Documentation
¶
Overview ¶
Package auth owns the ctm serve password hashing, user credentials file, and in-memory session store (V27 single-user auth).
Index ¶
- Variables
- func Delete() error
- func Exists() bool
- func Required(token string, next http.Handler) http.Handler
- func Save(u User) error
- func UserFrom(ctx context.Context) string
- func UserPath() string
- func Verify(enc Encoded, password string) bool
- func WithUser(ctx context.Context, user string) context.Context
- type Encoded
- type Params
- type Store
- type User
Constants ¶
This section is empty.
Variables ¶
var DefaultParams = Params{
M: 64 * 1024,
T: 3,
P: 2,
SaltLen: 16,
HashLen: 32,
}
DefaultParams is the canonical set of argon2id params used by Hash. Stored inside Encoded so a future bump does not invalidate old hashes.
Functions ¶
func Delete ¶
func Delete() error
Delete removes user.json. Returns nil if the file was already absent (idempotent by design so ctm auth reset can be run twice without confusion).
func Required ¶
Required returns an HTTP middleware that enforces a static bearer token. Requests without an `Authorization: Bearer <token>` header matching the expected token (constant-time compared) are rejected with 401 + a small JSON body and the standard `WWW-Authenticate` challenge header.
An empty `token` argument is a programming error (Required is wired at server boot, not per-request) and panics rather than silently disabling auth.
func Save ¶
Save writes u to UserPath() atomically (tmp-file + rename) with 0600 perms, creating the config directory if needed.
Types ¶
type Encoded ¶
type Encoded struct {
Algo string `json:"algo"`
Params Params `json:"params"`
SaltB64 string `json:"salt_b64"`
HashB64 string `json:"hash_b64"`
}
Encoded is the on-disk representation of a hashed password. Everything needed to verify a password against this hash is contained here; no external key material is required.
type Params ¶
type Params struct {
M uint32 `json:"m"`
T uint32 `json:"t"`
P uint8 `json:"p"`
SaltLen uint32 `json:"salt_len"`
HashLen uint32 `json:"hash_len"`
}
Params holds the argon2id cost parameters. Defaults follow current OWASP guidance for modest-power servers.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is a goroutine-safe in-memory map of session tokens to usernames. The zero value is unusable; callers must use NewStore. Single-user assumption: the map contains 0..N entries for a single username (one per device).
func (*Store) Create ¶
Create issues a new random 32-byte session token for username and returns it. Token format: base64.URL-encoded.
func (*Store) Lookup ¶
Lookup returns the username bound to tok, or ("", false) if the token is unknown. If user.json has been deleted since last check, the entire store is wiped before reporting false.
func (*Store) Seed ¶
Seed inserts a pre-known token → username mapping. Intended only for test seams where the caller injects a fixed token via Options.Token.
func (*Store) SetStaleWindowForTest ¶
SetStaleWindowForTest lets tests force an immediate restat.
Source Files