README
¶
module/iam
身份、凭证与会话。
账号、凭证、邮箱和资料落在 MySQL 的四张表里，会话完全活在 Redis 里，两者只靠一个 user id 相连。
它提供什么
- 账号 ——
users、password_credentials、email_identities、profiles四张表。注册、登录、登出、改密码、管理员重置密码。 - 会话 —— 一个不透明 cookie 背后是 Redis 里的快照，配套自服务与管理员两个视角的列表和吊销接口。
- 防爆破 —— 连续失败的登录在 Redis 里计数，达到阈值锁定一个窗口。
- 用户管理 —— 建号、列表、查询、更新，以及吊销任意用户的会话。
接入
import "github.com/hydroan/gst/module/iam"
iam.Register()
必须在 authz 之前注册：Authz 读的是 IAMSession 放到请求上的 subject 和 tenant。
Redis 是硬依赖，不是缓存：会话不落库，没有 Redis 谁也认证不了。所以注册时就会检查
Redis.Enabled，没开直接让启动失败——这件事该在部署还能改配置的那一刻说。
复制到业务项目：
gg module copy iam
配置
| 键 | 默认 | 它约束什么 |
|---|---|---|
IAM_SESSION_EXPIRATION |
8h |
会话寿命，登录时定死 |
IAM_SESSION_USER_STATE_TTL |
30s |
用户状态缓存最多能陈旧多久 |
IAM_LOGIN_FAILURE_LIMIT |
5 |
连续失败几次锁定账号 |
IAM_LOGIN_FAILURE_WINDOW |
15m |
锁定持续多久 |
四个都在注册时或首次使用时读取，非法值让启动失败，而不是让第一个用到它的请求失败。
深入
- SESSION.md —— 会话怎么存、每个请求怎么校验、吊销时到底动了哪些键。 会话不落库，所以这部分的行为全部由 Redis 的键布局决定，值得单独读。
- TENANT.md —— 开启多租户后，哪些接口属于租户、哪些跨租户、哪些只认当前登录主体。
Documentation
¶
Index ¶
- Constants
- func EnsureAdminOnUser(ctx *types.ServiceContext, targetUserID string) error
- func GetSessionExpiration() time.Duration
- func Register()
- type AdminSession
- type AdminSessionDeleteReq
- type AdminSessionDeleteRsp
- type AdminSessionGetRsp
- type AdminSessionListRsp
- type AdminSessionOwnerView
- type AdminUserCreateReq
- type AdminUserCreateRsp
- type AdminUserGetRsp
- type AdminUserListRsp
- type AdminUserPatchReq
- type AdminUserPatchRsp
- type AdminUserSession
- type AdminUserSessionDeleteReq
- type AdminUserSessionDeleteRsp
- type AdminUserSessionListRsp
- type AdminUserView
- type AuthenticatedSessionRsp
- type AuthenticatedSessionView
- type ChangePasswordReq
- type ChangePasswordRsp
- type CurrentDeleteReq
- type CurrentDeleteRsp
- type CurrentGetRsp
- type EmailIdentity
- type LoginReq
- type LoginRsp
- type LogoutRsp
- type PasswordCredential
- type PrincipalView
- type Profile
- type ProfileGetRsp
- type ProfilePatchReq
- type ProfilePatchRsp
- type ResetPasswordReq
- type ResetPasswordRsp
- type Session
- type SessionDeleteAllReq
- type SessionDeleteAllRsp
- type SessionDeleteReq
- type SessionDeleteRsp
- type SessionGetRsp
- type SessionListRsp
- type SessionView
- type SignupReq
- type SignupRsp
- type User
- type UserStatus
Constants ¶
const ( UserStatusActive = modeliamuser.UserStatusActive UserStatusInactive = modeliamuser.UserStatusInactive UserStatusLocked = modeliamuser.UserStatusLocked )
Variables ¶
This section is empty.
Functions ¶
func EnsureAdminOnUser ¶
func EnsureAdminOnUser(ctx *types.ServiceContext, targetUserID string) error
EnsureAdminOnUser reports whether the acting user may administer the target user under the IAM tenant-admin rules, returning a service error when it may not. System-root actors are granted globally; a tenant administrator must hold route permission in the current tenant and the target must belong to that same tenant, and system-root targets are never manageable through tenant-local admin APIs.
This is the seam other framework modules use to reuse IAM authorization. Resolving the two users and evaluating the rules are IAM's own steps, so a caller states what it wants to know rather than reproducing the procedure — and IAM stays free to change the procedure without touching those modules.
func GetSessionExpiration ¶
GetSessionExpiration returns the configured session expiration time. If not configured, it returns the default value of 8 hours.
func Register ¶
func Register()
Register registers IAM models, API routes, middleware, and scheduled jobs.
API Routes:
Session routes:
- GET /api/iam/session/current
- DELETE /api/iam/session/current
- GET /api/iam/sessions
- GET /api/iam/admin/sessions
- GET /api/iam/admin/sessions/:id
- DELETE /api/iam/admin/sessions/:id
- GET /api/iam/admin/users/:id/sessions
- DELETE /api/iam/admin/users/:id/sessions
- GET /api/iam/sessions/:id
- DELETE /api/iam/sessions
- DELETE /api/iam/sessions/:id
Note: DELETE /api/iam/sessions/:id treats id=others as a reserved self-service bulk logout that revokes every other session of the current user.
Account management routes:
- POST /api/login
- POST /api/logout
- POST /api/signup
- POST /api/iam/change-password
- POST /api/iam/reset-password
- POST /api/iam/admin/users
- GET /api/iam/admin/users
- GET /api/iam/admin/users/:id
- PATCH /api/iam/admin/users/:id
- GET /api/iam/profile
- PATCH /api/iam/profile
Middleware:
- IAMSession for protected IAM routes and session-aware APIs
Configuration:
- IAM_SESSION_EXPIRATION sets the session lifetime; it defaults to 8 hours. It is read at registration so an unparseable value fails startup rather than the first login.
NOTE: Register IAM modules before authz modules because authz middleware depends on IAMSession.
Types ¶
type AdminSessionDeleteReq ¶
type AdminSessionDeleteReq = modeliamsession.AdminSessionDeleteReq
Admin session API aliases.
type AdminSessionDeleteRsp ¶
type AdminSessionDeleteRsp = modeliamsession.AdminSessionDeleteRsp
Admin session API aliases.
type AdminSessionGetRsp ¶
type AdminSessionGetRsp = modeliamsession.AdminSessionGetRsp
Admin session API aliases.
type AdminSessionListRsp ¶
type AdminSessionListRsp = modeliamsession.AdminSessionListRsp
Admin session API aliases.
type AdminSessionOwnerView ¶
type AdminSessionOwnerView = modeliamsession.AdminSessionOwnerView
Admin session API aliases.
type AdminUserCreateReq ¶
type AdminUserCreateReq = modeliamuser.AdminUserCreateReq
User API aliases.
type AdminUserCreateRsp ¶
type AdminUserCreateRsp = modeliamuser.AdminUserCreateRsp
User API aliases.
type AdminUserSession ¶
type AdminUserSession = modeliamsession.AdminUserSession
Admin session API aliases.
type AdminUserSessionDeleteReq ¶
type AdminUserSessionDeleteReq = modeliamsession.AdminUserSessionDeleteReq
Admin session API aliases.
type AdminUserSessionDeleteRsp ¶
type AdminUserSessionDeleteRsp = modeliamsession.AdminUserSessionDeleteRsp
Admin session API aliases.
type AdminUserSessionListRsp ¶
type AdminUserSessionListRsp = modeliamsession.AdminUserSessionListRsp
Admin session API aliases.
type AuthenticatedSessionRsp ¶
type AuthenticatedSessionRsp = modeliamsession.AuthenticatedSessionRsp
Session API aliases.
type AuthenticatedSessionView ¶
type AuthenticatedSessionView = modeliamsession.AuthenticatedSessionView
Session API aliases.
type ChangePasswordReq ¶
type ChangePasswordReq = modeliamaccount.ChangePasswordReq
Account API aliases.
type ChangePasswordRsp ¶
type ChangePasswordRsp = modeliamaccount.ChangePasswordRsp
Account API aliases.
type CurrentDeleteReq ¶
type CurrentDeleteReq = modeliamsession.CurrentDeleteReq
Session API aliases.
type CurrentDeleteRsp ¶
type CurrentDeleteRsp = modeliamsession.CurrentDeleteRsp
Session API aliases.
type PasswordCredential ¶
type PasswordCredential = modeliamaccount.PasswordCredential
User API aliases.
type ResetPasswordReq ¶
type ResetPasswordReq = modeliamaccount.ResetPasswordReq
Account API aliases.
type ResetPasswordRsp ¶
type ResetPasswordRsp = modeliamaccount.ResetPasswordRsp
Account API aliases.
type SessionDeleteAllReq ¶
type SessionDeleteAllReq = modeliamsession.SessionDeleteAllReq
Session API aliases.
type SessionDeleteAllRsp ¶
type SessionDeleteAllRsp = modeliamsession.SessionDeleteAllRsp
Session API aliases.
type SessionDeleteReq ¶
type SessionDeleteReq = modeliamsession.SessionDeleteReq
Session API aliases.
type SessionDeleteRsp ¶
type SessionDeleteRsp = modeliamsession.SessionDeleteRsp
Session API aliases.
Source Files