Documentation
¶
Index ¶
- Constants
- Variables
- type Claims
- type Manager
- func (m *Manager) Generate2FAToken(userID uuid.UUID) (string, error)
- func (m *Manager) GenerateAccessToken(userID uuid.UUID) (string, error)
- func (m *Manager) GenerateRefreshToken(userID uuid.UUID) (string, error)
- func (m *Manager) GetRefreshTokenExpiry() time.Duration
- func (m *Manager) Validate2FAToken(tokenString string) (*Claims, error)
- func (m *Manager) ValidateAccessToken(tokenString string) (*Claims, error)
- func (m *Manager) ValidateRefreshToken(tokenString string) (*Claims, error)
Constants ¶
const ( TokenTypeAccess = "access" TokenTypeRefresh = "refresh" TokenType2FA = "2fa" )
Token types. The type is embedded as a claim and verified on validation so a token minted for one purpose cannot be replayed for another (e.g. a 2FA challenge token being used as a full access token, which would bypass the second factor).
Variables ¶
var ( ErrInvalidToken = errors.New("invalid token") ErrExpiredToken = errors.New("token has expired") )
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
UserID uuid.UUID `json:"user_id"`
TokenType string `json:"token_type,omitempty"`
jwt.RegisteredClaims
}
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
func NewManager ¶
func (*Manager) Generate2FAToken ¶
Generate2FAToken creates a short-lived token for 2FA challenge (5 minutes)
func (*Manager) GenerateAccessToken ¶
GenerateAccessToken creates a new JWT access token
func (*Manager) GenerateRefreshToken ¶
GenerateRefreshToken creates a new JWT refresh token
func (*Manager) GetRefreshTokenExpiry ¶
func (*Manager) Validate2FAToken ¶
Validate2FAToken validates a 2FA challenge token
func (*Manager) ValidateAccessToken ¶
ValidateAccessToken validates and parses an access token.
It rejects 2FA challenge tokens, which are signed with the same secret as access tokens. Without this check a client could take the short-lived twoFactorToken returned by the password step and use it directly as a Bearer access token, bypassing the second factor entirely.
Source Files