Documentation
¶
Overview ¶
Package selfservice implements the public self-service account pages: forgotten-password reset for agents and customers, and customer self-registration with email verification.
Both flows are switched by config/default.yaml: features.lost_password (agent + customer password reset) and features.registration (customer sign-up). Links in emails are built from BASE_URL, the operator-set public URL of the instance; the request Host header is never trusted for that.
Index ¶
Constants ¶
const ( TokenPasswordReset = "password_reset" TokenEmailVerify = "email_verify" )
Token types stored in gk_auth_token.token_type.
const ( UserAgent = "agent" UserCustomer = "customer" )
Account types stored in gk_auth_token.user_type.
const ( StatusPending = "pending" StatusApproved = "approved" )
Registration request statuses (gk_registration_request.status).
const ( // ResetTokenTTL is how long a password reset link stays valid. ResetTokenTTL = 1 * time.Hour // VerifyTokenTTL is how long a registration confirmation link stays valid. VerifyTokenTTL = 24 * time.Hour )
Token lifetimes and request budgets.
const EnvBaseURL = "BASE_URL"
EnvBaseURL names the environment variable holding the public URL of this instance (scheme://host[:port][/prefix]). Links in self-service emails are built from it; the request Host header is attacker-controlled and would let anyone send a victim a reset link pointing at their own server.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Source Files