auth

package
v0.22.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 8, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultPasswordMinimumLength = 8
	MaximumPasswordLength        = 128
)

Variables

View Source 
var (
	ErrInvalidCredentials              = errors.New("invalid credentials")
	ErrUserAlreadyExists               = errors.New("user already exists")
	ErrUnsupportedProvider             = errors.New("auth provider is not supported")
	ErrAccountExistsMustLink           = errors.New("account exists; must link provider explicitly")
	ErrUsernameTaken                   = errors.New("username already taken")
	ErrInvalidUsername                 = errors.New("invalid username")
	ErrNoRolesInContext                = errors.New("no roles in context for user")
	ErrEmailNotAllowed                 = errors.New("email is not allowed to access the application")
	ErrAuthProviderAlreadyLinked       = errors.New("auth provider already linked to another user")
	ErrAuthProviderAlreadyLinkedToUser = errors.New("auth provider already linked to user")
	ErrCannotRemoveLastAuthMethod      = errors.New("cannot remove last auth method")
	ErrCannotRemoveLastAuthProvider    = ErrCannotRemoveLastAuthMethod
	ErrCannotDeleteLastAdmin           = errors.New("cannot delete last active admin")
	ErrPasswordAlreadyExists           = errors.New("password provider already exists")
	ErrPendingProviderLinkExpired      = errors.New("pending provider link expired")
	ErrPendingProviderLinkInvalid      = errors.New("pending provider link invalid")
	ErrPendingProviderLinkNeedsProof   = errors.New("pending provider link requires proof")
	ErrProviderEmailNotVerified        = errors.New("provider email is not verified")
	ErrProviderDisabled                = errors.New("provider disabled")
	ErrPasswordProviderMissing         = errors.New("password provider missing")
	ErrPasskeyNotFound                 = errors.New("passkey not found")
	ErrPasskeyAlreadyExists            = errors.New("passkey already exists")
	ErrPasskeyRegistrationInvalid      = errors.New("passkey registration invalid")
	ErrPasskeyAuthenticationInvalid    = errors.New("passkey authentication invalid")
)
View Source 
var (
	ErrPasswordTooShort        = errors.New("password is too short")
	ErrPasswordTooLong         = errors.New("password is too long")
	ErrPasswordInvalidEncoding = errors.New("password is not valid UTF-8")
)

Functions

func EnsureUsername added in v0.1.13 

func EnsureUsername(username, email string) (string, error)

func Hash 

func Hash(password string) (string, error)

func PasswordPolicyMessage added in v0.22.0 

func PasswordPolicyMessage(err error, minimum int) (string, bool)

func SanitizeUsername 

func SanitizeUsername(s string) string

sanitizeUsername: - keeps only [a-zA-z0-9_-] - turns runs of other chars into a single '-' - trims leading/trailing '-' and '_'

func SecureFiveDigits 

func SecureFiveDigits() (int64, error)

func ValidateUsername 

func ValidateUsername(username string) error

func Verify 

func Verify(password, encoded string) (bool, error)

Types

type AppleCredentialLifecycle added in v0.22.0 

type AppleCredentialLifecycle interface {
	Save(context.Context, uuid.UUID, string) error
	PromoteProviderLink(context.Context, uuid.UUID, uuid.UUID) error
}

type Config 

type Config struct {
	Store                  *store.Store
	Tx                     *tx.Manager
	WebhookPublisher       webhook.Publisher
	Logger                 *slog.Logger
	AccessPolicy           accesspolicy.EmailAccessPolicy
	OAuthProviders         oauth.OAuthProviders
	Organizations          *organization.Service
	AccessTokenRevocations *token.AccessTokenRevocations
	PasswordMinimumLength  int
	SecurityEvents         securityevent.Recorder
	AppleCredentials       AppleCredentialLifecycle
}

type LoginInput 

type LoginInput struct {
	Provider domain.Provider

	Identifier string // Email address or username for password login.
	Username   string
	Email      string
	Password   string

	OAuthID               string
	ProviderEmailVerified bool
	InvitationToken       string
}

type OAuthIdentityInput added in v0.1.19 

type OAuthIdentityInput struct {
	Provider domain.Provider

	Username              string
	Email                 string
	ProviderUserID        string
	ProviderEmailVerified bool
}

type PasswordHashVerification added in v0.22.0 

type PasswordHashVerification struct {
	Valid       bool
	NeedsRehash bool
}

func VerifyPasswordHash added in v0.22.0 

func VerifyPasswordHash(password, encoded string) (PasswordHashVerification, error)

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func New 

func New(cfg Config) *Service

func (*Service) AddPassword added in v0.1.17 

func (s *Service) AddPassword(ctx context.Context, userID uuid.UUID, passwordHash string) error

func (*Service) ChangePassword added in v0.1.17 

func (s *Service) ChangePassword(ctx context.Context, userID uuid.UUID, sessionID uuid.UUID, currentPassword string, newPasswordHash string) error

func (*Service) ChangeUsername 

func (s *Service) ChangeUsername(ctx context.Context, userID uuid.UUID, username string) error

func (*Service) CompleteAccountRecoveryProviderLinkWithPassword added in v0.1.19 

func (s *Service) CompleteAccountRecoveryProviderLinkWithPassword(
	ctx context.Context,
	linkID uuid.UUID,
	password string,
	now time.Time,
) (domain.User, error)

func (*Service) CompleteAccountRecoveryProviderLinkWithProviderProof added in v0.1.19 

func (s *Service) CompleteAccountRecoveryProviderLinkWithProviderProof(
	ctx context.Context,
	linkID uuid.UUID,
	proofProvider domain.Provider,
	proofProviderUserID string,
	now time.Time,
) (domain.User, error)
func (s *Service) CompleteAppleProviderLink(
	ctx context.Context,
	linkID uuid.UUID,
	userID uuid.UUID,
	sessionID uuid.UUID,
	providerUserID string,
	providerEmail string,
	providerEmailVerified bool,
	refreshToken string,
	now time.Time,
) error
func (s *Service) CompleteProviderLink(
	ctx context.Context,
	linkID uuid.UUID,
	userID uuid.UUID,
	sessionID uuid.UUID,
	provider domain.Provider,
	providerUserID string,
	providerEmail string,
	providerEmailVerified bool,
	now time.Time,
) error

func (*Service) DeleteUser 

func (s *Service) DeleteUser(ctx context.Context, userID uuid.UUID) error

func (*Service) DisableUser 

func (s *Service) DisableUser(ctx context.Context, userID uuid.UUID) error
func (s *Service) GetPendingProviderLink(ctx context.Context, linkID uuid.UUID) (domain.PendingProviderLink, error)

func (*Service) GetUser 

func (s *Service) GetUser(ctx context.Context, userID uuid.UUID) (domain.User, error)

func (*Service) GetUserByEmail added in v0.1.14 

func (s *Service) GetUserByEmail(ctx context.Context, email string) (domain.User, error)

func (*Service) HashPassword added in v0.22.0 

func (s *Service) HashPassword(ctx context.Context, password string) (string, error)

func (*Service) IsProviderEnabled added in v0.1.17 

func (s *Service) IsProviderEnabled(provider domain.Provider) bool

func (*Service) ListUserAuthProviders added in v0.1.17 

func (s *Service) ListUserAuthProviders(ctx context.Context, userID uuid.UUID) ([]domain.AuthProvider, error)

func (*Service) Login 

func (s *Service) Login(ctx context.Context, in LoginInput) (domain.User, error)

func (*Service) LoginWithApple added in v0.22.0 

func (s *Service) LoginWithApple(ctx context.Context, in LoginInput, refreshToken string) (domain.User, error)

LoginWithApple commits the provider/account mutation and encrypted refresh token together. A caller can therefore safely queue the newly issued token for revocation whenever this method returns an error.

func (*Service) PasswordMinimumLength added in v0.22.0 

func (s *Service) PasswordMinimumLength() int

func (*Service) RecordLoginDenied added in v0.22.0 

func (s *Service) RecordLoginDenied(ctx context.Context, method domain.AuthenticationMethod, reason string) error

RecordLoginDenied records a credential assertion rejected before a user or session can safely be resolved. Callers must not attach submitted identity values to the event.

func (*Service) SaveAppleCredential added in v0.22.0 

func (s *Service) SaveAppleCredential(ctx context.Context, userID uuid.UUID, refreshToken string) error

func (*Service) SetPassword added in v0.12.0 

func (s *Service) SetPassword(ctx context.Context, userID uuid.UUID, passwordHash string, now time.Time) error

func (*Service) Signup 

func (s *Service) Signup(ctx context.Context, in SignupInput) (domain.User, error)
func (s *Service) StartAccountRecoveryProviderLink(
	ctx context.Context,
	in OAuthIdentityInput,
	now time.Time,
) (domain.PendingProviderLink, error)
func (s *Service) StartProviderLink(
	ctx context.Context,
	userID uuid.UUID,
	sessionID uuid.UUID,
	provider domain.Provider,
	now time.Time,
) (uuid.UUID, error)

func (*Service) UnlinkAuthProvider added in v0.1.17 

func (s *Service) UnlinkAuthProvider(ctx context.Context, userID uuid.UUID, provider domain.Provider) error

func (*Service) UserExistsByEmail added in v0.1.12 

func (s *Service) UserExistsByEmail(ctx context.Context, email string) (bool, error)

func (*Service) ValidatePassword added in v0.22.0 

func (s *Service) ValidatePassword(_ context.Context, password string) error

func (*Service) VerifyExternalIdentity added in v0.22.0 

func (s *Service) VerifyExternalIdentity(
	ctx context.Context,
	userID uuid.UUID,
	provider domain.Provider,
	providerUserID string,
) error

func (*Service) VerifyPassword added in v0.22.0 

func (s *Service) VerifyPassword(ctx context.Context, userID uuid.UUID, password string) error

type SignupInput 

type SignupInput struct {
	Provider domain.Provider

	Username        string
	Email           string
	PasswordHash    string
	InvitationToken string
	InvitationID    uuid.UUID
	EmailVerifiedAt *time.Time

	OAuthID string
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.