Documentation
¶
Index ¶
- Variables
- func CanClone(caps string) bool
- func CanPull(caps string) bool
- func CanPush(caps string) bool
- func CanPushUV(caps string) bool
- func CanRead(caps string) bool
- func CanSyncPrivate(caps string) bool
- func CreateUser(d *db.DB, projectCode, login, password, caps string) error
- func DeleteUser(d *db.DB, login string) error
- func HasCapability(caps string, required byte) bool
- func InviteExpiryKey(login string) string
- func IsAdmin(caps string) bool
- func SetInviteExpiry(d *db.DB, login string, expiry time.Time) error
- func SetPassword(d *db.DB, projectCode, login, password string) error
- func UpdateCaps(d *db.DB, login, caps string) error
- type InviteToken
- type User
Constants ¶
This section is empty.
Variables ¶
var ErrAuthFailed = errors.New("authentication failed")
Functions ¶
func CanRead ¶ added in v0.11.0
CanRead reports fossil's Read permission, which i (Write) and Admin imply. It differs from CanPull, which accepts only o.
func CanSyncPrivate ¶
func CreateUser ¶
CreateUser inserts a new user into the user table. User times are seconds since 1970, as fossil's now() writes them (src/user.c). Panics if d is nil or login is empty.
func DeleteUser ¶
DeleteUser deletes a user by login. Returns an error if the user is not found (0 rows affected). Panics if d is nil.
func HasCapability ¶
func InviteExpiryKey ¶ added in v0.13.0
InviteExpiryKey is the config row that holds login's invite expiry. It is go-libfossil's own: fossil never writes it, unlike user.cexpire, which is fossil's web-login cookie expiry (#441).
func IsAdmin ¶ added in v0.11.0
IsAdmin reports fossil's Admin permission: a, or s (Setup), which implies it (login.c login_set_capabilities).
func SetInviteExpiry ¶ added in v0.13.0
SetInviteExpiry records the instant after which login's invite no longer admits a sync login, in UTC.
func SetPassword ¶
SetPassword updates the password for a user and stamps the row's mtime, as `fossil user password` does. Returns an error if the user is not found (0 rows affected). Panics if d is nil.
Types ¶
type InviteToken ¶
type InviteToken struct {
URL string `json:"url"`
Login string `json:"login"`
Password string `json:"password"`
Caps string `json:"caps"`
}
func DecodeInviteToken ¶
func DecodeInviteToken(s string) (InviteToken, error)
func (InviteToken) Encode ¶
func (t InviteToken) Encode() string
type User ¶
func GetUser ¶
GetUser retrieves a user by login. Returns an error if the user is not found. Panics if d is nil.
func VerifyLogin ¶
VerifyLogin validates a login card against the user table, as fossil's check_tail_hash and check_login do (src/xfer.c, draft §6.4).
The card must have been decoded from the request it arrived in: its nonce must be the SHA-1 of the body that followed it (xfer.LoginCard NonceCoversTail). The signature covers only the nonce, so without that check a card captured from one request authenticates any other.
nobody and anonymous succeed without a password and carry no capabilities of their own. Any other user needs a non-empty stored password: an empty one would make the signature SHA1(nonce), which anyone can compute.
Returns the authenticated User on success, or ErrAuthFailed on any failure. Panics if d or card is nil (TigerStyle preconditions).
Source Files