auth

Aug 7, 2026

Changes in this version

+ const MinPasswordLength

+ var ErrClonedAuthenticator = errors.New("auth: this passkey's counter went backwards")

+ var ErrEnrollmentStale = errors.New(...)

+ var ErrLastFactor = store.ErrLastFactor

+ var ErrNoPasskeys = errors.New("auth: this account has no passkeys")

+ var ErrPasskeyUnavailable = errors.New("auth: passkeys need HTTPS (or localhost)")

+ var ErrPasswordlessNotAllowed = errors.New("auth: this account must sign in with its password")

+ var ErrTooBusy = errors.New("auth: too many sign-ins in flight, try again")

+ var ErrTooManyFactors = errors.New("auth: this account already has the maximum number of authenticators")

+ var ErrUserVerificationRequired = errors.New("auth: this passkey did not verify who you are; use your password")

+ func MapsRoles(cfg store.LDAPConfig) bool

+ func MatchTOTP(code, secret string) (counter int64, ok bool)

+ func RolesForGroups(cfg store.LDAPConfig, groups []string) []int64

+ func StepUpKey(userID int64, sessionID string) string

type Claims

+ Epoch int64

+ type Issued struct

+ ExpiresAt time.Time

+ ID string

+ Token string

type LDAPResult

+ Email string

+ type PasswordlessError struct

+ Err error

+ Username string

+ func (e *PasswordlessError) Error() string

+ func (e *PasswordlessError) Unwrap() error

+ type RelyingParty struct

+ DisplayName string

+ ID string

+ Origin string

type Service

+ func (s *Service) BeginPasskeyLogin(ctx context.Context, rp RelyingParty, challengeToken string) (*protocol.CredentialAssertion, error)

+ func (s *Service) BeginPasskeyRegistration(ctx context.Context, rp RelyingParty, userID int64, stepUp bool) (*protocol.CredentialCreation, error)

+ func (s *Service) BeginPasswordlessLogin(rlKey string, rp RelyingParty) (*protocol.CredentialAssertion, string, error)

+ func (s *Service) ChallengeUsername(challengeToken string) string

+ func (s *Service) FinishPasskeyLogin(ctx context.Context, rp RelyingParty, rlKey, challengeToken string, ...) (*LoginResult, error)

+ func (s *Service) FinishPasskeyRegistration(ctx context.Context, rp RelyingParty, userID int64, name string, ...) error

+ func (s *Service) FinishPasswordlessLogin(ctx context.Context, rp RelyingParty, rlKey, ceremonyID string, ...) (*LoginResult, error)

+ func (s *Service) HasPasskeys(ctx context.Context, userID int64) (bool, error)

+ func (s *Service) ListFactors(ctx context.Context, userID int64) ([]store.AuthFactor, error)

+ func (s *Service) RemoveFactor(ctx context.Context, userID, factorID int64) error

+ func (s *Service) VerifyUserPassword(ctx context.Context, rlKey string, u *store.User, password string) error

+ type SessionEpochSource interface

+ SessionEpoch func(ctx context.Context, userID int64) (int64, error)

+ SessionExists func(ctx context.Context, id string, userID int64) (bool, error)

+ TouchSession func(ctx context.Context, id string) error

+ type SessionInfo struct

+ IP string

+ UserAgent string

Jun 16, 2026

Changes in this version

+ func SectionsForGroups(cfg store.LDAPConfig, groups []string) []string

+ func WithClaims(ctx context.Context, c *Claims) context.Context

type LDAPResult

+ Groups []string

Jun 2, 2026

Changes in this version

+ const SessionCookie

+ const TOTPIssuer

+ var ErrInvalidCreds = errors.New("auth: invalid credentials")

+ var ErrInvalidHash = errors.New("auth: invalid password hash format")

+ var ErrInvalidMFACode = errors.New("auth: invalid 2fa code")

+ var ErrInvalidUsername = errors.New("auth: username must be 3-32 characters")

+ var ErrMFARequired = errors.New("auth: 2fa code required")

+ var ErrRateLimited = errors.New("auth: too many attempts, try again later")

+ var ErrSetupDone = errors.New("auth: setup already completed")

+ var ErrWeakPassword = errors.New("auth: password must be at least 10 characters")

+ func HashPassword(password string) (string, error)

+ func LDAPTest(cfg store.LDAPConfig) (int, error)

+ func ValidateTOTP(code, secret string) bool

+ func VerifyPassword(password, encoded string) (bool, error)

+ type Claims struct

+ Kind TokenKind

+ Role string

+ UserID int64

+ Username string

+ func ClaimsFrom(ctx context.Context) (*Claims, bool)

+ type Enrollment struct

+ OtpauthURL string

+ QRDataURI string

+ Secret string

+ func GenerateTOTP(accountName string) (*Enrollment, error)

+ type LDAPResult struct

+ IsAdmin bool

+ Username string

+ func LDAPAuthenticate(cfg store.LDAPConfig, username, password string) (*LDAPResult, error)

+ type LoginLimiter struct

+ func NewLoginLimiter(max int, window time.Duration) *LoginLimiter

+ func (l *LoginLimiter) Allow(key string) bool

+ func (l *LoginLimiter) Fail(key string)

+ func (l *LoginLimiter) Reset(key string)

+ type LoginResult struct

+ ExpiresAt time.Time

+ MFARequired bool

+ Token string

+ User *store.User

+ type Middleware struct

+ func NewMiddleware(tokens *TokenManager) *Middleware

+ func (m *Middleware) ParseSessionToken(raw string) (*Claims, error)

+ func (m *Middleware) RequireSession(next http.Handler) http.Handler

+ type Service struct

+ func NewService(s *store.Store, tm *TokenManager) *Service

+ func (s *Service) BeginTOTPEnrollment(ctx context.Context, userID int64) (*Enrollment, error)

+ func (s *Service) ConfirmTOTPEnrollment(ctx context.Context, userID int64, code string) error

+ func (s *Service) CreateAccount(ctx context.Context, username, password, role string, readOnly bool, ...) (*store.User, error)

+ func (s *Service) Login(ctx context.Context, rlKey, username, password string, exemptMFA bool) (*LoginResult, error)

+ func (s *Service) NeedsSetup(ctx context.Context) (bool, error)

+ func (s *Service) SetPassword(ctx context.Context, userID int64, password string) error

+ func (s *Service) Setup(ctx context.Context, username, password string) (*store.User, error)

+ func (s *Service) VerifyMFA(ctx context.Context, challengeToken, code string) (*LoginResult, error)

+ type TokenKind string

+ const KindMFAChallenge

+ const KindSession

+ type TokenManager struct

+ func NewTokenManager(secret []byte, sessionTTL time.Duration) *TokenManager

+ func (m *TokenManager) Issue(userID int64, username, role string, kind TokenKind) (string, time.Time, error)

+ func (m *TokenManager) Parse(tokenString string) (*Claims, error)