auth

package

v1.0.0 Latest Latest Go to latest Published: Aug 26, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/GZ-Alinx/awsinfra

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func HashPassword(password []byte) (string, error)
func VerifyPassword(encoded string, password []byte) bool
func WithSession(ctx context.Context, session Session) context.Context
type Service
- func NewService(config appconfig.SecurityConfig, encodedPasswordHash string) (*Service, error)
- func NewServiceWithUsers(config appconfig.SecurityConfig, encodedPasswordHash string, users UserStore) (*Service, error)
type Session
- func SessionFromContext(ctx context.Context) (Session, bool)
type UserStore

Constants ¶

View Source

const CookieName = "ops_deploy_session"

Variables ¶

View Source

var (
	ErrInvalidCredentials = errors.New("invalid username or password")
	ErrRateLimited        = errors.New("too many login attempts; try again later")
	ErrUnauthenticated    = errors.New("authentication required")
	ErrInvalidCSRF        = errors.New("invalid CSRF token")
)

Functions ¶

func HashPassword ¶

func HashPassword(password []byte) (string, error)

func VerifyPassword ¶

func VerifyPassword(encoded string, password []byte) bool

func WithSession ¶

func WithSession(ctx context.Context, session Session) context.Context

Types ¶

type Service ¶

type Service struct {
	// contains filtered or unexported fields
}

func NewService ¶

func NewService(config appconfig.SecurityConfig, encodedPasswordHash string) (*Service, error)

func NewServiceWithUsers ¶

func NewServiceWithUsers(config appconfig.SecurityConfig, encodedPasswordHash string, users UserStore) (*Service, error)

func (*Service) Authenticate ¶

func (s *Service) Authenticate(r *http.Request) (Session, error)

func (s *Service) Login(w http.ResponseWriter, r *http.Request, username, password string) (Session, error)

func (*Service) Logout ¶

func (s *Service) Logout(w http.ResponseWriter, r *http.Request)

func (*Service) Reauthenticate ¶

func (s *Service) Reauthenticate(ctx context.Context, username, password string) error

Reauthenticate verifies the current user's password without issuing a new session. It is used for short-lived access to production credentials.

func (*Service) ReauthenticateRequest ¶

func (s *Service) ReauthenticateRequest(r *http.Request, username, password string) error

ReauthenticateRequest adds an independent client/user lockout to sensitive operations, so a stolen session cannot be used to brute-force a password.

func (*Service) RefreshCurrentSession ¶

func (s *Service) RefreshCurrentSession(r *http.Request, user access.User) (Session, error)

RefreshCurrentSession keeps the caller signed in after a profile-only update while preserving the normal updated_at based invalidation for all other sessions.

func (*Service) ValidateCSRF ¶

func (s *Service) ValidateCSRF(r *http.Request, session Session) error

type Session ¶

type Session struct {
	Username            string                    `json:"username"`
	DisplayName         string                    `json:"display_name"`
	IsAdmin             bool                      `json:"is_admin"`
	PlatformPermissions access.PlatformPermission `json:"platform_permissions"`
	CSRFToken           string                    `json:"csrf_token"`
	ExpiresAt           time.Time                 `json:"expires_at"`
}

func SessionFromContext ¶

func SessionFromContext(ctx context.Context) (Session, bool)

type UserStore ¶

type UserStore interface {
	GetUser(context.Context, string) (access.User, error)
}

Source Files ¶

View all Source files

service.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL