connect

package
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 22, 2026 License: AGPL-3.0 Imports: 9 Imported by: 0

Documentation

Overview

Package connect provides the Connect-Go RPC handler layer for the identity service. It implements the identityconnect.IdentityServiceHandler interface generated by buf/protoc-gen-connect-go.

The handler is a thin adapter — it extracts request metadata (IP, user agent, authenticated user ID), calls the appropriate service method, and converts service-layer domain types to proto response messages.

Since buf generate has not run yet, the generated proto types (identitypb.*, identityconnect.*) do not exist. This code is written against the EXPECTED interface. The compiler will catch any mismatches when protos are generated.

Expected generated import paths: 

identitypb      "github.com/elloloop/identity/gen/go/identity"
identityconnect "github.com/elloloop/identity/gen/go/identity/identityconnect"

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type IdentityHandler 

type IdentityHandler struct {
	// contains filtered or unexported fields
}

IdentityHandler implements identityconnect.IdentityServiceHandler. Each method delegates to the appropriate service, translating between proto and service-layer types.

func NewIdentityHandler 

func NewIdentityHandler(
	auth *service.AuthService,
	admin *service.AdminService,
	groups *service.GroupService,
	help *service.HelpService,
	profile *service.ProfileService,
	idv *service.IdentityVerificationService,
	orgSignup *service.OrganizationSignupService,
	cfg *config.Config,
) *IdentityHandler

NewIdentityHandler creates a new IdentityHandler wired to the service layer. idv is optional: pass nil in deployments that do not need identity verification, and the IDV RPCs will return CodeUnimplemented. orgSignup is optional: nil (or a deployment not in mode=multi) causes the OrganizationSignup RPC to return CodeUnimplemented.

func (*IdentityHandler) AcceptInvitation 

func (h *IdentityHandler) AcceptInvitation(
	ctx context.Context,
	req *connect.Request[identitypb.AcceptInvitationRequest],
) (*connect.Response[identitypb.AcceptInvitationResponse], error)

AcceptInvitation completes account setup for an invited user.

func (*IdentityHandler) AddGroupMember 

func (h *IdentityHandler) AddGroupMember(
	ctx context.Context,
	req *connect.Request[identitypb.AddGroupMemberRequest],
) (*connect.Response[identitypb.AddGroupMemberResponse], error)

AddGroupMember adds a user to a group.

func (*IdentityHandler) ApproveQrLogin 

func (h *IdentityHandler) ApproveQrLogin(
	ctx context.Context,
	req *connect.Request[identitypb.ApproveQrLoginRequest],
) (*connect.Response[identitypb.ApproveQrLoginResponse], error)

ApproveQrLogin approves or rejects a QR login session from the authenticated device.

func (*IdentityHandler) BeginIdentityVerification added in v0.4.0 

func (h *IdentityHandler) BeginIdentityVerification(
	ctx context.Context,
	req *connect.Request[identitypb.BeginIdentityVerificationRequest],
) (*connect.Response[identitypb.BeginIdentityVerificationResponse], error)

BeginIdentityVerification starts a verification session for the caller.

func (*IdentityHandler) BeginOAuthLogin 

func (h *IdentityHandler) BeginOAuthLogin(
	ctx context.Context,
	req *connect.Request[identitypb.BeginOAuthLoginRequest],
) (*connect.Response[identitypb.BeginOAuthLoginResponse], error)

BeginOAuthLogin returns the provider authorization URL plus the server-minted state artifacts needed to complete the callback safely.

func (*IdentityHandler) BeginPasskeyLogin 

func (h *IdentityHandler) BeginPasskeyLogin(
	ctx context.Context,
	req *connect.Request[identitypb.BeginPasskeyLoginRequest],
) (*connect.Response[identitypb.BeginPasskeyLoginResponse], error)

BeginPasskeyLogin generates PublicKeyCredentialRequestOptions for navigator.credentials.get().

func (*IdentityHandler) BeginPasskeyRegistration 

func (h *IdentityHandler) BeginPasskeyRegistration(
	ctx context.Context,
	req *connect.Request[identitypb.BeginPasskeyRegistrationRequest],
) (*connect.Response[identitypb.BeginPasskeyRegistrationResponse], error)

BeginPasskeyRegistration generates PublicKeyCredentialCreationOptions for navigator.credentials.create().

func (*IdentityHandler) BeginTotpSetup 

func (h *IdentityHandler) BeginTotpSetup(
	ctx context.Context,
	req *connect.Request[identitypb.BeginTotpSetupRequest],
) (*connect.Response[identitypb.BeginTotpSetupResponse], error)

BeginTotpSetup generates a new TOTP secret and recovery codes for the authenticated user. The secret is NOT yet active — the user must call VerifyTotpSetup with a valid code to confirm enrollment.

func (*IdentityHandler) ChangePassword 

func (h *IdentityHandler) ChangePassword(
	ctx context.Context,
	req *connect.Request[identitypb.ChangePasswordRequest],
) (*connect.Response[identitypb.ChangePasswordResponse], error)

ChangePassword changes the authenticated user's password after verifying the current password. The service layer also invalidates all refresh tokens.

func (*IdentityHandler) CompletePasskeyLogin 

func (h *IdentityHandler) CompletePasskeyLogin(
	ctx context.Context,
	req *connect.Request[identitypb.CompletePasskeyLoginRequest],
) (*connect.Response[identitypb.CompletePasskeyLoginResponse], error)

CompletePasskeyLogin verifies the passkey assertion and issues tokens.

func (*IdentityHandler) CompletePasskeyRegistration 

func (h *IdentityHandler) CompletePasskeyRegistration(
	ctx context.Context,
	req *connect.Request[identitypb.CompletePasskeyRegistrationRequest],
) (*connect.Response[identitypb.CompletePasskeyRegistrationResponse], error)

CompletePasskeyRegistration verifies the attestation and stores the new passkey credential.

func (*IdentityHandler) ConfirmEmailChange 

func (h *IdentityHandler) ConfirmEmailChange(
	ctx context.Context,
	req *connect.Request[identitypb.ConfirmEmailChangeRequest],
) (*connect.Response[identitypb.ConfirmEmailChangeResponse], error)

ConfirmEmailChange consumes a pending email-change token (sent to the new address). This RPC is exempt from the auth middleware so a user clicking the link from their inbox doesn't need to be currently signed in. On success, the user's email is updated and ALL of their refresh tokens are revoked, forcing re-authentication everywhere.

func (*IdentityHandler) ConfirmPasswordReset 

func (h *IdentityHandler) ConfirmPasswordReset(
	ctx context.Context,
	req *connect.Request[identitypb.ConfirmPasswordResetRequest],
) (*connect.Response[identitypb.ConfirmPasswordResetResponse], error)

ConfirmPasswordReset consumes a password-reset token and sets a new password.

func (*IdentityHandler) CreateGroup 

func (h *IdentityHandler) CreateGroup(
	ctx context.Context,
	req *connect.Request[identitypb.CreateGroupRequest],
) (*connect.Response[identitypb.CreateGroupResponse], error)

CreateGroup creates a new group.

func (*IdentityHandler) CreateUser 

func (h *IdentityHandler) CreateUser(
	ctx context.Context,
	req *connect.Request[identitypb.CreateUserRequest],
) (*connect.Response[identitypb.CreateUserResponse], error)

CreateUser creates a new user. Admin only. Delegates to InviteUser with createImmediately=true.

func (*IdentityHandler) DeactivateUser 

func (h *IdentityHandler) DeactivateUser(
	ctx context.Context,
	req *connect.Request[identitypb.DeactivateUserRequest],
) (*connect.Response[identitypb.DeactivateUserResponse], error)

DeactivateUser deactivates a user account. Admin only.

func (*IdentityHandler) DeleteGroup 

func (h *IdentityHandler) DeleteGroup(
	ctx context.Context,
	req *connect.Request[identitypb.DeleteGroupRequest],
) (*connect.Response[identitypb.DeleteGroupResponse], error)

DeleteGroup deletes a group.

func (*IdentityHandler) DeletePasskey 

func (h *IdentityHandler) DeletePasskey(
	ctx context.Context,
	req *connect.Request[identitypb.DeletePasskeyRequest],
) (*connect.Response[identitypb.DeletePasskeyResponse], error)

DeletePasskey deletes a registered passkey credential. Delegates to ProfileService.DeletePasskey.

func (*IdentityHandler) DeleteUser 

func (h *IdentityHandler) DeleteUser(
	ctx context.Context,
	req *connect.Request[identitypb.DeleteUserRequest],
) (*connect.Response[identitypb.DeleteUserResponse], error)

DeleteUser deletes a user. Admin only. Delegates to DeactivateUser since the service layer does not provide hard-delete — deactivation is the supported removal path.

func (*IdentityHandler) DisableTotp 

func (h *IdentityHandler) DisableTotp(
	ctx context.Context,
	req *connect.Request[identitypb.DisableTotpRequest],
) (*connect.Response[identitypb.DisableTotpResponse], error)

DisableTotp removes TOTP enrollment for the authenticated user. Requires password confirmation for security.

func (*IdentityHandler) GetCurrentUser 

func (h *IdentityHandler) GetCurrentUser(
	ctx context.Context,
	req *connect.Request[identitypb.GetCurrentUserRequest],
) (*connect.Response[identitypb.GetCurrentUserResponse], error)

GetCurrentUser returns the currently authenticated user's profile.

func (*IdentityHandler) GetIdentityVerificationStatus added in v0.4.0 

func (h *IdentityHandler) GetIdentityVerificationStatus(
	ctx context.Context,
	req *connect.Request[identitypb.GetIdentityVerificationStatusRequest],
) (*connect.Response[identitypb.GetIdentityVerificationStatusResponse], error)

GetIdentityVerificationStatus returns the current status of a verification.

func (*IdentityHandler) GetQrLoginSession 

func (h *IdentityHandler) GetQrLoginSession(
	ctx context.Context,
	req *connect.Request[identitypb.GetQrLoginSessionRequest],
) (*connect.Response[identitypb.GetQrLoginSessionResponse], error)

GetQrLoginSession retrieves the details of a QR login session for display on the authenticated device.

func (*IdentityHandler) GetUser 

func (h *IdentityHandler) GetUser(
	ctx context.Context,
	req *connect.Request[identitypb.GetUserRequest],
) (*connect.Response[identitypb.GetUserResponse], error)

GetUser returns a single user by ID. Admin only.

func (*IdentityHandler) InitiateQrLogin 

func (h *IdentityHandler) InitiateQrLogin(
	ctx context.Context,
	req *connect.Request[identitypb.InitiateQrLoginRequest],
) (*connect.Response[identitypb.InitiateQrLoginResponse], error)

InitiateQrLogin creates a new QR login session for a new device.

func (*IdentityHandler) InviteUser 

func (h *IdentityHandler) InviteUser(
	ctx context.Context,
	req *connect.Request[identitypb.InviteUserRequest],
) (*connect.Response[identitypb.InviteUserResponse], error)

InviteUser creates a new user invitation or immediately creates an active user.

func (*IdentityHandler) ListAuditEvents 

func (h *IdentityHandler) ListAuditEvents(
	ctx context.Context,
	req *connect.Request[identitypb.ListAuditEventsRequest],
) (*connect.Response[identitypb.ListAuditEventsResponse], error)

ListAuditEvents returns a paginated list of audit events. Admin only. Delegates to ProfileService.ListAuditEvents which enforces admin role.

func (*IdentityHandler) ListGroupMembers 

func (h *IdentityHandler) ListGroupMembers(
	ctx context.Context,
	req *connect.Request[identitypb.ListGroupMembersRequest],
) (*connect.Response[identitypb.ListGroupMembersResponse], error)

ListGroupMembers lists all members of a group.

func (*IdentityHandler) ListGroups 

func (h *IdentityHandler) ListGroups(
	ctx context.Context,
	req *connect.Request[identitypb.ListGroupsRequest],
) (*connect.Response[identitypb.ListGroupsResponse], error)

ListGroups returns a paginated list of groups.

func (*IdentityHandler) ListHelpRequests 

func (h *IdentityHandler) ListHelpRequests(
	ctx context.Context,
	req *connect.Request[identitypb.ListHelpRequestsRequest],
) (*connect.Response[identitypb.ListHelpRequestsResponse], error)

ListHelpRequests returns a paginated list of admin help requests. Admin only.

func (*IdentityHandler) ListMySessions 

func (h *IdentityHandler) ListMySessions(
	ctx context.Context,
	req *connect.Request[identitypb.ListMySessionsRequest],
) (*connect.Response[identitypb.ListMySessionsResponse], error)

ListMySessions lists the authenticated user's active sessions.

func (*IdentityHandler) ListPasskeys 

func (h *IdentityHandler) ListPasskeys(
	ctx context.Context,
	req *connect.Request[identitypb.ListPasskeysRequest],
) (*connect.Response[identitypb.ListPasskeysResponse], error)

ListPasskeys lists the authenticated user's registered passkey credentials. Delegates to ProfileService.ListMyPasskeys.

func (*IdentityHandler) ListUsers 

func (h *IdentityHandler) ListUsers(
	ctx context.Context,
	req *connect.Request[identitypb.ListUsersRequest],
) (*connect.Response[identitypb.ListUsersResponse], error)

ListUsers returns a paginated list of users. Admin only.

func (*IdentityHandler) Logout 

func (h *IdentityHandler) Logout(
	ctx context.Context,
	req *connect.Request[identitypb.LogoutRequest],
) (*connect.Response[identitypb.LogoutResponse], error)

Logout invalidates the given refresh token.

func (*IdentityHandler) OAuthLogin 

func (h *IdentityHandler) OAuthLogin(
	ctx context.Context,
	req *connect.Request[identitypb.OAuthLoginRequest],
) (*connect.Response[identitypb.OAuthLoginResponse], error)

OAuthLogin exchanges an OAuth authorization code for backend-issued tokens.

The service layer is responsible for the actual provider-side code exchange and identity verification. The handler simply forwards the authorization code, the user-selected provider, and the redirect URI.

func (*IdentityHandler) OrganizationSignup added in v0.8.0 

func (h *IdentityHandler) OrganizationSignup(
	ctx context.Context,
	req *connect.Request[identitypb.OrganizationSignupRequest],
) (*connect.Response[identitypb.OrganizationSignupResponse], error)

OrganizationSignup creates a new tenant + admin user in one transaction. Only available in `mode=multi`; returns CodeUnimplemented in `mode=single` per docs/IDENTITY.md decision log §3.

func (*IdentityHandler) PasswordLogin 

func (h *IdentityHandler) PasswordLogin(
	ctx context.Context,
	req *connect.Request[identitypb.PasswordLoginRequest],
) (*connect.Response[identitypb.PasswordLoginResponse], error)

PasswordLogin authenticates a user with email and password. If TOTP is enabled, returns totp_required=true and a login_challenge_id for the client to pass to VerifyTotp.

func (*IdentityHandler) PasswordSignup 

func (h *IdentityHandler) PasswordSignup(
	ctx context.Context,
	req *connect.Request[identitypb.PasswordSignupRequest],
) (*connect.Response[identitypb.PasswordSignupResponse], error)

PasswordSignup creates a new user account with email and password.

func (*IdentityHandler) PollQrLogin 

func (h *IdentityHandler) PollQrLogin(
	ctx context.Context,
	req *connect.Request[identitypb.PollQrLoginRequest],
) (*connect.Response[identitypb.PollQrLoginResponse], error)

PollQrLogin polls for QR login session completion from the new device.

func (*IdentityHandler) ReactivateUser 

func (h *IdentityHandler) ReactivateUser(
	ctx context.Context,
	req *connect.Request[identitypb.ReactivateUserRequest],
) (*connect.Response[identitypb.ReactivateUserResponse], error)

ReactivateUser reactivates a previously deactivated user. Admin only.

func (*IdentityHandler) RedeemOAuthCode added in v0.9.0 

func (h *IdentityHandler) RedeemOAuthCode(
	ctx context.Context,
	req *connect.Request[identitypb.RedeemOAuthCodeRequest],
) (*connect.Response[identitypb.RedeemOAuthCodeResponse], error)

RedeemOAuthCode exchanges the single-use one-time code from the hosted OAuth callback redirect for a backend-issued token pair. The code is consumed atomically; a replay or expired code surfaces as CodeUnauthenticated.

func (*IdentityHandler) RefreshToken 

func (h *IdentityHandler) RefreshToken(
	ctx context.Context,
	req *connect.Request[identitypb.RefreshTokenRequest],
) (*connect.Response[identitypb.RefreshTokenResponse], error)

RefreshToken rotates the refresh token and issues a new access token.

func (*IdentityHandler) RegenerateRecoveryCodes 

func (h *IdentityHandler) RegenerateRecoveryCodes(
	ctx context.Context,
	req *connect.Request[identitypb.RegenerateRecoveryCodesRequest],
) (*connect.Response[identitypb.RegenerateRecoveryCodesResponse], error)

RegenerateRecoveryCodes generates a new set of recovery codes, invalidating any existing codes. Requires password confirmation.

func (*IdentityHandler) RemoveGroupMember 

func (h *IdentityHandler) RemoveGroupMember(
	ctx context.Context,
	req *connect.Request[identitypb.RemoveGroupMemberRequest],
) (*connect.Response[identitypb.RemoveGroupMemberResponse], error)

RemoveGroupMember removes a user from a group.

func (*IdentityHandler) RequestAdminHelp 

func (h *IdentityHandler) RequestAdminHelp(
	ctx context.Context,
	req *connect.Request[identitypb.RequestAdminHelpRequest],
) (*connect.Response[identitypb.RequestAdminHelpResponse], error)

RequestAdminHelp creates a new admin help request. This is an unauthenticated endpoint — the user cannot log in and needs admin assistance.

func (*IdentityHandler) RequestEmailChange 

func (h *IdentityHandler) RequestEmailChange(
	ctx context.Context,
	req *connect.Request[identitypb.RequestEmailChangeRequest],
) (*connect.Response[identitypb.RequestEmailChangeResponse], error)

RequestEmailChange begins the primary-email rotation flow. The caller must already be authenticated (auth middleware enforces this) AND supply their current password as a re-authentication step. The new address is sent a verification link; the old address is sent a security notice. The change takes effect only after ConfirmEmailChange.

func (*IdentityHandler) RequestPasswordReset 

func (h *IdentityHandler) RequestPasswordReset(
	ctx context.Context,
	req *connect.Request[identitypb.RequestPasswordResetRequest],
) (*connect.Response[identitypb.RequestPasswordResetResponse], error)

RequestPasswordReset sends a password reset link to the user's recovery email. Always returns success to prevent email enumeration.

func (*IdentityHandler) ResetUserPassword 

func (h *IdentityHandler) ResetUserPassword(
	ctx context.Context,
	req *connect.Request[identitypb.ResetUserPasswordRequest],
) (*connect.Response[identitypb.ResetUserPasswordResponse], error)

ResetUserPassword resets a user's password. Admin only.

func (*IdentityHandler) ResolveHelpRequest 

func (h *IdentityHandler) ResolveHelpRequest(
	ctx context.Context,
	req *connect.Request[identitypb.ResolveHelpRequestRequest],
) (*connect.Response[identitypb.ResolveHelpRequestResponse], error)

ResolveHelpRequest resolves or rejects an admin help request. Admin only.

func (*IdentityHandler) RevokeAllSessions 

func (h *IdentityHandler) RevokeAllSessions(
	ctx context.Context,
	req *connect.Request[identitypb.RevokeAllSessionsRequest],
) (*connect.Response[identitypb.RevokeAllSessionsResponse], error)

RevokeAllSessions revokes all sessions for the authenticated user. Requires password confirmation.

func (*IdentityHandler) RevokeSession 

func (h *IdentityHandler) RevokeSession(
	ctx context.Context,
	req *connect.Request[identitypb.RevokeSessionRequest],
) (*connect.Response[identitypb.RevokeSessionResponse], error)

RevokeSession revokes a single session by its ID.

func (*IdentityHandler) SendEmailVerification 

func (h *IdentityHandler) SendEmailVerification(
	ctx context.Context,
	req *connect.Request[identitypb.SendEmailVerificationRequest],
) (*connect.Response[identitypb.SendEmailVerificationResponse], error)

SendEmailVerification sends a verification email to the authenticated user.

func (*IdentityHandler) SetUserQuota 

func (h *IdentityHandler) SetUserQuota(
	ctx context.Context,
	req *connect.Request[identitypb.SetUserQuotaRequest],
) (*connect.Response[identitypb.SetUserQuotaResponse], error)

SetUserQuota sets a user's storage quota. Admin only.

func (*IdentityHandler) SignOutEverywhere 

func (h *IdentityHandler) SignOutEverywhere(
	ctx context.Context,
	req *connect.Request[identitypb.SignOutEverywhereRequest],
) (*connect.Response[identitypb.SignOutEverywhereResponse], error)

SignOutEverywhere revokes all sessions for the authenticated user. This is a distinct RPC from RevokeAllSessions per the proto definition but delegates to the same service method.

func (*IdentityHandler) UpdateGroup 

func (h *IdentityHandler) UpdateGroup(
	ctx context.Context,
	req *connect.Request[identitypb.UpdateGroupRequest],
) (*connect.Response[identitypb.UpdateGroupResponse], error)

UpdateGroup updates a group's name and/or description.

func (*IdentityHandler) UpdateProfile 

func (h *IdentityHandler) UpdateProfile(
	ctx context.Context,
	req *connect.Request[identitypb.UpdateProfileRequest],
) (*connect.Response[identitypb.UpdateProfileResponse], error)

UpdateProfile updates the authenticated user's profile (name, avatar).

func (*IdentityHandler) UpdateUser 

func (h *IdentityHandler) UpdateUser(
	ctx context.Context,
	req *connect.Request[identitypb.UpdateUserRequest],
) (*connect.Response[identitypb.UpdateUserResponse], error)

UpdateUser updates a user's profile fields. Admin only.

func (*IdentityHandler) VerifyEmail 

func (h *IdentityHandler) VerifyEmail(
	ctx context.Context,
	req *connect.Request[identitypb.VerifyEmailRequest],
) (*connect.Response[identitypb.VerifyEmailResponse], error)

VerifyEmail consumes an email-verification token and marks the email verified.

func (*IdentityHandler) VerifyTotp 

func (h *IdentityHandler) VerifyTotp(
	ctx context.Context,
	req *connect.Request[identitypb.VerifyTotpRequest],
) (*connect.Response[identitypb.VerifyTotpResponse], error)

VerifyTotp completes a login challenge that requires TOTP. Accepts either a 6-digit TOTP code or a recovery code.

func (*IdentityHandler) VerifyTotpSetup 

func (h *IdentityHandler) VerifyTotpSetup(
	ctx context.Context,
	req *connect.Request[identitypb.VerifyTotpSetupRequest],
) (*connect.Response[identitypb.VerifyTotpSetupResponse], error)

VerifyTotpSetup confirms TOTP enrollment by verifying a code generated from the secret provided by BeginTotpSetup.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.