Documentation
¶
Overview ¶
Package jwt provides JWT issuance and validation backed by user/session state. Package jwt 提供基于用户/会话状态的 JWT 签发与校验。
Index ¶
- Constants
- Variables
- func WithClaims(ctx context.Context, claims Claims) context.Context
- type Claims
- type IssueOptions
- type Manager
- func (m *Manager) IssueSessionTokens(ctx context.Context, userID string, opts IssueOptions) (access string, accessExp time.Time, refresh string, refreshExp time.Time, ...)
- func (m *Manager) RevokeAccess(ctx context.Context, tokenStr string) error
- func (m *Manager) RevokeAllSessions(ctx context.Context, userID string) error
- func (m *Manager) RevokeRefresh(ctx context.Context, tokenStr string) error
- func (m *Manager) RevokeSession(ctx context.Context, userID, sessionID string) (bool, error)
- func (m *Manager) RotateRefreshTokens(ctx context.Context, oldRefresh string) (RefreshResult, bool, error)
- func (m *Manager) ValidateAccessToken(ctx context.Context, tokenStr string) (Claims, bool, error)
- func (m *Manager) ValidateRefreshToken(ctx context.Context, tokenStr string) (Claims, bool, error)
- type ManagerOptions
- type RefreshResult
Constants ¶
const ( TokenKindAccess = "access" TokenKindRefresh = "refresh" )
Variables ¶
var ( // ErrUnauthorized 表示 token 无效或已过期。 ErrUnauthorized = errors.New("unauthorized") // ErrManagerMisconfigured reports missing Manager state. // ErrManagerMisconfigured 表示 Manager 缺少必要状态。 ErrManagerMisconfigured = errors.New("jwt manager is misconfigured") // ErrUserIDRequired reports a missing user ID. // ErrUserIDRequired 表示缺少 user ID。 ErrUserIDRequired = errors.New("user id is required") // ErrSessionIDRequired reports a missing session ID. // ErrSessionIDRequired 表示缺少 session ID。 ErrSessionIDRequired = errors.New("session id is required") // ErrStoreUnavailable 表示 store 不可用。 ErrStoreUnavailable = errors.New("token store unavailable") )
Functions ¶
Types ¶
type Claims ¶
type Claims struct {
Kind string `json:"kind"`
SessionID string `json:"sid"`
Version int64 `json:"ver"`
jwt.RegisteredClaims
}
Claims contains token claims used by the auth flow. Claims 保存认证流程使用的 token claims。
type IssueOptions ¶ added in v0.1.3
type IssueOptions struct {
SessionOnly bool `json:"session_only,omitempty"`
}
IssueOptions controls token issuance behavior. IssueOptions 控制 token 签发行为。
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager issues and validates JWTs backed by SessionStore. Manager 负责签发和校验由 SessionStore 支撑的 JWT。
func New ¶
func New(signingKey string, store authstore.SessionStore) (*Manager, error)
New returns a Manager with DefaultManagerOptions. Call New(signingKey, store). New 返回使用 DefaultManagerOptions 的 Manager。 调用 New(signingKey, store)。
func NewWithOptions ¶
func NewWithOptions(signingKey string, store authstore.SessionStore, opts ManagerOptions) (*Manager, error)
NewWithOptions returns a Manager with explicit options. Use separate Manager values for different issuers, audiences, or TTLs. NewWithOptions 返回使用显式选项的 Manager。 不同 issuer、audience 或 TTL 应使用独立的 Manager。
func (*Manager) IssueSessionTokens ¶
func (m *Manager) IssueSessionTokens(ctx context.Context, userID string, opts IssueOptions) (access string, accessExp time.Time, refresh string, refreshExp time.Time, err error)
IssueSessionTokens issues access and refresh tokens. IssueSessionTokens 签发 access 与 refresh token。
func (*Manager) RevokeAccess ¶
RevokeAccess revokes the session bound to tokenStr. RevokeAccess 吊销 tokenStr 绑定的 session。
func (*Manager) RevokeAllSessions ¶
RevokeAllSessions revokes all sessions for userID. RevokeAllSessions 吊销 userID 的全部 session。
func (*Manager) RevokeRefresh ¶
RevokeRefresh revokes the session bound to tokenStr. RevokeRefresh 吊销 tokenStr 绑定的 session。
func (*Manager) RevokeSession ¶
RevokeSession revokes one session. ok reports whether the session belonged to userID. RevokeSession 吊销一个 session。 ok 表示该 session 是否属于 userID。
func (*Manager) RotateRefreshTokens ¶
func (m *Manager) RotateRefreshTokens(ctx context.Context, oldRefresh string) (RefreshResult, bool, error)
RotateRefreshTokens rotates a refresh token. ok reports whether the old refresh token was accepted. RotateRefreshTokens 轮换 refresh token。 ok 表示旧 refresh token 是否通过校验。
func (*Manager) ValidateAccessToken ¶ added in v0.1.5
ValidateAccessToken validates an access token. ok reports whether the token was accepted. ValidateAccessToken 校验 access token。 ok 表示 token 是否通过校验。
type ManagerOptions ¶
type ManagerOptions struct {
Issuer string
Audience string
AccessTTL time.Duration
RefreshTTL time.Duration
}
ManagerOptions configures NewWithOptions. ManagerOptions 配置 NewWithOptions。
func DefaultManagerOptions ¶
func DefaultManagerOptions() ManagerOptions
DefaultManagerOptions returns default options. DefaultManagerOptions 返回默认选项。
type RefreshResult ¶ added in v0.1.3
type RefreshResult struct {
Access string `json:"access,omitempty"`
AccessExpiresAt time.Time `json:"access_expires_at,omitempty"`
Refresh string `json:"refresh,omitempty"`
RefreshExpiresAt time.Time `json:"refresh_expires_at,omitempty"`
SessionOnly bool `json:"session_only,omitempty"`
}
RefreshResult contains refreshed tokens. RefreshResult 保存刷新后的 token。