Documentation
¶
Overview ¶
Package credentials generates, hashes and verifies the secrets the application issues or accepts: passwords, API tokens, service credentials and recovery codes.
Index ¶
- func GenerateCollectKey() (string, error)
- func GenerateIngestKey() (string, error)
- func GenerateServiceCredential() (prefix, secret, value string, err error)
- func GenerateTokenPrefix() (string, error)
- func GenerateTokenSecret() (string, error)
- func HashPassword(password string) (string, error)
- func HashRecoveryCode(code string) string
- func HashSecret(secret string) string
- func ServiceCredentialValue(prefix, secret string) string
- func TokenValue(prefix, secret string) string
- func VerifyPassword(encodedHash, password string) bool
- func VerifySecret(secret, hash string) bool
- type ParsedToken
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateCollectKey ¶
GenerateCollectKey returns a per-workspace collect write-key (x-collect-key).
func GenerateIngestKey ¶
GenerateIngestKey returns an Integration's hook key (POST /hooks/{key}): the address of one Integration's inbound provider callbacks, which also names its Workspace. Unlike the collect key it is never exposed in the browser tracker.
func GenerateServiceCredential ¶
GenerateServiceCredential returns a new Service credential's visible prefix, its secret and the value a service presents (`smsc_<prefix>_<secret>`). The prefix of an API token is `omtk`, so one kind never parses as the other.
func GenerateTokenPrefix ¶
func GenerateTokenSecret ¶
GenerateTokenSecret returns secretLen URL-safe base64 characters. secretLen is a multiple of 4, so the random bytes fill every character and the last one carries no zero padding bits.
func HashPassword ¶
HashPassword returns a PHC-encoded argon2id hash of the given password.
func HashRecoveryCode ¶
HashRecoveryCode is the stored form of a Recovery code (ADR 0020): the SHA-256 hex of the code lower-cased with spaces and dashes removed, so it may be typed either way. The codes are random, so an unsalted fast hash is enough, and the lookup by hash must be deterministic.
func HashSecret ¶
HashSecret is the stored form of a generated secret: its SHA-256 hex. The secret is 240 random bits, so a fast unsalted hash is enough, and it is checked on every request, where a slow password hash would be a cost with no gain.
func ServiceCredentialValue ¶
ServiceCredentialValue is the value a service presents for a credential.
func TokenValue ¶
func VerifyPassword ¶
VerifyPassword reports whether password matches the PHC-encoded hash.
func VerifySecret ¶
VerifySecret reports whether secret hashes to the stored hash, in constant time.
Types ¶
type ParsedToken ¶
func ParseServiceCredential ¶
func ParseServiceCredential(value string) *ParsedToken
ParseServiceCredential splits a presented value into its prefix and secret; nil when the value is not shaped like a Service credential.
func ParseToken ¶
func ParseToken(value string) *ParsedToken
Source Files