Documentation
¶
Overview ¶
Package auth holds the serve authentication primitives: startup token or configured password verification, stateless signed session cookies, and login throttling. There is no session table and no background janitor; everything is verified cryptographically or pruned lazily on access.
Index ¶
- Constants
- func ClientIP(r *http.Request, behindProxy bool) string
- func GenerateToken() (string, error)
- func SecureCookie(c *http.Cookie)
- type Auth
- func (a *Auth) CheckLogin(ip string) (retryAfter int, ok bool)
- func (a *Auth) HasPassword() bool
- func (a *Auth) Kind() string
- func (a *Auth) MintCookie() *http.Cookie
- func (a *Auth) MintSessionCookie(app bool) *http.Cookie
- func (a *Auth) RecordResult(ip string, success bool) (retryAfter int)
- func (a *Auth) SessionState(r *http.Request) (ok, app, reissue bool)
- func (a *Auth) SetPassword(password string) error
- func (a *Auth) Token() string
- func (a *Auth) ValidSession(r *http.Request) (ok, reissue bool)
- func (a *Auth) VerifyPassword(candidate string) bool
- func (a *Auth) VerifyToken(candidate string) bool
Constants ¶
const CookieName = "sift_session"
CookieName is the session cookie.
const SessionLifetime = 12 * time.Hour
SessionLifetime is the cookie lifetime. Sessions are re-issued when less than half remains, so active users are never interrupted.
Variables ¶
This section is empty.
Functions ¶
func ClientIP ¶
ClientIP extracts the client IP: RemoteAddr always, X-Forwarded-For only behind a trusted proxy.
func GenerateToken ¶
GenerateToken creates a 256-bit base64url startup token.
func SecureCookie ¶
SecureCookie marks the session cookie Secure for TLS/proxied responses.
Types ¶
type Auth ¶
type Auth struct {
// contains filtered or unexported fields
}
Auth verifies credentials and mints session cookies. The zero value is unusable; build one with NewToken or NewPassword.
func NewPassword ¶
NewPassword builds password auth (remote mode).
func (*Auth) CheckLogin ¶
CheckLogin enforces throttling before a credential check. It returns nil when the attempt may proceed, or the seconds to wait with ok=false.
func (*Auth) HasPassword ¶
HasPassword reports whether password login is enabled.
func (*Auth) Kind ¶
Kind reports "token" or "password" for banners and /api/meta. Local mode (which always has a token) reports token even when a password is also set.
func (*Auth) MintCookie ¶
MintCookie issues a stateless signed session cookie. Restarting the server invalidates all sessions because the key is per-process.
func (*Auth) MintSessionCookie ¶
MintSessionCookie issues a session cookie, marking it as an app-mode session when app is true.
func (*Auth) RecordResult ¶
RecordResult updates throttling after an attempt and returns the backoff for a failure (0 when the failure is not yet throttled).
func (*Auth) SessionState ¶
SessionState reports whether r carries a live session cookie, whether that session was created by an app-mode launch, and whether the cookie should be re-issued. The app flag is authenticated: it is part of the signed body.
func (*Auth) SetPassword ¶
SetPassword adds a secondary password credential (local mode with an explicitly configured password). Either credential unlocks a session.
func (*Auth) ValidSession ¶
ValidSession reports whether r carries a live session cookie, and whether the cookie should be re-issued (less than half the lifetime remains).
func (*Auth) VerifyPassword ¶
VerifyPassword checks a password-mode credential in constant time. The password itself is never persisted; only this process's keyed MAC exists.
func (*Auth) VerifyToken ¶
VerifyToken checks a token-mode credential in constant time.
Source Files