TOTPCode(secret string, step int64) (string, error)

+ func TOTPStep(t time.Time) int64

+ func TOTPURI(issuer, account, secret string) string

+ func TOTPVerify(secret, code string, now time.Time) (step int64, ok bool)

+ func WritePassword(ctx context.Context, q *dbgen.Queries, h *Hasher, userID uuid.UUID, ...) error

type APIKeyAuditor

+ RecordAPIKeyReachRevocation func(ctx context.Context, actor *Identity, ev APIKeyRevocation) error

type APIKeyInfo

+ OrganizationID *uuid.UUID

+ RevokedOrganizations []APIKeyOrgRevocation

+ type APIKeyOrgRevocation struct

+ OrganizationID uuid.UUID

+ OrganizationName string

+ RevokedAt time.Time

type APIKeyRotation

+ ReachNarrowed bool

type CreateAPIKeyInput

+ OrganizationID *uuid.UUID

type Identity

+ APIKeyBarredOrgIDs []uuid.UUID

+ APIKeyOrgID *uuid.UUID

type LoginResult

+ Pending *PendingSecondFactor

+ func (r *LoginResult) SecondFactorRequired() bool

+ type MFAAuditor interface

+ RecordMFAChange func(ctx context.Context, actor *Identity, ev MFAChange) error

+ type MFAChange struct

+ Email string

+ Kind MFAChangeKind

+ RecoveryCodesRemaining int64

+ UserID uuid.UUID

+ type MFAChangeKind string

+ const MFADisabled

+ const MFAEnabled

+ const MFARecoveryCodeUsed

+ const MFARecoveryCodesRegenerated

+ type MFACipher struct

+ func NewMFACipher(key string) (*MFACipher, error)

+ func (c *MFACipher) Open(stored string) (string, error)

+ func (c *MFACipher) Seal(secret string) (string, error)

+ type MFAConfig struct

+ Audit MFAAuditor

+ Auth *Service

+ Cipher *MFACipher

+ Issuer string

+ Log *slog.Logger

+ Notify MFANotifier

+ type MFAEnrolled struct

+ RecoveryCodes []string

+ type MFAEnrolment struct

+ Secret string

+ URI string

+ type MFANotifier interface

+ NotifyMFAChange func(ctx context.Context, ev MFAChange) error

+ type MFAService struct

+ func NewMFAService(pool *pgxpool.Pool, cfg MFAConfig) (*MFAService, error)

+ func (m *MFAService) Available() bool

+ func (m *MFAService) BeginEnrolment(ctx context.Context, actor *Identity) (*MFAEnrolment, error)

+ func (m *MFAService) CompleteSecondFactor(ctx context.Context, token, code string, ip netip.Addr, userAgent string) (*LoginResult, error)

+ func (m *MFAService) ConfirmEnrolment(ctx context.Context, actor *Identity, secret, code string) (*MFAEnrolled, error)

+ func (m *MFAService) Disable(ctx context.Context, actor *Identity, password, code string) error

+ func (m *MFAService) PurgePendingLogins(ctx context.Context, batch int32) (int64, error)

+ func (m *MFAService) RegenerateRecoveryCodes(ctx context.Context, actor *Identity) ([]string, error)

+ func (m *MFAService) Status(ctx context.Context, actor *Identity) (MFAStatus, error)

+ type MFAStatus struct

+ Available bool

+ Enabled bool

+ EnabledAt *time.Time

+ RecoveryCodesRemaining int64

type MembershipAuthority

+ func LoadMemberships(ctx context.Context, q *dbgen.Queries, userID, orgID uuid.UUID) (*MembershipAuthority, error)

+ func (m *MembershipAuthority) Reaches(workspaceID *uuid.UUID) bool

+ type PendingSecondFactor struct

+ Expires time.Time

+ Token string

type RotateAPIKeyInput

+ Reach RotationReach

+ type RotationReach int

+ const ReachAccount

+ const ReachOrganization

+ const ReachUnchanged

type Service

+ func (s *Service) VerifyPassword(ctx context.Context, userID uuid.UUID, password string) error

v0.2.0

Aug 6, 2026

Changes in this version

+ const DefaultRotationGrace

+ const MaxRotationGrace

+ const MinRotationGrace

+ const NoRoleRank

+ const PermAuditReadInstance

+ const PermDestinationsDecide

+ const PermDestinationsReview

+ const PermDomainsWriteInstance

+ const PermInstanceAdmin

+ var ErrAPIKeyAlreadyRotated = errors.New("auth: this api key has already been rotated")

+ var ErrNoWorkspace = errors.New("auth: account belongs to no organization")

+ var InstanceGrantable = map[string]struct

+ var InstancePrincipalScopes = []string

+ var KeyIssuableRoles = map[string]struct

+ func ClientIPFrom(ctx context.Context) netip.Addr

+ func HashOpaqueToken(token string) []byte

+ func NewOpaqueToken(n int) (token string, hash []byte, err error)

+ func ProvisionOrganization(ctx context.Context, q *dbgen.Queries, userID uuid.UUID, name string, ...) (dbgen.Organization, dbgen.Workspace, error)

+ func Slugify(s string) string

+ func WithClientIP(ctx context.Context, addr netip.Addr) context.Context

+ type APIKeyAuditor interface

+ RecordAPIKeyRevocation func(ctx context.Context, actor *Identity, ev APIKeyRevocation) error

+ RecordAPIKeyRotation func(ctx context.Context, actor *Identity, ev APIKeyRotation) error

type APIKeyConfig

+ Auditor APIKeyAuditor

type APIKeyInfo

+ GraceExpiresAt *time.Time

+ OrgWide bool

+ RotatedAt *time.Time

+ SuccessorID *uuid.UUID

+ type APIKeyRevocation struct

+ KeyID uuid.UUID

+ OwnerID uuid.UUID

+ Prefix string

+ type APIKeyRotation struct

+ GraceExpiresAt time.Time

+ OrgWide bool

+ PredecessorID uuid.UUID

+ PredecessorPrefix string

+ Scopes []string

+ ScopesNarrowed bool

+ SuccessorID uuid.UUID

+ SuccessorPrefix string

type APIKeyService

+ func (s *APIKeyService) MayCreateOrgWide(ctx context.Context, actor *Identity) (bool, error)

+ func (s *APIKeyService) Rotate(ctx context.Context, actor *Identity, in RotateAPIKeyInput) (*RotatedAPIKey, error)

+ type Authority struct

+ Granted bool

+ Rank int32

+ Role string

type CreateAPIKeyInput

+ OrgWide bool

type Identity

+ RoleRank int32

+ func (i *Identity) HasOrganization() bool

+ type MembershipAuthority struct

+ func LoadMembershipAuthority(ctx context.Context, q *dbgen.Queries, userID, orgID uuid.UUID, ...) (*MembershipAuthority, error)

+ func (m *MembershipAuthority) In(workspaceID *uuid.UUID) Authority

+ func (m *MembershipAuthority) Permission() string

+ func (m *MembershipAuthority) Scopes() (orgWide bool, workspaceIDs []uuid.UUID)

+ type RotateAPIKeyInput struct

+ Grace time.Duration

+ Scopes []string

+ type RotatedAPIKey struct

+ Predecessor RotatedPredecessor

+ type RotatedPredecessor struct

+ ID uuid.UUID

+ Prefix string

+ StopsWorkingAt time.Time

type Service

+ func (s *Service) SetDefaultWorkspace(ctx context.Context, actor *Identity, workspaceID *uuid.UUID) error

+ func (s *Service) SwitchWorkspace(ctx context.Context, actor *Identity, workspaceID uuid.UUID) error

+ func (s *Service) Workspaces(ctx context.Context, actor *Identity) ([]Workspace, error)

+ type Workspace struct

+ Current bool

+ Default bool

+ ID uuid.UUID

+ IsPersonal bool

+ Name string

+ OrganizationID uuid.UUID

+ OrganizationName string

+ Slug string

v0.1.0

Jul 31, 2026

Changes in this version

+ const APIKeyPrefixLength

+ const MaxPasswordLength

+ const MinPasswordLength

+ const MinPepperLength

+ const PermAPIKeysRead

+ const PermAPIKeysWrite

+ const SessionCookieName

+ const SessionCookieNameInsecure

+ var DefaultLockout = LockoutPolicy

+ var DefaultParams = Params

+ var ErrAPIKeyInvalid = errors.New("auth: api key is not valid")

+ var ErrAccountInactive = errors.New("auth: account is not active")

+ var ErrAccountLocked = errors.New("auth: account temporarily locked")

+ var ErrEmailTaken = errors.New("auth: email already registered")

+ var ErrInvalidCredentials = errors.New("auth: invalid email or password")

+ var ErrInvalidEmail = errors.New("auth: invalid email address")

+ var ErrInvalidHash = errors.New("auth: hash is not in a recognised format")

+ var ErrMismatch = errors.New("auth: password does not match")

+ var ErrSessionExpired = errors.New("auth: session expired")

+ var ErrSessionNotFound = errors.New("auth: session not found")

+ var ErrSessionRevoked = errors.New("auth: session revoked")

+ var ErrSignupClosed = errors.New("auth: registration is closed")

+ var ErrUnsupportedID = errors.New("auth: unsupported password hash algorithm")

+ var NonDelegableScopes = map[string]struct

+ func APIKeyHash(pepper []byte, prefix, secret string) []byte

+ func AnonymizeIP(addr netip.Addr) string

+ func CookieName(secure bool) string

+ func HashSessionToken(token string) []byte

+ func IsSessionInvalid(err error) bool

+ func NewSessionToken() (token string, hash []byte, err error)

+ func NormalizeEmail(email string) string

+ func ParseAPIKey(token string) (prefix, secret string, err error)

+ func ValidateEmail(email string) error

+ type APIKeyConfig struct

+ Logger *slog.Logger

+ Pepper []byte

+ UsageFlushInterval time.Duration

+ type APIKeyInfo struct

+ CreatedAt time.Time

+ ExpiresAt *time.Time

+ ID uuid.UUID

+ LastUsedAt *time.Time

+ Name string

+ Prefix string

+ RevokedAt *time.Time

+ Scopes []string

+ type APIKeyService struct

+ func NewAPIKeyService(pool *pgxpool.Pool, authSvc *Service, cfg APIKeyConfig) (*APIKeyService, error)

+ func (s *APIKeyService) Authenticate(ctx context.Context, token string) (*Identity, error)

+ func (s *APIKeyService) Close(ctx context.Context) error

+ func (s *APIKeyService) Create(ctx context.Context, actor *Identity, in CreateAPIKeyInput) (*CreatedAPIKey, error)

+ func (s *APIKeyService) FlushUsage(ctx context.Context) error

+ func (s *APIKeyService) List(ctx context.Context, actor *Identity) ([]APIKeyInfo, error)

+ func (s *APIKeyService) Revoke(ctx context.Context, actor *Identity, id uuid.UUID) error

+ func (s *APIKeyService) Start()

+ type CreateAPIKeyInput struct

+ ExpiresAt *time.Time

+ Name string

+ Scopes []string

+ type CreatedAPIKey struct

+ Key string

+ type Hasher struct

+ func NewHasher(p Params) *Hasher

+ func (h *Hasher) DummyVerify(password string)

+ func (h *Hasher) Hash(password string) (string, error)

+ func (h *Hasher) NeedsRehash(encoded string) bool

+ func (h *Hasher) Verify(password, encoded string) error

+ type Identity struct

+ APIKeyID *uuid.UUID

+ Email string

+ Name string

+ OrgID uuid.UUID

+ Role string

+ SessionID uuid.UUID

+ UserID uuid.UUID

+ WorkspaceID uuid.UUID

+ func (i *Identity) Can(permission string) bool

+ func (i *Identity) IsAPIKey() bool

+ func (i *Identity) Permissions() []string

+ type LockoutPolicy struct

+ Threshold int

+ Window time.Duration

+ func (p LockoutPolicy) LockedUntil(failedCount int, lastFailure time.Time, now time.Time) time.Time

+ func (p LockoutPolicy) ThresholdParam() int32

+ func (p LockoutPolicy) WindowSecondsParam() int32

+ type LoginInput struct

+ Email string

+ IP netip.Addr

+ Password string

+ UserAgent string

+ type LoginResult struct

+ Expires time.Time

+ Identity *Identity

+ Token string

+ type Params struct

+ Iterations uint32

+ KeyLength uint32

+ MemoryKiB uint32

+ Parallelism uint8

+ SaltLength uint32

+ type RegisterInput struct

+ Email string

+ IsFirstUser bool

+ Name string

+ Password string

+ type Service struct

+ func NewService(pool *pgxpool.Pool, cfg ServiceConfig) *Service

+ func (s *Service) Authenticate(ctx context.Context, token string) (*Identity, error)

+ func (s *Service) ChangePassword(ctx context.Context, userID, keepSession uuid.UUID, current, next string) error

+ func (s *Service) Hasher() *Hasher

+ func (s *Service) IdentityForEmail(ctx context.Context, email string) (*Identity, error)

+ func (s *Service) Login(ctx context.Context, in LoginInput) (*LoginResult, error)

+ func (s *Service) Logout(ctx context.Context, sessionID uuid.UUID) error

+ func (s *Service) NeedsSetup(ctx context.Context) (bool, error)

+ func (s *Service) Register(ctx context.Context, in RegisterInput) (*Identity, error)

+ type ServiceConfig struct

+ Lockout LockoutPolicy

+ Params Params

+ TTL SessionTTL

+ type Session struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID uuid.UUID

+ LastSeenAt time.Time

+ UserID uuid.UUID

+ type SessionTTL struct

+ Absolute time.Duration

+ Idle time.Duration

+ func (t SessionTTL) Valid(s Session, now time.Time) error

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL