Documentation
¶
Overview ¶
Package internal contains helper utilities that are intentionally private to goAuth, including secure random generation and device fingerprint helpers.
Sub-packages ¶
- audit — async event dispatch (Dispatcher + Sink implementations)
- flows — pure-function flow orchestrators for every Engine operation
- limiters — domain-specific rate limiters (account, backup-code, email, TOTP, reset)
- metrics — lock-free counters and latency histograms
- rate — core Redis-backed rate limit primitives
- security — scanner baseline and perf regression tooling
- stores — shared store interface adapters
What this package must NOT do ¶
- Export types that appear in the public goAuth API.
- Be imported by any package outside the goAuth module.
Index ¶
- func DecodeRefreshToken(token string) (string, [refreshSecretSize]byte, error)
- func DecodeResetToken(token string) (string, [resetSecretSize]byte, error)
- func EncodeRefreshToken(sessionID string, secret [refreshSecretSize]byte) (string, error)
- func EncodeResetToken(resetID string, secret [resetSecretSize]byte) (string, error)
- func HashBindingValue(v string) [32]byte
- func HashRefreshSecret(secret [refreshSecretSize]byte) [32]byte
- func HashResetBytes(secret []byte) [32]byte
- func HashResetSecret(secret [resetSecretSize]byte) [32]byte
- func NewOTP(digits int) (string, error)
- func NewRefreshSecret() ([refreshSecretSize]byte, error)
- func NewResetSecret() ([resetSecretSize]byte, error)
- type SessionID
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecodeRefreshToken ¶
DecodeRefreshToken decodes an opaque refresh token into its constituent session ID, tenant ID, and secret.
func DecodeResetToken ¶
DecodeResetToken decodes a reset token into its constituent parts.
func EncodeRefreshToken ¶
EncodeRefreshToken encodes a session ID, tenant ID, and refresh secret into an opaque base64url token string.
func EncodeResetToken ¶
EncodeResetToken encodes a reset ID, tenant ID, and secret into a base64url token.
func HashBindingValue ¶
HashBindingValue returns the SHA-256 hash of a device binding value (IP address or User-Agent string).
func HashRefreshSecret ¶
HashRefreshSecret returns the SHA-256 hash of a refresh secret.
func HashResetBytes ¶
HashResetBytes returns the SHA-256 hash of raw reset secret bytes.
func HashResetSecret ¶
HashResetSecret returns the SHA-256 hash of a reset secret string.
func NewRefreshSecret ¶
NewRefreshSecret generates a 32-byte cryptographic random refresh secret.
func NewResetSecret ¶
NewResetSecret generates a cryptographic random secret for password reset.
Types ¶
type SessionID ¶
type SessionID [16]byte
SessionID is a cryptographically random 128-bit session identifier.
func NewSessionID ¶
NewSessionID generates a cryptographically random 128-bit session ID.
func ParseSessionID ¶
ParseSessionID decodes a hex-encoded session ID string.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package audit implements async event dispatching for security-relevant operations.
|
Package audit implements async event dispatching for security-relevant operations. |
|
Package flows contains pure-function orchestrators for every Engine operation.
|
Package flows contains pure-function orchestrators for every Engine operation. |
|
Package limiters provides domain-specific rate limiters built on top of the internal/rate primitives.
|
Package limiters provides domain-specific rate limiters built on top of the internal/rate primitives. |
|
Package metrics provides lock-free counters and latency histograms for goAuth observability.
|
Package metrics provides lock-free counters and latency histograms for goAuth observability. |
|
Package rate provides internal primitives used to build Redis-backed rate limit keys, errors, and limiter behavior for security-sensitive authentication workflows.
|
Package rate provides internal primitives used to build Redis-backed rate limit keys, errors, and limiter behavior for security-sensitive authentication workflows. |
|
Package security contains CLI tooling for automated security analysis: performance regression gates, static-analysis scanner baselines, and related helper scripts.
|
Package security contains CLI tooling for automated security analysis: performance regression gates, static-analysis scanner baselines, and related helper scripts. |
|
Package stores provides Redis-backed, short-lived record stores for security-sensitive authentication flows: password reset, email verification, and MFA login challenges.
|
Package stores provides Redis-backed, short-lived record stores for security-sensitive authentication flows: password reset, email verification, and MFA login challenges. |
|
Package window provides the shared rate-limit window primitive used by every limiter domain (internal/rate and internal/limiters).
|
Package window provides the shared rate-limit window primitive used by every limiter domain (internal/rate and internal/limiters). |