Documentation
¶
Overview ¶
Package auth implements PKCE + localhost-callback login for the CLI and bearer middleware for all other RPCs.
Index ¶
- Constants
- Variables
- func DeviceFromContext(ctx context.Context) (string, bool)
- func HashBearer(bearer string) string
- func Interceptor(svc *Service) connect.UnaryInterceptorFunc
- func IsOwner(ctx context.Context) bool
- type AppToken
- type AppTokenRecord
- type ApproveResult
- type BeginResult
- type ExchangeResult
- type LoginRequest
- type Service
- func (s *Service) AppTokenFromBearer(ctx context.Context, bearer string) (AppToken, error)
- func (s *Service) Approve(ctx context.Context, requestID string) (ApproveResult, error)
- func (s *Service) Begin(ctx context.Context, ...) (BeginResult, error)
- func (s *Service) CreateAppToken(ctx context.Context, name string) (AppTokenRecord, string, error)
- func (s *Service) DeviceFromBearer(ctx context.Context, bearer string) (string, error)
- func (s *Service) Exchange(ctx context.Context, code, verifier, redirectURI string) (ExchangeResult, error)
- func (s *Service) GetRequest(ctx context.Context, requestID string) (LoginRequest, error)
- func (s *Service) IsAdminToken(tok string) bool
- func (s *Service) ListAppTokens(ctx context.Context) ([]AppTokenRecord, error)
- func (s *Service) RevokeAppToken(ctx context.Context, id string) error
Constants ¶
const ( StatePending = "PENDING" StateApproved = "APPROVED" StateExpired = "EXPIRED" StateUsed = "USED" )
State constants written to auth_codes.state.
Variables ¶
var AppTokenRPCs = map[string]struct{}{
"/prosa.v1.AnalyticsService/GetReport": {},
}
AppTokenRPCs are the read-only procedures available to app tokens.
var ErrUnknownToken = errors.New("unknown or revoked token")
ErrUnknownToken is returned when a bearer doesn't map to a live row.
var PublicRPCs = map[string]struct{}{
"/prosa.v1.HealthService/Check": {},
"/prosa.v1.AuthService/BeginLogin": {},
"/prosa.v1.AuthService/ExchangeCode": {},
}
PublicRPCs are the procedure paths that skip bearer enforcement. Anything not in this set must present a valid Authorization header.
Functions ¶
func DeviceFromContext ¶
DeviceFromContext returns the device id stamped by Interceptor. The caller MUST treat a missing value as an unauthenticated condition.
func HashBearer ¶
HashBearer returns the canonical sha256 hash we store.
func Interceptor ¶
func Interceptor(svc *Service) connect.UnaryInterceptorFunc
Interceptor is a Connect unary interceptor that pulls the bearer from the request, resolves it to a device_id, and stamps the context. Public RPCs pass through untouched. Admin callers (panel) present `Authorization: Admin <PROSA_ADMIN_TOKEN>` and get an owner-flagged context with no device id.
Types ¶
type AppTokenRecord ¶
type AppTokenRecord struct {
ID string
Name string
CreatedAt time.Time
LastUsedAt *time.Time
RevokedAt *time.Time
}
AppTokenRecord is the database projection used by the owner management RPCs.
type ApproveResult ¶
ApproveResult is returned after the panel approves a login attempt.
type BeginResult ¶
BeginResult is the projection of BeginLoginResponse.
type ExchangeResult ¶
ExchangeResult is the projection of ExchangeCodeResponse.
type LoginRequest ¶
LoginRequest is the projection of GetLoginRequestResponse.
type Service ¶
type Service struct {
Pool *pgxpool.Pool
AdminToken string
PanelBaseURL string
ExpiresIn time.Duration
}
Service is the login state machine and bearer lookup.
func (*Service) AppTokenFromBearer ¶
AppTokenFromBearer resolves a live app token from an Authorization secret.
func (*Service) Begin ¶
func (s *Service) Begin(ctx context.Context, hostname, fingerprint, challenge, redirectURI, clientState string) (BeginResult, error)
Begin inserts a fresh PENDING auth_codes row.
func (*Service) CreateAppToken ¶
CreateAppToken inserts a new app token and returns its plaintext secret once.
func (*Service) DeviceFromBearer ¶
DeviceFromBearer looks up the device_id bound to a bearer presented in an Authorization header. Returns ErrUnknownToken when no row matches OR when the row was revoked.
func (*Service) Exchange ¶
func (s *Service) Exchange(ctx context.Context, code, verifier, redirectURI string) (ExchangeResult, error)
Exchange verifies PKCE and issues the device bearer.
func (*Service) GetRequest ¶
GetRequest returns metadata for the panel confirmation page.
func (*Service) IsAdminToken ¶
IsAdminToken is a constant-time comparison helper used by the interceptor; exposed so handlers that want to gate explicit admin paths (e.g. ApproveLogin) can reuse the same check.
func (*Service) ListAppTokens ¶
func (s *Service) ListAppTokens(ctx context.Context) ([]AppTokenRecord, error)
ListAppTokens returns app tokens newest first, including revoked rows.
Source Files