auth

package

v0.4.2 Latest Latest Go to latest Published: Sep 6, 2026 License: Apache-2.0 Imports: 28 Imported by: 0

Documentation ¶

Index ¶

Variables
func HashPassword(password string) (string, error)
func NewCSRFToken(secret []byte) (string, error)
func NormalizeEmail(email string) string
func RegisterRoutes(mux *http.ServeMux, service *Service)
func RequireAuthentication(service *Service, next http.Handler) http.Handler
func RequirePermission(service *Service, permission string, next http.Handler) http.Handler
func RequireRole(service *Service, role string, next http.Handler) http.Handler
func ValidateCSRFToken(secret []byte, token string) bool
func ValidatePassword(password string) error
func VerifyPassword(encoded, password string) bool
type AuthResponse
type AuthResult
type CSRFResponse
type Controller
- func NewController(service *Service) *Controller
- func (c *Controller) HandleCSRF(w http.ResponseWriter, r *http.Request)
- func (c *Controller) HandleLogin(w http.ResponseWriter, r *http.Request)
- func (c *Controller) HandleLogout(w http.ResponseWriter, r *http.Request)
- func (c *Controller) HandleMe(w http.ResponseWriter, r *http.Request)
- func (c *Controller) HandleRefresh(w http.ResponseWriter, r *http.Request)
type LoginRequest
type PostgresRepository
- func NewPostgresRepository(pool *pgxpool.Pool) *PostgresRepository
- func (r *PostgresRepository) ClearLoginAttempts(ctx context.Context, key string) error
- func (r *PostgresRepository) CreateAdmin(ctx context.Context, email, passwordHash string) (User, error)
- func (r *PostgresRepository) CreateRefreshToken(ctx context.Context, token refreshToken) error
- func (r *PostgresRepository) FindUserByEmail(ctx context.Context, email string) (storedUser, error)
- func (r *PostgresRepository) IsLoginRateLimited(ctx context.Context, key string, now time.Time) (bool, error)
- func (r *PostgresRepository) RecordLoginFailure(ctx context.Context, key string, now time.Time) (bool, error)
- func (r *PostgresRepository) RevokeRefreshFamilyByToken(ctx context.Context, hash []byte, now time.Time) error
- func (r *PostgresRepository) RotateRefreshToken(ctx context.Context, hash []byte, replacement refreshToken, now time.Time) (storedUser, error)
type Principal
- func PrincipalFromContext(ctx context.Context) (Principal, bool)
type Repository
type Service
- func NewProvisioner(repository Repository) *Service
- func NewService(repository Repository, tokens *TokenManager, csrfSecret string, ...) *Service
- func (s *Service) Authenticate(rawToken string, now time.Time) (Principal, error)
- func (s *Service) Available() bool
- func (s *Service) CreateAdmin(ctx context.Context, email, password string) (User, error)
- func (s *Service) Login(ctx context.Context, request LoginRequest, remoteAddr string, now time.Time) (AuthResult, error)
- func (s *Service) Logout(ctx context.Context, rawToken string, now time.Time) error
- func (s *Service) NewCSRFToken() (string, error)
- func (s *Service) Refresh(ctx context.Context, rawToken string, now time.Time) (AuthResult, error)
- func (s *Service) ValidateCSRFToken(token string) bool
type TokenManager
- func LoadTokenManager(privatePath, publicPath, keyID, issuer, audience string) (*TokenManager, error)
- func (m *TokenManager) IssueAccessToken(user User, now time.Time, ttl time.Duration) (string, error)
- func (m *TokenManager) ParseAccessToken(raw string, now time.Time) (Principal, error)
type User

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrUnavailable         = errors.New("authentication unavailable")
	ErrInvalidCredentials  = errors.New("invalid credentials")
	ErrRateLimited         = errors.New("login rate limited")
	ErrInvalidRefreshToken = errors.New("invalid refresh token")
	ErrRefreshReuse        = errors.New("refresh token reuse detected")
	ErrInvalidCSRF         = errors.New("invalid csrf token")
	ErrUnauthenticated     = errors.New("authentication required")
	ErrForbidden           = errors.New("permission denied")
	ErrUserExists          = errors.New("user already exists")
)

Functions ¶

func HashPassword ¶

func HashPassword(password string) (string, error)

func NewCSRFToken ¶

func NewCSRFToken(secret []byte) (string, error)

func NormalizeEmail ¶

func NormalizeEmail(email string) string

func RegisterRoutes ¶

func RegisterRoutes(mux *http.ServeMux, service *Service)

func RequireAuthentication ¶

func RequireAuthentication(service *Service, next http.Handler) http.Handler

func RequirePermission ¶

func RequirePermission(service *Service, permission string, next http.Handler) http.Handler

func RequireRole ¶ added in v0.4.0

func RequireRole(service *Service, role string, next http.Handler) http.Handler

RequireRole enforces an explicit role after authenticating the request. Roles do not grant access implicitly; product routes should normally pair this check with RequirePermission when both dimensions are part of the authorization contract.

func ValidateCSRFToken ¶

func ValidateCSRFToken(secret []byte, token string) bool

func ValidatePassword ¶

func ValidatePassword(password string) error

func VerifyPassword ¶

func VerifyPassword(encoded, password string) bool

Types ¶

type AuthResponse ¶

type AuthResponse struct {
	User User `json:"user"`
}

type AuthResult ¶

type AuthResult struct {
	User         User
	AccessToken  string
	RefreshToken string
}

type CSRFResponse ¶

type CSRFResponse struct {
	CSRFToken string `json:"csrf_token"`
}

type Controller ¶

type Controller struct {
	// contains filtered or unexported fields
}

func NewController ¶

func NewController(service *Service) *Controller

func (*Controller) HandleCSRF ¶

func (c *Controller) HandleCSRF(w http.ResponseWriter, r *http.Request)

func (*Controller) HandleLogin ¶

func (c *Controller) HandleLogin(w http.ResponseWriter, r *http.Request)

func (*Controller) HandleLogout ¶

func (c *Controller) HandleLogout(w http.ResponseWriter, r *http.Request)

func (*Controller) HandleMe ¶

func (c *Controller) HandleMe(w http.ResponseWriter, r *http.Request)

func (*Controller) HandleRefresh ¶

func (c *Controller) HandleRefresh(w http.ResponseWriter, r *http.Request)

type LoginRequest ¶

type LoginRequest struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

type PostgresRepository ¶

type PostgresRepository struct {
	// contains filtered or unexported fields
}

func NewPostgresRepository ¶

func NewPostgresRepository(pool *pgxpool.Pool) *PostgresRepository

func (*PostgresRepository) ClearLoginAttempts ¶

func (r *PostgresRepository) ClearLoginAttempts(ctx context.Context, key string) error

func (*PostgresRepository) CreateAdmin ¶

func (r *PostgresRepository) CreateAdmin(ctx context.Context, email, passwordHash string) (User, error)

func (*PostgresRepository) CreateRefreshToken ¶

func (r *PostgresRepository) CreateRefreshToken(ctx context.Context, token refreshToken) error

func (*PostgresRepository) FindUserByEmail ¶

func (r *PostgresRepository) FindUserByEmail(ctx context.Context, email string) (storedUser, error)

func (*PostgresRepository) IsLoginRateLimited ¶

func (r *PostgresRepository) IsLoginRateLimited(ctx context.Context, key string, now time.Time) (bool, error)

func (*PostgresRepository) RecordLoginFailure ¶

func (r *PostgresRepository) RecordLoginFailure(ctx context.Context, key string, now time.Time) (bool, error)

func (*PostgresRepository) RevokeRefreshFamilyByToken ¶

func (r *PostgresRepository) RevokeRefreshFamilyByToken(ctx context.Context, hash []byte, now time.Time) error

func (*PostgresRepository) RotateRefreshToken ¶

func (r *PostgresRepository) RotateRefreshToken(ctx context.Context, hash []byte, replacement refreshToken, now time.Time) (storedUser, error)

type Principal ¶

type Principal struct {
	User
	TokenID string
}

func PrincipalFromContext ¶

func PrincipalFromContext(ctx context.Context) (Principal, bool)

type Repository ¶

type Repository interface {
	FindUserByEmail(context.Context, string) (storedUser, error)
	CreateAdmin(context.Context, string, string) (User, error)
	IsLoginRateLimited(context.Context, string, time.Time) (bool, error)
	RecordLoginFailure(context.Context, string, time.Time) (bool, error)
	ClearLoginAttempts(context.Context, string) error
	CreateRefreshToken(context.Context, refreshToken) error
	RotateRefreshToken(context.Context, []byte, refreshToken, time.Time) (storedUser, error)
	RevokeRefreshFamilyByToken(context.Context, []byte, time.Time) error
}

type Service ¶

type Service struct {
	// contains filtered or unexported fields
}

func NewProvisioner ¶

func NewProvisioner(repository Repository) *Service

func NewService ¶

func NewService(repository Repository, tokens *TokenManager, csrfSecret string, accessTokenTTL, refreshTokenTTL time.Duration, cookieSecure bool, cookieSameSite http.SameSite) *Service

func (*Service) Authenticate ¶

func (s *Service) Authenticate(rawToken string, now time.Time) (Principal, error)

func (*Service) Available ¶

func (s *Service) Available() bool

func (*Service) CreateAdmin ¶

func (s *Service) CreateAdmin(ctx context.Context, email, password string) (User, error)

func (s *Service) Login(ctx context.Context, request LoginRequest, remoteAddr string, now time.Time) (AuthResult, error)

func (*Service) Logout ¶

func (s *Service) Logout(ctx context.Context, rawToken string, now time.Time) error

func (*Service) NewCSRFToken ¶

func (s *Service) NewCSRFToken() (string, error)

func (*Service) Refresh ¶

func (s *Service) Refresh(ctx context.Context, rawToken string, now time.Time) (AuthResult, error)

func (*Service) ValidateCSRFToken ¶

func (s *Service) ValidateCSRFToken(token string) bool

type TokenManager ¶

type TokenManager struct {
	// contains filtered or unexported fields
}

func LoadTokenManager ¶

func LoadTokenManager(privatePath, publicPath, keyID, issuer, audience string) (*TokenManager, error)

func (*TokenManager) IssueAccessToken ¶

func (m *TokenManager) IssueAccessToken(user User, now time.Time, ttl time.Duration) (string, error)

func (*TokenManager) ParseAccessToken ¶

func (m *TokenManager) ParseAccessToken(raw string, now time.Time) (Principal, error)

type User ¶

type User struct {
	ID          int64    `json:"id"`
	Email       string   `json:"email"`
	Roles       []string `json:"roles"`
	Permissions []string `json:"permissions"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL