Documentation
¶
Index ¶
- Constants
- func AppendPasswordHistory(history []string, newHash string) []string
- func CheckPasswordHash(password, hash string) bool
- func CheckPasswordHistory(history []string, newPassword string) bool
- func CountRemainingCodes(hashedCodes []string) int
- func GenerateAccessKey() (string, error)
- func GenerateQRCode(key *otp.Key) ([]byte, error)
- func GenerateRSAKeyPair() (*rsa.PrivateKey, *rsa.PublicKey, error)
- func GenerateRecoveryCodes(count int) ([]string, error)
- func GenerateSTSToken(roleID int, roleName string, tenantID int, duration time.Duration, ...) (string, error)
- func GenerateSecretKey() (string, error)
- func GenerateTOTPKey(accountName string) (*otp.Key, error)
- func GenerateToken(userID int, username string, tenantID int, mfaAuth bool, ...) (string, error)
- func HashPassword(password string) (string, error)
- func HashRecoveryCode(code string) (string, error)
- func HashRecoveryCodes(codes []string) ([]string, error)
- func InvalidateRecoveryCode(hashedCodes []string, index int) []string
- func IsEmail(s string) bool
- func ParsePrivateKeyFromPEM(pemStr string) (*rsa.PrivateKey, error)
- func ParsePublicKeyFromPEM(pemStr string) (*rsa.PublicKey, error)
- func PrivateKeyToPEM(priv *rsa.PrivateKey) string
- func PublicKeyToPEM(pub *rsa.PublicKey) string
- func SignRequest(req *http.Request, accessKey, secretKey string) error
- func TenantIDFromContext(ctx context.Context) (int, bool)
- func UserIDFromContext(ctx context.Context) (int, bool)
- func UsernameFromContext(ctx context.Context) (string, bool)
- func ValidatePassword(password string) error
- func ValidateTOTP(passcode string, secret string) bool
- func VerifyRecoveryCode(hashedCodes []string, inputCode string) (int, bool)
- func VerifySignature(req *http.Request, secretKey string, signatureToVerify string) (bool, error)
- func WithTenantID(ctx context.Context, tenantID int) context.Context
- func WithUserID(ctx context.Context, userID int) context.Context
- func WithUsername(ctx context.Context, username string) context.Context
- type Claims
- type RedisValidator
- type Validator
Constants ¶
const ( HeaderNuwaDate = "X-Nuwa-Date" HeaderAuthorization = "Authorization" Algorithm = "HMAC-SHA256" )
const ( RecoveryCodeLength = 8 // 8-character recovery codes RecoveryCodeCount = 10 // Generate 10 recovery codes )
Variables ¶
This section is empty.
Functions ¶
func AppendPasswordHistory ¶
AppendPasswordHistory adds new hash and keeps max 5
func CheckPasswordHash ¶
CheckPasswordHash compares a password with a hash
func CheckPasswordHistory ¶
CheckPasswordHistory checks if the new password has been used recently (in last 5).
func CountRemainingCodes ¶
CountRemainingCodes counts how many recovery codes are still valid
func GenerateAccessKey ¶
GenerateAccessKey generates a random Access Key (AK) Format: NW + 18 characters random alphanumeric (approx) Example: NWABC123...
func GenerateQRCode ¶
GenerateQRCode returns the QR code image bytes for a key.
func GenerateRSAKeyPair ¶
func GenerateRSAKeyPair() (*rsa.PrivateKey, *rsa.PublicKey, error)
GenerateRSAKeyPair generates a new RSA key pair of 2048 bits
func GenerateRecoveryCodes ¶
GenerateRecoveryCodes generates N random recovery codes Returns plaintext codes for display to user
func GenerateSTSToken ¶
func GenerateSTSToken(roleID int, roleName string, tenantID int, duration time.Duration, mfaAuth bool, signKey *rsa.PrivateKey) (string, error)
GenerateSTSToken generates a temporary JWT token for an assumed role (RS256)
func GenerateSecretKey ¶
GenerateSecretKey generates a random Secret Key (SK) Typically 40 characters.
func GenerateTOTPKey ¶
GenerateTOTPKey generates a new TOTP key for a user.
func GenerateToken ¶
func GenerateToken(userID int, username string, tenantID int, mfaAuth bool, signKey *rsa.PrivateKey) (string, error)
GenerateToken generates a new JWT token for a user (RS256)
func HashPassword ¶
HashPassword hashes the password using bcrypt
func HashRecoveryCode ¶
HashRecoveryCode hashes a recovery code using bcrypt This allows secure storage and one-time use verification
func HashRecoveryCodes ¶
HashRecoveryCodes hashes multiple recovery codes
func InvalidateRecoveryCode ¶
InvalidateRecoveryCode marks a recovery code as used by clearing it
func ParsePrivateKeyFromPEM ¶
func ParsePrivateKeyFromPEM(pemStr string) (*rsa.PrivateKey, error)
ParsePrivateKeyFromPEM parses a PEM encoded private key
func ParsePublicKeyFromPEM ¶
ParsePublicKeyFromPEM parses a PEM encoded public key
func PrivateKeyToPEM ¶
func PrivateKeyToPEM(priv *rsa.PrivateKey) string
PrivateKeyToPEM encodes Private Key to PEM
func PublicKeyToPEM ¶
PublicKeyToPEM encodes Public Key to PEM
func SignRequest ¶
SignRequest calculates the signature and adds the Authorization header to the request. It also sets X-Nuwa-Date if not present. Format: Nuwa <AccessKey>:<Signature>
func TenantIDFromContext ¶
TenantIDFromContext returns the tenant ID from the context
func UserIDFromContext ¶
UserIDFromContext returns the user ID from the context
func UsernameFromContext ¶
UsernameFromContext returns the username from the context
func ValidatePassword ¶
ValidatePassword enforces password complexity policy
func ValidateTOTP ¶
ValidateTOTP validates a passcode against the secret.
func VerifyRecoveryCode ¶
VerifyRecoveryCode verifies a recovery code against hashed codes Returns (matched, index) where index is the position of the matched code Returns (-1, false) if no match found
func VerifySignature ¶
VerifySignature verifies the request signature. Returns true if valid.
func WithTenantID ¶
WithTenantID returns a new context with the given tenant ID
func WithUserID ¶
WithUserID returns a new context with the given user ID
Types ¶
type Claims ¶
type Claims struct {
UserID int `json:"user_id,omitempty"`
Username string `json:"username,omitempty"`
TenantID int `json:"tenant_id,omitempty"`
RoleID int `json:"role_id,omitempty"` // For STS
MfaAuthenticated bool `json:"mfa_authenticated,omitempty"`
jwt.RegisteredClaims
}
Claims defines the custom claims for our JWT
type RedisValidator ¶
type RedisValidator struct {
// contains filtered or unexported fields
}
RedisValidator implements Validator using Redis
func NewRedisValidator ¶
func NewRedisValidator(cache cache.Cache) *RedisValidator
Source Files