Documentation
¶
Overview ¶
Package passkey wraps github.com/go-webauthn/webauthn for this project's two ceremonies (registering a credential, signing in with one). Unlike internal/totp's from-scratch RFC 6238 implementation, WebAuthn is not simple enough for stdlib: it's a multi-step challenge/response protocol with CBOR attestation objects and COSE key parsing, and hand-rolling that verification is a real security risk. go-webauthn is the de facto standard Go implementation and is used by many production Go auth systems, so this is a deliberate exception to this codebase's usual "avoid dependencies stdlib already covers" instinct.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewRelyingParty ¶
NewRelyingParty builds a *webauthn.WebAuthn scoped to one HTTP request's own host and scheme. There is no single fixed domain to configure at startup: this is a self-hosted platform, so the relying party ID is whatever domain the operator is actually reached on, the same request-derived origin internal/api's oauthRedirectURL already uses for OAuth callbacks. Timeouts.Enforce is set on both ceremonies so an expired challenge is rejected by the library itself, on top of the caller's own short-TTL, single-use session store.
func ToWebAuthnCredential ¶
func ToWebAuthnCredential(c Credential) webauthn.Credential
ToWebAuthnCredential converts a stored Credential to the shape the library's ceremonies compare against.
Types ¶
type Credential ¶
type Credential struct {
ID string
UserID string
CredentialID []byte
PublicKey []byte
SignCount uint32
AAGUID []byte
Transports []string
Label string
// BackupEligible and BackupState are the authenticator's BE/BS flags
// at registration. webauthn.WebAuthn.FinishLogin hard-rejects a login
// whose BE flag disagrees with the stored credential's, so these
// must round-trip through storage rather than default to false.
BackupEligible bool
BackupState bool
CreatedAt time.Time
LastUsedAt *time.Time
}
Credential is one stored WebAuthn credential (migrations/0255), the shape internal/store persists and internal/api converts to and from webauthn.Credential.
func FromWebAuthnCredential ¶
func FromWebAuthnCredential(id, userID, label string, wc *webauthn.Credential, now time.Time) Credential
FromWebAuthnCredential converts a freshly created library credential (webauthn.WebAuthn.CreateCredential's result) into the row internal/store persists. id, userID and label are supplied by the caller since the library has no notion of either.
type User ¶
type User struct {
ID string
Name string
DisplayName string
Credentials []Credential
}
User adapts an account and its stored credentials to webauthn.User. WebAuthnID is the account's own store.User.ID, which is why login ceremonies never need a separate lookup table: webauthn.SessionData carries it as UserID, and that value alone resolves back to the account signing in.
func (User) WebAuthnCredentials ¶
func (u User) WebAuthnCredentials() []webauthn.Credential
WebAuthnCredentials returns u's stored credentials, converted to the library's own shape.
func (User) WebAuthnDisplayName ¶
WebAuthnDisplayName returns u's human-facing display name.
func (User) WebAuthnID ¶
WebAuthnID returns u's account ID as the WebAuthn user handle.
func (User) WebAuthnName ¶
WebAuthnName returns u's account name (its email).
Source Files