Documentation
¶
Overview ¶
Package credentials generates, hashes and verifies the secrets the application issues or accepts: passwords, API tokens, service credentials and recovery codes.
Index ¶
- func GenerateCollectKey() (string, error)
- func GenerateIngestKey() (string, error)
- func GenerateServiceCredential() (prefix, secret, value string, err error)
- func GenerateTokenPrefix() (string, error)
- func GenerateTokenSecret() (string, error)
- func HashPassword(password string) (string, error)
- func HashRecoveryCode(code string) string
- func HashServiceSecret(secret string) string
- func HashTokenSecret(secret string) (string, error)
- func ServiceCredentialValue(prefix, secret string) string
- func TokenValue(prefix, secret string) string
- func UseMinTokenHashCost()
- func VerifyPassword(encodedHash, password string) bool
- func VerifyServiceSecret(secret, hash string) bool
- func VerifyTokenSecret(secret, hash string) bool
- type ParsedToken
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateCollectKey ¶
GenerateCollectKey returns a per-workspace collect write-key (x-collect-key).
func GenerateIngestKey ¶
GenerateIngestKey returns an Integration's hook key (POST /hooks/{key}): the address of one Integration's inbound provider callbacks, which also names its Workspace. Unlike the collect key it is never exposed in the browser tracker.
func GenerateServiceCredential ¶
GenerateServiceCredential returns a new Service credential's visible prefix, its secret and the value a service presents (`smsc_<prefix>_<secret>`). The prefix of an API token is `omtk`, so one kind never parses as the other.
func GenerateTokenPrefix ¶
func GenerateTokenSecret ¶
func HashPassword ¶
HashPassword returns a PHC-encoded argon2id hash of the given password.
func HashRecoveryCode ¶
HashRecoveryCode is the stored form of a Recovery code (ADR 0020): the SHA-256 hex of the code lower-cased with spaces and dashes removed, so it may be typed either way. The codes are random, so an unsalted fast hash is enough, and the lookup by hash must be deterministic.
func HashServiceSecret ¶
HashServiceSecret is the stored form of a Service credential's secret: its SHA-256 hex. The secret is 40 random characters, so a fast unsalted hash is enough, and it is checked on every request, where a slow password hash would be a cost with no gain.
func HashTokenSecret ¶
func ServiceCredentialValue ¶
ServiceCredentialValue is the value a service presents for a credential.
func TokenValue ¶
func UseMinTokenHashCost ¶
func UseMinTokenHashCost()
UseMinTokenHashCost lowers the cost of every secret hashed from now on to bcrypt's minimum. Only tests call it: at cost 12 each created token takes about 0.3s, which dominates a suite that creates one per request.
func VerifyPassword ¶
VerifyPassword reports whether password matches the PHC-encoded hash.
func VerifyServiceSecret ¶
VerifyServiceSecret reports whether secret hashes to the stored hash, in constant time.
func VerifyTokenSecret ¶
Types ¶
type ParsedToken ¶
func ParseServiceCredential ¶
func ParseServiceCredential(value string) *ParsedToken
ParseServiceCredential splits a presented value into its prefix and secret; nil when the value is not shaped like a Service credential.
func ParseToken ¶
func ParseToken(value string) *ParsedToken
Source Files