Documentation
¶
Overview ¶
Package app contains the identity context's application services. The Authenticator orchestrates credential lookup and password verification without depending on any infrastructure package directly.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator verifies login credentials and returns the authenticated MemberID. It is the sole entry point for the password-based login flow.
func NewAuthenticator ¶
func NewAuthenticator(repo domain.CredentialRepository, hasher passwordHasher) *Authenticator
NewAuthenticator constructs an Authenticator with the supplied credential repository and password hasher. Production callers pass crypto.NewHasher(crypto.DefaultParams()).
func (*Authenticator) Login ¶
Login looks up the credential for email, verifies password against the stored hash, and returns the authenticated MemberID on success.
On a wrong password, or an unknown/deactivated email, Login returns domain.ErrInvalidCredentials with no further detail to prevent user enumeration. A lookup failure or a stored hash that fails to parse is a distinct internal error, wrapped and returned as-is, so the caller can tell it apart from a real 401.
Source Files