internal/

Package background runs work after an endpoint has responded.

Package emailtoken creates and checks the single-use tokens sent in emails: verification, password reset, and email change.

Package httpapi holds the request and response plumbing shared by the module's HTTP endpoints, following the API design standard: the standard error format, strict JSON decoding, request IDs, and finding the real client behind a trusted proxy.

Package migrate applies the module's embedded migrations.

Package migrations holds the module's SQL migrations, embedded into the binary.

Package oauth runs the provider side of signing in with Google and GitHub: building the authorization URL with PKCE and state, and swapping the returned code for the user's identity.

Package password hashes and verifies passwords with argon2id, and checks new passwords against the length policy in the auth standard.

Package pwned checks passwords against Have I Been Pwned's list of passwords seen in data breaches, using its range API (https://haveibeenpwned.com/API/v3#PwnedPasswords).

Package ratelimit counts requests in fixed time windows, stored in Postgres so every API instance shares the counts.

Package recoverycode makes and checks 2FA recovery codes: single-use codes a user keeps for when they lose their authenticator.

Package secretbox encrypts small secrets for storage, such as TOTP secrets, with AES-256-GCM.

Package sender sends email in the background, so endpoints respond without waiting for the email provider.

Package session creates, validates, extends, and revokes login sessions.

Package testdb gives tests a fresh, empty Postgres database.

Package token generates and hashes the random secrets used for sessions, email verification, and password resets.

Package totp implements time-based one-time passwords (RFC 6238), the six-digit codes from authenticator apps.