session

package
v0.24.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 11, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrUnauthenticated                 = errors.New("unauthenticated")
	ErrSessionExpired                  = errors.New("session expired")
	ErrSessionRevoked                  = errors.New("session revoked")
	ErrInvalidSession                  = errors.New("invalid session")
	ErrInvalidRefreshToken             = errors.New("invalid refresh token")
	ErrRefreshTokenReuse               = errors.New("refresh token reuse")
	ErrForbidden                       = errors.New("forbidden")
	ErrUserDisabled                    = errors.New("user is disabled")
	ErrUserNotAllowed                  = errors.New("user is not allowed")
	ErrRecentAuthenticationRequired    = errors.New("recent authentication required")
	ErrAuthenticationChallengeInvalid  = errors.New("authentication challenge is invalid")
	ErrAuthenticationMethodUnavailable = errors.New("authentication method is unavailable")
)
View Source 
var ErrInvalidListPage = errors.New("invalid session list page")

Functions

func ClearEmailVerificationTransaction added in v0.22.0 

func ClearEmailVerificationTransaction(w http.ResponseWriter)

func ClearSessionCookies 

func ClearSessionCookies(w http.ResponseWriter)

func Configure 

func Configure(secure bool)

func ReadAccessToken 

func ReadAccessToken(r *http.Request) (string, bool)

func ReadEmailVerificationTransaction added in v0.22.0 

func ReadEmailVerificationTransaction(r *http.Request) (uuid.UUID, bool)

func ReadRefreshToken 

func ReadRefreshToken(r *http.Request) (string, bool)

func SetAccessToken 

func SetAccessToken(w http.ResponseWriter, token string, maxAgeSeconds int)

func SetEmailVerificationTransaction added in v0.22.0 

func SetEmailVerificationTransaction(w http.ResponseWriter, id uuid.UUID, expiresAt time.Time, now time.Time)

func SetRefreshToken 

func SetRefreshToken(w http.ResponseWriter, token string, maxAgeSeconds int)

Types

type AccessIdentity 

type AccessIdentity struct {
	UserID           uuid.UUID
	SessionID        uuid.UUID
	OrganizationID   uuid.UUID
	OrganizationRole domain.OrganizationRole
	Roles            roles.Roles
	EmailVerified    bool
}

type ListOptions added in v0.22.0 

type ListOptions = keyset.Options

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func New 

func New(cfg SessionConfig) *Service

func (*Service) CompleteAuthenticationChallenge added in v0.22.0 

func (s *Service) CompleteAuthenticationChallenge(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	challengeID uuid.UUID,
	method domain.AuthenticationMethod,
	now time.Time,
) error

func (*Service) CreatePasskeySession added in v0.22.0 

func (s *Service) CreatePasskeySession(
	ctx context.Context,
	userID uuid.UUID,
	passkeyID uuid.UUID,
	audience token.Audience,
	userAgent string,
	now time.Time,
	clientIP string,
) (accessToken string, refreshToken string, err error)

func (*Service) CreateSession 

func (s *Service) CreateSession(
	ctx context.Context,
	userID uuid.UUID,
	audience token.Audience,
	authenticationMethod domain.AuthenticationMethod,
	userAgent string,
	now time.Time,
	clientIP string,
) (
	accessToken string,
	refreshToken string,
	err error,
)

func (*Service) ListUserSessions added in v0.1.16 

func (s *Service) ListUserSessions(
	ctx context.Context,
	userID uuid.UUID,
	currentSessionID uuid.UUID,
	now time.Time,
) ([]domain.Session, error)

func (*Service) ListUserSessionsPage added in v0.22.0 

func (s *Service) ListUserSessionsPage(ctx context.Context, userID uuid.UUID, now time.Time, options ListOptions) (SessionPage, error)

func (*Service) Logout 

func (s *Service) Logout(ctx context.Context, refreshToken, accessToken string) error

func (*Service) MarkRecentlyAuthenticated added in v0.22.0 

func (s *Service) MarkRecentlyAuthenticated(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	method domain.AuthenticationMethod,
	now time.Time,
) error

func (*Service) RecordReauthenticationDenied added in v0.22.0 

func (s *Service) RecordReauthenticationDenied(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	method domain.AuthenticationMethod,
	reasonCode string,
) error

RecordReauthenticationDenied persists a rejected credential proof after the challenge transaction has ended. Keeping this separate from CompleteAuthenticationChallenge ensures denial evidence is not rolled back.

func (*Service) RefreshSession 

func (s *Service) RefreshSession(ctx context.Context, refreshToken string, audience token.Audience, now time.Time) (newAccessToken string, newRefreshToken string, err error)

func (*Service) RequireRecentAuthentication added in v0.22.0 

func (s *Service) RequireRecentAuthentication(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	now time.Time,
) error

func (*Service) RevokeAccessToken added in v0.13.0 

func (s *Service) RevokeAccessToken(ctx context.Context, accessToken string, now time.Time) error

func (*Service) RevokeAllSessions 

func (s *Service) RevokeAllSessions(ctx context.Context, userID uuid.UUID) error

func (*Service) RevokeOtherUserSessions added in v0.1.16 

func (s *Service) RevokeOtherUserSessions(
	ctx context.Context,
	userID uuid.UUID,
	currentSessionID uuid.UUID,
	now time.Time,
) error

func (*Service) RevokeUserSession added in v0.1.16 

func (s *Service) RevokeUserSession(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	now time.Time,
) error

func (*Service) StartAuthenticationChallenge added in v0.22.0 

func (s *Service) StartAuthenticationChallenge(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	now time.Time,
) (domain.AuthenticationChallenge, error)

func (*Service) SwitchSessionOrganization added in v0.1.24 

func (s *Service) SwitchSessionOrganization(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	organizationID uuid.UUID,
	audience token.Audience,
	now time.Time,
) (
	accessToken string,
	refreshToken string,
	err error,
)

func (*Service) ValidateAccessToken 

func (s *Service) ValidateAccessToken(
	ctx context.Context,
	accessToken string,
	expectedAudience token.Audience,
	now time.Time,
) (*AccessIdentity, error)

func (*Service) ValidateAnyAccessToken added in v0.1.13 

func (s *Service) ValidateAnyAccessToken(
	ctx context.Context,
	accessToken string,
	now time.Time,
) (*AccessIdentity, error)

func (*Service) ValidateAuthenticationChallenge added in v0.22.0 

func (s *Service) ValidateAuthenticationChallenge(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	challengeID uuid.UUID,
	now time.Time,
) error

func (*Service) ValidateCompletedAuthenticationChallenge added in v0.22.0 

func (s *Service) ValidateCompletedAuthenticationChallenge(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	challengeID uuid.UUID,
) error

type SessionConfig 

type SessionConfig struct {
	Store                      *store.Store
	Tx                         *tx.Manager
	AccessTokens               *token.AccessTokenService
	AccessTokenRevocations     *token.AccessTokenRevocations
	SessionTTL                 time.Duration
	RefreshTokenTTL            time.Duration
	RefreshTokenRotation       time.Duration
	RecentAuthenticationWindow time.Duration
	Policy                     config.SessionPolicyReader
	AccessPolicy               accesspolicy.EmailAccessPolicy
	Organizations              *organization.Service
	SecurityEvents             securityevent.Recorder
}

type SessionPage added in v0.22.0 

type SessionPage = keyset.Page[domain.Session]

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.