Documentation
¶
Overview ¶
Package auth authenticates AgentSQL API keys without exposing account state.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ( // ErrInvalidCredentials hides whether an API key or Agent record exists. ErrInvalidCredentials = errors.New("invalid credentials") // ErrAgentDisabled indicates that a valid key belongs to a non-active Agent. ErrAgentDisabled = errors.New("agent is disabled") // ErrKeyExpired indicates that a valid API key has reached its expiry time. ErrKeyExpired = errors.New("API key is expired") )
Functions ¶
This section is empty.
Types ¶
type AgentKeyReader ¶
type AgentKeyReader interface {
GetByAPIKeyHash(ctx context.Context, hash string) (model.Agent, error)
}
AgentKeyReader is the minimum read dependency required for authentication.
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator validates extracted raw API keys against Agent records.
func NewAuthenticator ¶
func NewAuthenticator(reader AgentKeyReader) *Authenticator
NewAuthenticator constructs an Authenticator using the system clock.
func NewAuthenticatorWithClock ¶
func NewAuthenticatorWithClock(reader AgentKeyReader, clock Clock) *Authenticator
NewAuthenticatorWithClock constructs an Authenticator with an injected clock.
func (*Authenticator) Authenticate ¶
func (authenticator *Authenticator) Authenticate( ctx context.Context, rawKey string, ) (model.Agent, error)
Authenticate returns an active, unexpired Agent only after constant-time hash verification. Repository failures are intentionally hidden as invalid credentials.
Source Files
Click to show internal directories.
Click to hide internal directories.