The highest tagged major version is
Documentation
¶
Overview ¶
Package basic provides NewStatic/NewStaticWithOptions for bounded Basic credentials. It owns immutable principal copies and per-owner keyed digests, not password hashing for persisted stores, decoding, TLS or erasure. Digest comparisons scan all entries, but input admission and hashing are not a whole-call constant-time guarantee. Constructed values can be reused concurrently.
Index ¶
Examples ¶
Constants ¶
const MaxEntries = 256
MaxEntries bounds the work performed for one static Basic authentication.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Entry ¶
type Entry struct {
// Username is nonempty raw input, admitted before hashing; constructors reject controls.
Username string
// Password is plaintext construction input, never retained as plaintext by Static.
Password string
// Principal is copied identity data; an empty Method becomes basic and a conflicting Method rejects.
Principal authentication.PrincipalSpec
}
Entry configures one accepted username and password pair.
type Option ¶
type Option func(*config)
Option configures a static Basic authenticator.
func WithMaxPasswordBytes ¶
WithMaxPasswordBytes sets an inclusive raw password-byte limit between one and 8 KiB. Without this option, the limit is 8 KiB.
func WithMaxUsernameBytes ¶
WithMaxUsernameBytes sets an inclusive raw username-byte limit between one and 8 KiB. Without this option, the limit is 8 KiB.
type Static ¶
type Static struct {
// contains filtered or unexported fields
}
Static validates Basic credentials against a bounded immutable set. Only fixed-length keyed secret digests are retained and every entry is compared.
func NewStatic ¶
NewStatic validates and copies entries with inclusive 8 KiB raw-byte limits for each username and password. Principal limits are independent.
Example ¶
package main
import (
"context"
"fmt"
authentication "github.com/faustbrian/go-authentication/v2"
"github.com/faustbrian/go-authentication/v2/basic"
)
func main() {
authenticator, _ := basic.NewStatic([]basic.Entry{{
Username: "service", Password: "password",
Principal: authentication.PrincipalSpec{Subject: "service-account"},
}})
result, err := authenticator.Authenticate(
context.Background(),
authentication.NewBasicCredential("service", "password"),
)
principal, authenticated := result.Principal()
fmt.Println(err, authenticated, principal.Subject())
}
Output: <nil> true service-account
func NewStaticWithOptions ¶
NewStaticWithOptions validates and copies entries with immutable credential byte limits. Options may reduce, but not exceed, the default 8 KiB per field. Oversized credentials fail with ErrInvalidConfiguration before scanning or hashing credential contents or copying principals. Caller inputs must remain stable during construction; no plaintext-secret erasure is performed. A zero Static has no entries and rejects admitted credentials; nil receivers are not guarded. No background work or Close lifecycle exists.
func (*Static) Authenticate ¶
func (s *Static) Authenticate(ctx context.Context, credential authentication.Credential) (authentication.Result, error)
Authenticate admits raw credential bytes before hashing, then compares every configured entry. Oversized fields fail invalid; cancellation takes precedence. Require a nonnil context; only its initial state is checked. Inputs must be concrete BasicCredential values (not pointers); blocking/provider work is absent.
Source Files