Help us shape the future of Go! Take the 2026 Go Developer Survey

postgres

package
v0.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 1, 2026 License: MIT Imports: 28 Imported by: 2

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrLegacySchemaRequiresReset = errors.New("goauth v0.1 schema requires an explicit dev/test reset")
	ErrResetConfirmationRequired = errors.New("explicit goauth reset confirmation is required")
	ErrFutureSchema              = errors.New("goauth database schema is newer than this library")
	ErrSchemaNeedsMigration      = errors.New("goauth database schema requires migration")
	ErrSchemaChecksumMismatch    = errors.New("goauth migration checksum mismatch")
)
View Source 
var ErrAuthTransactionAlreadyActive = errors.New("auth transaction is already active")

ErrAuthTransactionAlreadyActive means an owned auth transaction was requested from a context already carrying a managed transaction on the same database handle. The owned callback is not invoked and no new transaction is started.

Functions

func Down 

func Down(ctx context.Context, db *sql.DB, confirmation ResetConfirmation) error

Down removes canonical auth state, including managed notifications, and requires an exact confirmation value. It is intended for isolated development and test databases; Migrate never calls it implicitly.

func Migrate 

func Migrate(ctx context.Context, db *sql.DB) error

func NewRBAC 

func NewRBAC(db *sql.DB, cache rbac.Cache) (*rbac.Service, error)

func VerifySchema 

func VerifySchema(ctx context.Context, db *sql.DB) error

VerifySchema checks the schema version, additive migration checksums, required tables, credential-policy and notification queue columns/index, and the subject-retirement marker, validated disabled-only fence, and rate-event retention index. It does not compare every type, index, foreign key or constraint. AutoMigrate-disabled Runtime construction also performs this nonmutating check.

Types

type CleanupBatchResult added in v0.7.0 

type CleanupBatchResult struct {
	CleanupResult
	OIDCRequests int64
	OIDCCodes    int64
}

CleanupBatchResult reports confirmed commits from one bounded maintenance pass. Each field is independently bounded by perCategoryLimit; OIDCRefreshFamilies and RefreshFamilies are additionally capped at 32. NotificationsExpired counts envelope updates, while NotificationReceipts counts physical row deletions.

type CleanupPolicy 

type CleanupPolicy struct {
	// ExpiredRecordRetention applies to canonical refresh history only after
	// its family or session ends, never merely after token consumption/expiry.
	ExpiredRecordRetention       time.Duration
	RateEventRetention           time.Duration
	AuditEventRetention          time.Duration
	NotificationReceiptRetention time.Duration
	Now                          func() time.Time
}

func DefaultCleanupPolicy 

func DefaultCleanupPolicy() CleanupPolicy

type CleanupResult 

type CleanupResult struct {
	PasswordResets       int64
	EmailChallenges      int64
	EmailChanges         int64
	RefreshTokens        int64
	RefreshFamilies      int64
	OIDCRefreshTokens    int64
	OIDCRefreshFamilies  int64
	Sessions             int64
	RateEvents           int64
	AuditEvents          int64
	NotificationsExpired int64
	NotificationReceipts int64
}

type Config 

type Config struct {
	DB                 *sql.DB
	DSN                string
	AutoMigrate        bool
	ConnectionTimeout  time.Duration
	NotificationSender goauth.NotificationSender
	NotificationWorker NotificationWorkerConfig
	Runtime            goauth.Config
}

type CredentialProof added in v0.5.0 

type CredentialProof struct {
	// contains filtered or unexported fields
}

CredentialProof is an opaque, short-lived credential verification bound to one runtime. It contains no password and can only be prepared by that runtime.

type NotificationBlockedEvent 

type NotificationBlockedEvent struct {
	DeliveryID string
	Reason     string
}

NotificationBlockedEvent contains no payload, key material, or raw error.

type NotificationQueueStats 

type NotificationQueueStats struct {
	Pending int64
	// GatewayAccepted is durable queue ownership, not provider acceptance.
	GatewayAccepted int64
	Leased          int64
	Blocked         int64
	Delivered       int64
	// Exhausted includes an exhausted retry budget or explicit terminal sender rejection.
	Exhausted      int64
	Expired        int64
	Cancelled      int64
	OldestQueuedAt *time.Time
	WorkerRunning  bool
}

type NotificationWorkerConfig 

type NotificationWorkerConfig struct {
	Workers       int
	PollInterval  time.Duration
	SendTimeout   time.Duration
	LeaseDuration time.Duration
	RetryMin      time.Duration
	RetryMax      time.Duration
	MaxAttempts   int
	// OnBlocked receives a safe diagnostic after a decrypt failure is persisted.
	// It should return promptly; the worker continues with other deliveries.
	OnBlocked func(NotificationBlockedEvent)
}

type OIDCRefreshTokenStore 

type OIDCRefreshTokenStore struct {
	// contains filtered or unexported fields
}

OIDCRefreshTokenStore persists only a deterministic selector and an HMAC digest. The raw bearer token exists only at the provider boundary.

func NewOIDCRefreshTokenStore 

func NewOIDCRefreshTokenStore(db *sql.DB, keys goauth.KeyRing) (*OIDCRefreshTokenStore, error)

func (*OIDCRefreshTokenStore) Get 

func (s *OIDCRefreshTokenStore) Get(ctx context.Context, rawToken string) (oidc.RefreshToken, error)

func (*OIDCRefreshTokenStore) Revoke 

func (s *OIDCRefreshTokenStore) Revoke(ctx context.Context, rawToken string, revokedAt time.Time) error

func (*OIDCRefreshTokenStore) Rotate 

func (s *OIDCRefreshTokenStore) Rotate(
	ctx context.Context,
	currentRaw string,
	next oidc.RefreshToken,
	rotatedAt time.Time,
) error

func (*OIDCRefreshTokenStore) Save 

func (s *OIDCRefreshTokenStore) Save(ctx context.Context, token oidc.RefreshToken) error

type RateLimitCleanupRequest added in v0.6.0 

type RateLimitCleanupRequest struct {
	Before time.Time
	Limit  int
}

RateLimitCleanupRequest describes one bounded, independent retention pass. Before is exclusive; zero defaults to the configured Runtime clock minus 25h. An explicit Before must be at least 24h old. Limit must be in [1, 1000]. Callers must retain the longest window used by EVERY consumer of the shared table, plus clock-skew/request-latency margin. The 24h minimum only covers Runtime policy bounds; direct Store.TakeRateLimit permits longer windows.

type ResetConfirmation 

type ResetConfirmation string

ResetConfirmation is intentionally a distinct type so destructive schema resets cannot receive an arbitrary runtime string by accident. 

const ConfirmResetAuthState ResetConfirmation = "RESET GOAUTH AUTH STATE"

ConfirmResetAuthState must be passed explicitly to Down. Keeping the value typed prevents ordinary runtime strings from crossing the destructive API.

type Runtime 

type Runtime struct {
	*goauth.Runtime
	// contains filtered or unexported fields
}

Runtime owns a fully assembled goauth Runtime and, when constructed from a DSN, the database handle opened for it.

func NewRuntime 

func NewRuntime(config Config) (*Runtime, error)

func (*Runtime) CancelNotification added in v0.9.0 

func (r *Runtime) CancelNotification(ctx context.Context, id string) (bool, error)

CancelNotification stops future managed sends for a pending or blocked delivery whose original deadlines and retry budget remain live. It never cancels a leased delivery, including an elapsed lease with an unknown outcome. It clears the encrypted payload and lease ownership, retaining the receipt, attempt count and original deadlines. A false, nil result changes no row.

Cancellation does not prove that an earlier attempt was not accepted by the provider. It does not revoke a credential or reissue a notification. Eligibility is based on queue state and deadlines, not the current credential reference. A managed transaction on this database is joined, allowing host audit writes to commit atomically; the result is provisional until that transaction commits.

func (*Runtime) Cleanup 

func (r *Runtime) Cleanup(ctx context.Context, policy CleanupPolicy) (CleanupResult, error)

func (*Runtime) CleanupBatch added in v0.7.0 

func (r *Runtime) CleanupBatch(ctx context.Context, policy CleanupPolicy, perCategoryLimit int) (CleanupBatchResult, error)

CleanupBatch performs one opt-in, bounded broad maintenance pass. The limit must be 1..1000 and is per result field, NOT a total row budget. At most 12*perCategoryLimit + 2*min(perCategoryLimit, 32) row changes can commit. Policy defaults and retention predicates are the same as Cleanup; Cleanup's established behavior is unchanged. The policy clock is sampled exactly once.

Notification, OIDC, canonical refresh/session and generic cleanup commit in separate phases, releasing each phase's locks before the next. Active managed transactions, including foreign scopes, are rejected before SQL. On error, the result contains only earlier confirmed phases, never the failed phase's provisional counts. An unknown commit preserves ErrOperationOutcomeUnknown; zero counts do not establish rollback or recover an earlier uncertain count.

Call again with the same fixed policy clock to continue remaining eligible rows. There is no cursor, internal retry or exhaustion signal: locked rows, dependent rows and chain prefixes remain for later passes. Even a zero result does not prove the backlog is empty. Hosts own deadlines and spaced cadence; row-change bounds do not bound scan cost, lock latency or elapsed time.

func (*Runtime) CleanupNotificationReceipts added in v0.9.0 

func (r *Runtime) CleanupNotificationReceipts(
	ctx context.Context, retention time.Duration, limit int,
) (int64, error)

CleanupNotificationReceipts deletes at most limit scrubbed terminal managed notification receipts. It does not expire payloads or touch other auth data. Retention defaults to seven days and must be at least 24 hours. Both the original validity deadline and any delivered_at timestamp must be strictly older than the retention cutoff. In-flight, nonterminal and unsanitized rows remain, including rows whose leases have elapsed.

limit must be in [1, 1000]. Locked rows are skipped; a zero result does not prove that no eligible rows remain. Hosts own timeouts and spaced scheduling; a row bound does not bound query cost or elapsed time. A managed transaction on this database is joined, and the count is provisional until it commits.

func (*Runtime) CleanupRateLimitEvents added in v0.6.0 

func (r *Runtime) CleanupRateLimitEvents(ctx context.Context, request RateLimitCleanupRequest) (int64, error)

CleanupRateLimitEvents deletes only expired rate events, returning a count only after its own transaction commits. Active same-handle and foreign managed transaction contexts are rejected before SQL. Errors return zero; an uncertain commit preserves goauth.ErrOperationOutcomeUnknown. Retrying may delete another expired batch and does not recover the original count.

At most Limit oldest eligible candidates are materialized before row locking. Locked candidates are skipped without walking farther through the backlog. Fewer deletions, including zero, never prove that the backlog is empty. This method performs no internal retry/loop and takes no advisory or subject locks. Hosts must use deadlines and bounded, spaced worker wakes: bounded candidate cardinality and the retention index cannot guarantee wall-clock latency.

func (*Runtime) Close 

func (r *Runtime) Close() error

func (*Runtime) Database added in v0.5.0 

func (r *Runtime) Database() *sql.DB

Database returns the canonical database handle shared by managed transactions. Hosts must obtain context-scoped SQLExecutor for writes within those transactions.

func (*Runtime) ExpireNotifications added in v0.6.0 

func (r *Runtime) ExpireNotifications(ctx context.Context, limit int) (int64, error)

ExpireNotifications retires at most limit expired encrypted notification envelopes using the Runtime clock. It does not delete receipt rows, reset records, sessions, identifiers or audit events. Hosts may call it periodically; valid notifications and their original deadlines are never changed.

Expired means no further attempts are allowed, not that a provider could never have accepted an in-flight request. The cleared lease prevents a late sender completion from overwriting expiry. Unknown transport outcomes remain the host's responsibility and must never be reported as confirmed non-delivery. limit must be in [1, 1000]. Locked rows are skipped for a later bounded pass. The verified database constraint valid_until <= delete_after makes this cutoff equivalent to either deadline expiring. A partial index supports batch location; hosts still need a timeout because locked-row skipping and contention cost time. A managed transaction on this database is joined; a foreign scope is rejected.

func (*Runtime) InAuthTransaction added in v0.5.0 

func (r *Runtime) InAuthTransaction(ctx context.Context, fn func(context.Context) error) error

InAuthTransaction shares canonical auth, audit, RBAC and host SQL writes on this exact database handle. Nested operations join; only the outer call commits. fn must wait for all concurrent operations using its context before returning. The transaction context and its SQL executors must not outlive fn. Consume and close SQL result sets before another operation uses the same transaction connection; mixed Query/Exec calls must be serialized.

func (*Runtime) InOwnedAuthTransaction added in v0.6.0 

func (r *Runtime) InOwnedAuthTransaction(ctx context.Context, fn func(context.Context) error) error

InOwnedAuthTransaction owns the outermost managed auth transaction on this exact database handle. It rejects an ambient same-handle scope with ErrAuthTransactionAlreadyActive before invoking fn or starting a transaction; a scope belonging to another database handle is also rejected. InAuthTransaction and participating low-level operations may still join inside fn.

A nil return confirms commit. Prepared secrets, tokens and authorization results remain provisional until then: fn must not publish them, and callers must withhold them on every error, including goauth.ErrOperationOutcomeUnknown. An unknown outcome must not be treated as a rollback or blindly retried. The context, executor, concurrency and result-set rules of InAuthTransaction apply.

func (*Runtime) InvalidatePasswordResets added in v0.7.0 

func (r *Runtime) InvalidatePasswordResets(ctx context.Context, subjectID goauth.SubjectID) error

InvalidatePasswordResets retires outstanding reset records under the canonical subject lock. It joins the supplied managed transaction, so hosts can make an alias mutation and invalidation atomic. Returning an error must abort that transaction. Invalidation is required even when an old address is later restored.

func (*Runtime) NotificationStats 

func (r *Runtime) NotificationStats(ctx context.Context) (NotificationQueueStats, error)

NotificationStats reports delivery states without exposing encrypted payloads or raw sender errors.

func (*Runtime) OIDCProvider 

func (r *Runtime) OIDCProvider(options provider.Options) (*provider.Service, error)

OIDCProvider assembles the optional provider against canonical Account claims and the Runtime's digest-only refresh-token store. The caller owns client/signing-key stores and supplies atomic request/code stores, normally from the Redis adapter.

func (*Runtime) OIDCRefreshTokens 

func (r *Runtime) OIDCRefreshTokens() *OIDCRefreshTokenStore

OIDCRefreshTokens returns the digest-only PostgreSQL adapter used by an optional OIDC provider.

func (*Runtime) PrepareCredential added in v0.5.0 

func (r *Runtime) PrepareCredential(ctx context.Context, credential goauth.Credential) (*CredentialProof, error)

PrepareCredential performs durable rate admission and password verification before the host's outer transaction. The proof expires after five minutes.

func (*Runtime) RBAC 

func (r *Runtime) RBAC(cache rbac.Cache) (*rbac.Service, error)

RBAC assembles the optional hierarchy-free RBAC service on the Runtime's canonical PostgreSQL connection.

func (*Runtime) Resolve 

func (r *Runtime) Resolve(ctx context.Context, subjectID string) (goauth.Account, error)

Resolve implements the OIDC claims resolver using the canonical Account.

func (*Runtime) RevalidateCredential added in v0.5.0 

func (r *Runtime) RevalidateCredential(ctx context.Context, proof *CredentialProof) (goauth.Account, error)

RevalidateCredential requires this runtime's managed transaction and holds the canonical subject lock until the outer commit. Security version, active status and normalized primary email must still match the verified proof before a host can grant membership. Callers must never substitute request-supplied accounts.

func (*Runtime) RunNotifications 

func (r *Runtime) RunNotifications(ctx context.Context) error

RunNotifications delivers queued events until ctx is cancelled. Separate Runtime instances may run this method concurrently against the same database. A stable delivery ID permits host senders to deduplicate at-least-once sends.

func (*Runtime) SQLExecutor added in v0.5.0 

func (r *Runtime) SQLExecutor(ctx context.Context) (SQLExecutor, error)

SQLExecutor returns an executor on the Runtime database, joining the managed transaction in ctx. A context owned by another database is rejected.

type SQLExecutor added in v0.5.0 

type SQLExecutor interface {
	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
}

SQLExecutor provides transaction-aware SQL without transaction ownership.

type SessionOIDCCleanupResult added in v0.6.0 

type SessionOIDCCleanupResult struct {
	Requests        int64
	Codes           int64
	RefreshTokens   int64
	RefreshFamilies int64
}

SessionOIDCCleanupResult reports only confirmed committed row deletions. Each call deletes at most 1000 requests, 1000 codes, 1000 refresh tokens, and 32 empty refresh families. A remaining chain is continued on later calls.

type SessionOIDCState added in v0.6.0 

type SessionOIDCState struct {
	// contains filtered or unexported fields
}

SessionOIDCState is the transaction-bound, digest-only OIDC state adapter. It never authenticates a host session: callers must perform SessionAdmission before taking request/code/family/token locks. Every mutation requires the supplied Runtime's managed database transaction.

func NewSessionOIDCState added in v0.6.0 

func NewSessionOIDCState(runtime *Runtime) (*SessionOIDCState, error)

func (*SessionOIDCState) CleanupExpired added in v0.6.0 

func (s *SessionOIDCState) CleanupExpired(ctx context.Context) (SessionOIDCCleanupResult, error)

CleanupExpired removes expired strict-profile state in its own bounded transaction. It never touches legacy families, generic auth state or audit. Live-family code and refresh tombstones remain until the fixed family end. Ambient managed transactions are rejected; counters require confirmed commit.

func (*SessionOIDCState) ConsumeCode added in v0.6.0 

func (s *SessionOIDCState) ConsumeCode(ctx context.Context, raw, familyID string, now time.Time) (oidc.SessionCode, error)

func (*SessionOIDCState) ConsumeRequest added in v0.6.0 

func (s *SessionOIDCState) ConsumeRequest(ctx context.Context, challenge string) (oidc.SessionRequest, error)

func (*SessionOIDCState) InOwnedAuthTransaction added in v0.6.0 

func (s *SessionOIDCState) InOwnedAuthTransaction(ctx context.Context, fn func(context.Context) error) error

func (*SessionOIDCState) LockCode added in v0.6.0 

func (s *SessionOIDCState) LockCode(ctx context.Context, raw string) (oidc.SessionCode, error)

func (*SessionOIDCState) LockFamily added in v0.6.0 

func (s *SessionOIDCState) LockFamily(ctx context.Context, id string) (oidc.SessionFamily, error)

func (*SessionOIDCState) LockRefresh added in v0.6.0 

func (s *SessionOIDCState) LockRefresh(ctx context.Context, raw string) (oidc.SessionRefresh, error)

func (*SessionOIDCState) MarkLoginComplete added in v0.6.0 

func (s *SessionOIDCState) MarkLoginComplete(
	ctx context.Context, challenge, browserBinding string, completion oidc.RequestLoginCompletion,
) error

func (*SessionOIDCState) ReadCode added in v0.6.0 

func (s *SessionOIDCState) ReadCode(ctx context.Context, raw string) (oidc.SessionCode, error)

func (*SessionOIDCState) ReadRefresh added in v0.6.0 

func (s *SessionOIDCState) ReadRefresh(ctx context.Context, raw string) (oidc.SessionRefresh, error)

func (*SessionOIDCState) ReadRequest added in v0.6.0 

func (s *SessionOIDCState) ReadRequest(ctx context.Context, challenge string) (oidc.SessionRequest, error)

func (*SessionOIDCState) RevokeFamily added in v0.6.0 

func (s *SessionOIDCState) RevokeFamily(
	ctx context.Context, id string, reason oidc.SessionRevocationReason, now time.Time,
) error

func (*SessionOIDCState) RotateRefresh added in v0.6.0 

func (s *SessionOIDCState) RotateRefresh(ctx context.Context, current, next oidc.SessionRefresh, now time.Time) error

func (*SessionOIDCState) SaveCode added in v0.6.0 

func (s *SessionOIDCState) SaveCode(ctx context.Context, r oidc.SessionCode) error

func (*SessionOIDCState) SaveRefresh added in v0.6.0 

func (s *SessionOIDCState) SaveRefresh(ctx context.Context, r oidc.SessionRefresh) error

func (*SessionOIDCState) SaveRequest added in v0.6.0 

func (s *SessionOIDCState) SaveRequest(ctx context.Context, record oidc.SessionRequest) error

type Store 

type Store struct {
	// contains filtered or unexported fields
}

func NewStore 

func NewStore(db *sql.DB) (*Store, error)

func (*Store) AdmitRequiredMFASession added in v0.8.0 

func (s *Store) AdmitRequiredMFASession(ctx context.Context, session goauth.Session) error

func (*Store) AdvanceMFAStep added in v0.8.0 

func (s *Store) AdvanceMFAStep(ctx context.Context, subject goauth.SubjectID, factorID string, revision,
	previous, next int64,
) (bool, error)

func (*Store) CancelMFAEnrollment added in v0.8.0 

func (s *Store) CancelMFAEnrollment(ctx context.Context, subject goauth.SubjectID, session string, binding [32]byte) error

func (*Store) ChangePassword 

func (s *Store) ChangePassword(
	ctx context.Context,
	request goauth.PasswordChangeStoreRequest,
) (goauth.PasswordChangeStoreResult, error)

func (*Store) CompleteAssistedRecovery added in v0.11.0 

func (s *Store) CompleteAssistedRecovery(
	ctx context.Context, record goauth.AssistedRecoveryRecord, passwordPHC string, now time.Time,
) (goauth.Account, error)

func (*Store) ConsumeMFALogin added in v0.8.0 

func (s *Store) ConsumeMFALogin(ctx context.Context, pending goauth.MFALoginPending) (bool, error)

func (*Store) ConsumeMFARecovery added in v0.8.0 

func (s *Store) ConsumeMFARecovery(ctx context.Context, subject goauth.SubjectID, factorID string,
	revision int64, digest []byte,
) (bool, error)

func (*Store) ConsumePasswordReset 

func (s *Store) ConsumePasswordReset(
	ctx context.Context,
	request goauth.PasswordResetConsumeRequest,
) (goauth.PasswordResetConsumeResult, error)

func (*Store) ConsumePasswordResetWithPreparation added in v0.7.0 

func (s *Store) ConsumePasswordResetWithPreparation(
	ctx context.Context, request goauth.PasswordResetConsumeRequest,
	prepare func(context.Context, goauth.Account) (string, error),
) (goauth.PasswordResetConsumeResult, error)

ConsumePasswordResetWithPreparation authenticates and locks the current token before preparing a replacement credential. prepare must not mutate state.

func (*Store) CreateAssistedRecovery added in v0.11.0 

func (s *Store) CreateAssistedRecovery(ctx context.Context, record goauth.AssistedRecoveryRecord) error

func (*Store) CreateLocalAccount 

func (s *Store) CreateLocalAccount(
	ctx context.Context,
	record goauth.LocalAccountRecord,
) (goauth.Account, error)

func (*Store) CreateLocalIdentity added in v0.6.0 

func (s *Store) CreateLocalIdentity(ctx context.Context, record goauth.LocalIdentityRecord) (goauth.Account, error)

func (*Store) CreateMFALogin added in v0.8.0 

func (s *Store) CreateMFALogin(ctx context.Context, pending goauth.MFALoginPending) error

func (*Store) CreatePasswordReset 

func (s *Store) CreatePasswordReset(ctx context.Context, record goauth.PasswordResetRecord) error

func (*Store) CreatePasswordResetForSubject added in v0.7.0 

func (s *Store) CreatePasswordResetForSubject(ctx context.Context, record goauth.PasswordResetRecord) error

CreatePasswordResetForSubject is the explicit host-policy issuance capability. It never creates a credential or falls back to a primary-email lookup.

func (*Store) CreateSSOAccount 

func (s *Store) CreateSSOAccount(
	ctx context.Context,
	record goauth.SSOAccountRecord,
) (goauth.Account, goauth.IdentityLink, error)

func (*Store) CreateSession 

func (s *Store) CreateSession(ctx context.Context, record goauth.SessionRecord) error

func (*Store) DeleteEncrypted 

func (s *Store) DeleteEncrypted(context.Context, string) error

DeleteEncrypted cannot acknowledge a managed delivery without a lease token. Only the worker's token-checked completion path can clear ciphertext.

func (*Store) DeleteExpiredEncrypted 

func (s *Store) DeleteExpiredEncrypted(ctx context.Context, before time.Time) (int64, error)

func (*Store) EnqueueEncrypted 

func (s *Store) EnqueueEncrypted(ctx context.Context, event goauth.EncryptedEvent) error

func (*Store) EnsureMFAFactor added in v0.8.0 

func (s *Store) EnsureMFAFactor(ctx context.Context, subject goauth.SubjectID) (goauth.MFAFactorRecord, error)

func (*Store) FindAccount 

func (s *Store) FindAccount(
	ctx context.Context,
	identifier goauth.IdentifierInput,
) (goauth.Account, error)

func (*Store) FindAssistedRecoverySubject added in v0.11.0 

func (s *Store) FindAssistedRecoverySubject(ctx context.Context, selector string) (goauth.SubjectID, error)

func (*Store) FindLocalAccount 

func (s *Store) FindLocalAccount(
	ctx context.Context,
	identifier goauth.IdentifierInput,
) (goauth.LocalAccountRecord, error)

func (*Store) FindMFALoginSubject added in v0.8.0 

func (s *Store) FindMFALoginSubject(ctx context.Context, id string) (goauth.SubjectID, error)

func (*Store) GetAccount 

func (s *Store) GetAccount(ctx context.Context, subjectID goauth.SubjectID) (goauth.Account, error)

func (*Store) GetLocalAccount 

func (s *Store) GetLocalAccount(
	ctx context.Context,
	subjectID goauth.SubjectID,
) (goauth.LocalAccountRecord, error)

func (*Store) GetLocalIdentifier added in v0.6.0 

func (s *Store) GetLocalIdentifier(
	ctx context.Context, subjectID goauth.SubjectID, scheme goauth.IdentifierScheme,
) (goauth.Identifier, error)

func (*Store) GetPendingEmailChange 

func (s *Store) GetPendingEmailChange(
	ctx context.Context,
	subjectID goauth.SubjectID,
	now time.Time,
) (goauth.PendingEmailChange, error)

func (*Store) GetPendingScopedEmailChange added in v0.8.0 

func (s *Store) GetPendingScopedEmailChange(
	ctx context.Context, subjectID goauth.SubjectID, scope goauth.EmailChangeScope, now time.Time,
) (goauth.PendingEmailChange, error)

func (*Store) GetSubjectLifecycle added in v0.6.0 

func (s *Store) GetSubjectLifecycle(ctx context.Context, id goauth.SubjectID) (goauth.SubjectLifecycleView, error)

func (*Store) InAuthTransaction added in v0.5.0 

func (s *Store) InAuthTransaction(ctx context.Context, fn func(context.Context) error) error

InAuthTransaction atomically commits participating auth, audit and event writes.

func (*Store) InNotificationTransaction 

func (s *Store) InNotificationTransaction(ctx context.Context, fn func(context.Context) error) error

InNotificationTransaction joins the participating managed auth writes, notification enqueue, and security audit on this database handle.

func (*Store) InOwnedAuthTransaction added in v0.8.0 

func (s *Store) InOwnedAuthTransaction(ctx context.Context, fn func(context.Context) error) error

func (*Store) IntrospectSession 

func (s *Store) IntrospectSession(ctx context.Context, sessionID string) (goauth.SessionSecurity, error)

func (*Store) InvalidateMFAState added in v0.8.0 

func (s *Store) InvalidateMFAState(ctx context.Context, subject goauth.SubjectID) error

func (*Store) IssueEmailChallenge 

func (s *Store) IssueEmailChallenge(
	ctx context.Context,
	record goauth.EmailChallengeRecord,
	limits goauth.EmailChallengeLimits,
) (goauth.EmailChallengeIssueResult, error)

func (*Store) IssueEmailChange 

func (s *Store) IssueEmailChange(
	ctx context.Context,
	record goauth.EmailChangeRecord,
	limits goauth.EmailChallengeLimits,
) (goauth.EmailChangeIssueResult, error)

func (*Store) IssueScopedEmailChange added in v0.8.0 

func (s *Store) IssueScopedEmailChange(
	ctx context.Context, record goauth.EmailChangeRecord, limits goauth.EmailChallengeLimits,
) (goauth.EmailChangeIssueResult, error)

func (*Store) LinkIdentity 

func (s *Store) LinkIdentity(ctx context.Context, link goauth.IdentityLink) (goauth.IdentityLink, error)

func (*Store) LocalMFARequired added in v0.8.0 

func (s *Store) LocalMFARequired(ctx context.Context, subject goauth.SubjectID) (bool, error)

func (*Store) LockAccount added in v0.5.0 

func (s *Store) LockAccount(ctx context.Context, id goauth.SubjectID) (goauth.Account, error)

func (*Store) LockAssistedRecovery added in v0.11.0 

func (s *Store) LockAssistedRecovery(ctx context.Context, selector string) (goauth.AssistedRecoveryRecord, error)

func (*Store) LockMFAEnrollment added in v0.8.0 

func (s *Store) LockMFAEnrollment(ctx context.Context, subject goauth.SubjectID) (goauth.MFAEnrollmentRecord, error)

func (*Store) LockMFAFactor added in v0.8.0 

func (s *Store) LockMFAFactor(ctx context.Context, subject goauth.SubjectID) (goauth.MFAFactorRecord, error)

func (*Store) LockMFALogin added in v0.8.0 

func (s *Store) LockMFALogin(ctx context.Context, id string) (goauth.MFALoginPending, error)

func (*Store) MarkMFASessionAdmission added in v0.8.0 

func (s *Store) MarkMFASessionAdmission(ctx context.Context, session goauth.Session, admission goauth.MFASessionAdmission) error

MarkMFASessionAdmission is called only after creating the session in the same transaction. Runtime callers never upgrade an existing session's provenance.

func (*Store) PeekRefresh added in v0.5.0 

func (s *Store) PeekRefresh(ctx context.Context, request goauth.RefreshRotationRequest) (goauth.RefreshRotationResult, error)

func (*Store) RecordSecurityEvent 

func (s *Store) RecordSecurityEvent(ctx context.Context, event goauth.SecurityEvent) error

func (*Store) RenameLocalIdentity added in v0.6.0 

func (s *Store) RenameLocalIdentity(
	ctx context.Context, request goauth.RenameLocalIdentityStoreRequest,
) (goauth.LocalIdentityView, error)

func (*Store) ReplaceMFAFactor added in v0.8.0 

func (s *Store) ReplaceMFAFactor(ctx context.Context, subject goauth.SubjectID, expected,
	next goauth.MFAFactorRecord,
) (bool, error)

func (*Store) ReplaceMFARecovery added in v0.8.0 

func (s *Store) ReplaceMFARecovery(ctx context.Context, subject goauth.SubjectID, digests [][]byte) error
func (s *Store) ResolveIdentityLink(
	ctx context.Context,
	issuer string,
	externalSubject string,
) (goauth.Account, goauth.IdentityLink, error)

func (*Store) RetireLocalIdentity added in v0.6.0 

func (s *Store) RetireLocalIdentity(
	ctx context.Context, request goauth.RetireLocalIdentityStoreRequest,
) (goauth.SubjectLifecycleView, error)

func (*Store) RevokeSession 

func (s *Store) RevokeSession(
	ctx context.Context,
	subjectID goauth.SubjectID,
	sessionID string,
	now time.Time,
) (bool, error)

func (*Store) RevokeSubjectSessions 

func (s *Store) RevokeSubjectSessions(
	ctx context.Context,
	subjectID goauth.SubjectID,
	now time.Time,
) (int64, error)

func (*Store) RotateRefresh 

func (s *Store) RotateRefresh(ctx context.Context, request goauth.RefreshRotationRequest) (goauth.RefreshRotationResult, error)

func (*Store) SaveMFAEnrollment added in v0.8.0 

func (s *Store) SaveMFAEnrollment(ctx context.Context, e goauth.MFAEnrollmentRecord) error

func (*Store) SaveMFALoginSetup added in v0.8.0 

func (s *Store) SaveMFALoginSetup(ctx context.Context, p goauth.MFALoginPending, setup goauth.MFALoginSetup) error

func (*Store) SetSubjectStatus 

func (s *Store) SetSubjectStatus(
	ctx context.Context,
	subjectID goauth.SubjectID,
	status goauth.SubjectStatus,
	now time.Time,
) (goauth.Subject, error)

func (*Store) SetTrustedLocalPassword added in v0.6.0 

func (s *Store) SetTrustedLocalPassword(
	ctx context.Context, request goauth.TrustedLocalPasswordStoreRequest,
) (goauth.Account, error)

func (*Store) TakeMFAAttempt added in v0.8.0 

func (s *Store) TakeMFAAttempt(ctx context.Context, subject goauth.SubjectID) (bool, error)

func (*Store) TakeRateLimit 

func (s *Store) TakeRateLimit(
	ctx context.Context,
	request goauth.RateLimitRequest,
) (goauth.RateLimitResult, error)

TakeRateLimit commits admission independently of subsequent auth writes. Joining an outer transaction would lose attempts on rollback; opening another connection while it holds locks can deadlock. Reject that composition instead.

func (*Store) UpdateBasicProfile 

func (s *Store) UpdateBasicProfile(
	ctx context.Context,
	subjectID goauth.SubjectID,
	profile goauth.BasicProfile,
	now time.Time,
) (goauth.Account, error)

func (*Store) VerifyEmailChallenge 

func (s *Store) VerifyEmailChallenge(
	ctx context.Context,
	request goauth.EmailChallengeVerifyRequest,
) (goauth.EmailChallengeVerifyResult, error)

func (*Store) VerifyEmailChange 

func (s *Store) VerifyEmailChange(
	ctx context.Context,
	request goauth.EmailChangeVerifyRequest,
) (goauth.EmailChangeVerifyResult, error)

func (*Store) VerifyScopedEmailChange added in v0.8.0 

func (s *Store) VerifyScopedEmailChange(
	ctx context.Context, request goauth.EmailChangeVerifyRequest,
) (goauth.EmailChangeVerifyResult, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.