auth0

package
v0.244.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 10, 2026 License: AGPL-3.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ConfigEnvPrefix is the prefix applied to environment variables for configuring Auth0.
	ConfigEnvPrefix = "AUTH0_"
)

Variables

View Source 
var (
	ErrNoIDToken      = errors.New("no id_token field in oauth2 token")
	ErrInvalidToken   = errors.New("token is invalid")
	ErrInvalidState   = errors.New("oauth state does not match")
	ErrSessionExpired = errors.New("session expired, re-authentication required")
)
View Source 
var LoadManager = sync.OnceValues(func() (*Manager, error) {
	cfg, err := loadConfigOnce()
	if err != nil {
		return nil, fmt.Errorf("load config: %w", err)
	}

	mgmt, err := client.New(
		cfg.MgmtDomain,
		option.WithClientCredentials(
			context.Background(),
			cfg.ClientID,
			cfg.ClientSecret,
		),
	)
	if err != nil {
		return nil, fmt.Errorf("new management api connection: %w", err)
	}

	return &Manager{Management: mgmt}, nil
})

LoadManager loads a connection to the Auth0 management API.

Functions

This section is empty.

Types

type AuthURLResult added in v0.104.0 

type AuthURLResult struct {
	URL          string
	State        string
	Nonce        string
	CodeVerifier string
}

AuthURLResult holds the generated authorization URL along with the state, nonce and PKCE code verifier that must be stored in the session before redirecting (see StoreAuthRequest).

func (AuthURLResult) GetCodeVerifier added in v0.235.0 

func (a AuthURLResult) GetCodeVerifier() string

func (AuthURLResult) GetNonce added in v0.244.3 

func (a AuthURLResult) GetNonce() string

func (AuthURLResult) GetState added in v0.235.0 

func (a AuthURLResult) GetState() string

func (AuthURLResult) GetURL added in v0.235.0 

func (a AuthURLResult) GetURL() string

type Authenticator 

type Authenticator struct {
	// contains filtered or unexported fields
}

Authenticator is used to authenticate our users.

func LoadAuthenticator added in v0.235.0 

func LoadAuthenticator() (*Authenticator, error)

LoadAuthenticator performs setup and initialisation of the Auth0 tenant. It can be called repeatedly and lazily: only a successful initialisation is cached, so a transient discovery failure is retried on the next call rather than being stuck until restart.

func (*Authenticator) ClearAuth added in v0.235.0 

func (a *Authenticator) ClearAuth(ctx context.Context)

ClearAuth removes all authentication-related keys from the session.

func (*Authenticator) ConsumeReturnTo added in v0.244.3 

func (a *Authenticator) ConsumeReturnTo(ctx context.Context) (string, error)

ConsumeReturnTo returns the stored return path and removes it (single use).

func (*Authenticator) EnsureFresh added in v0.244.3 

func (a *Authenticator) EnsureFresh(ctx context.Context) error

EnsureFresh guarantees the session holds a usable access token, refreshing it if needed. It returns ErrSessionExpired if the user must log in again.

func (*Authenticator) GenerateAuthURL added in v0.235.0 

func (a *Authenticator) GenerateAuthURL(signup bool) (*AuthURLResult, error)

GenerateAuthURL constructs the Auth0 Universal Login redirect URL using PKCE (S256), state and a nonce. Pass signup=true to show the signup screen first. The caller decides this (e.g. from the route), so there is no hidden dependency on the router and no way to get an empty URL back.

func (*Authenticator) GenerateLogoutURL added in v0.235.0 

func (a *Authenticator) GenerateLogoutURL() (*url.URL, error)

GenerateLogoutURL generates the URL that logs the user out of Auth0. The return URL comes from configuration, not from the request's Host header.

func (*Authenticator) IsAccessTokenExpired added in v0.235.0 

func (a *Authenticator) IsAccessTokenExpired(ctx context.Context) bool

IsAccessTokenExpired returns true if the access token has expired, or will within expiryLeeway.

func (*Authenticator) IsAuthenticated added in v0.235.0 

func (a *Authenticator) IsAuthenticated(ctx context.Context) bool

IsAuthenticated returns true if the session contains an access token.

func (*Authenticator) PerformExchange added in v0.235.0 

func (a *Authenticator) PerformExchange(ctx context.Context, code string) (*models.UserProfileResponse, error)

PerformExchange verifies the callback and exchanges the authorization code for tokens. The PKCE verifier and nonce are read from the session (stored by StoreAuthRequest). Call ValidateState first. State, nonce and verifier are single-use and are cleared whether or not the exchange succeeds.

func (*Authenticator) PutReturnTo added in v0.235.0 

func (a *Authenticator) PutReturnTo(ctx context.Context, path string)

PutReturnTo stores the path to return to after login. Only local paths are accepted (open-redirect protection), and when triggered from htmx updates/paginate endpoints it returns to the base page.

func (*Authenticator) StoreAuthRequest added in v0.244.3 

func (a *Authenticator) StoreAuthRequest(ctx context.Context, r *AuthURLResult)

StoreAuthRequest saves everything the callback needs to verify the response. Call it before redirecting.

func (*Authenticator) ValidateState added in v0.244.3 

func (a *Authenticator) ValidateState(ctx context.Context, got string) error

ValidateState compares the state returned on the callback with the one stored in the session.

type Config 

type Config struct {
	Domain       string `koanf:"domain"       validate:"required"`
	MgmtDomain   string `koanf:"mgmtdomain"   validate:"required"`
	ClientID     string `koanf:"clientid"     validate:"required"`
	ClientSecret string `koanf:"clientsecret" validate:"required"`
	CallbackURL  string `koanf:"callbackurl"  validate:"required,url"`
	Audience     string `koanf:"audience"`
}

Config structure.

type Error added in v0.244.2 

type Error struct {
	ClientID string `form:"client_id"         json:"client_id"`
	Code     string `form:"error"             json:"error"`
	Message  string `form:"error_description" json:"error_description"`
	Tracking string `form:"tracking"          json:"tracking"`
}

Error is an error returned from Auth0 during user authorization.

func (*Error) Sanitise added in v0.244.2 

func (s *Error) Sanitise() error

func (Error) Validate added in v0.244.2 

func (e Error) Validate() error

type Manager added in v0.240.0 

type Manager struct {
	*client.Management
}

func (*Manager) ChangeUserPassword added in v0.240.0 

func (m *Manager) ChangeUserPassword(ctx context.Context, request *models.ChangePasswordRequest) error

ChangeUserPassword will perform a password change on behalf of a user.

func (*Manager) DeleteUser added in v0.240.0 

func (m *Manager) DeleteUser(ctx context.Context, id string) error

DeleteUser will delete the given user from the Auth0 backend.

func (*Manager) GetNewInactiveUsers added in v0.240.0 

func (m *Manager) GetNewInactiveUsers(ctx context.Context) ([]*UserData, error)

GetNewInactiveUsers returns all accounts created on the backend that haven't yet logged in to the app.

func (*Manager) GetUser added in v0.240.0 

func (m *Manager) GetUser(ctx context.Context, id string) (*UserData, error)

GetUser fetches the user with the given ID from Auth0.

func (*Manager) UpdateUser added in v0.240.0 

func (m *Manager) UpdateUser(ctx context.Context, update *UpdateUserData) error

UpdateUser updates user data in Auth0.

func (*Manager) UpdateUserCustomisation added in v0.240.0 

func (m *Manager) UpdateUserCustomisation(ctx context.Context, request *models.EditUserRequest) error

UpdateUserCustomisation writes local user customization changes back to the authorization service.

func (*Manager) UpdateUserMetadata added in v0.240.0 

func (m *Manager) UpdateUserMetadata(ctx context.Context, id string, key string, value any) error

UpdateUserMetadata updates the metadata associated with a user on the backend service.

type SessionManager added in v0.235.0 

type SessionManager interface {
	Get(ctx context.Context, key string) any
	Put(ctx context.Context, key string, value any)
	Remove(ctx context.Context, key string)
	RenewToken(ctx context.Context) error
}

SessionManager is the subset of the SCS session manager used by the authenticator.

type UpdateUserData added in v0.61.0 

type UpdateUserData struct {
	*management.UpdateUserRequestContent

	ID string
}

type UserData added in v0.47.0 

type UserData struct {
	*management.GetUserResponseContent
	*management.UserResponseSchema
}

type UserProfile 

type UserProfile struct {
	// URL of the server which issued this token.
	Issuer string `json:"iss" validate:"required,url"`
	// The client ID, or set of client IDs, that this token is issued for.
	Audience string `json:"aud" validate:"required"`
	// When the token was issued by the provider.
	IssuedAt int64 `json:"iat" validate:"required"`
	// Expiry of the token.
	Expiry int64 `json:"exp" validate:"required"`
	// A unique string which identifies the end user.
	Subject string `json:"sub" validate:"required"`
	// ID of the current session.
	SessionID string `json:"sid" validate:"required"`
	// The user's email address.
	Email string `json:"email" validate:"email"`
	// Indicates whether the user has verified their email address.
	EmailVerified bool `json:"email_verified"`
	// URL pointing to the user's profile picture.
	Picture string `json:"picture" validate:"omitempty,url"`
	// The user's family name.
	FamilyName string `json:"family_name"`
	// The user's family name.
	GivenName string `json:"given_name"`
	// The user's full name.
	Name string `json:"name"`
	// The user's nickname.
	Nickname string `json:"nickname"`
	// Timestamp indicating when the user's profile was last updated/modified.
	UpdatedAt string `json:"updated_at"`
	// LoginsCount is the number of times the user has logged in. If a user is blocked and logs in, the blocked session
	// is still counted. For a new user, this will be 1 as creating the account is counted as the first login.
	LoginsCount int64 `json:"logins_count" validate:"omitempty,gt=1"`
	// Blocked indicates whether the user has been blocked. Importing enables subscribers to ensure that users remain
	// blocked when migrating to Auth0.
	Blocked bool `json:"blocked"`
	// Custom fields that store info about a user that influences the user’s access, such as support plan, security
	// roles (if not using the Authorization Core feature set), or access control groups.
	AppMetadata map[string]any `json:"app_metadata"`
}

UserProfile represents the data returned from the auth0 backend that represents an authorised user. 

https://auth0.com/docs/manage-users/user-accounts/user-profiles/user-profile-structure

https://pkg.go.dev/github.com/coreos/go-oidc/v3@v3.15.0/oidc#IDToken

func (*UserProfile) GetEmail 

func (u *UserProfile) GetEmail() string

GetEmail returns the email address associated with the external user.

func (*UserProfile) GetID 

func (u *UserProfile) GetID() string

GetID returns a string that represents the ID of the external user.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.