Documentation
¶
Index ¶
- Constants
- Variables
- func ChangePassword(gdb *gorm.DB, userID uint, oldPass, newPass string) error
- func ShemsAdd(gdb *gorm.DB, name string) error
- func ShemsAddOrUpdate(gdb *gorm.DB, name, key string) error
- func ShemsRemove(gdb *gorm.DB, name string) error
- func UsersAdd(gdb *gorm.DB, username, role string) error
- func UsersAddOrUpdate(gdb *gorm.DB, username, password, role string) error
- func UsersList(gdb *gorm.DB) ([]db.User, error)
- func UsersRemove(gdb *gorm.DB, username string) error
- func UsersSetRole(gdb *gorm.DB, username, role string) error
- func ValidatePassword(pass string) error
Constants ¶
const MinPasswordLen = 8
MinPasswordLen is the minimum accepted password length, enforced at every entry point (CLI, HTTP form, GOLEM_ADMIN_PASSWORD env var).
Variables ¶
var ErrLastAdmin = errors.New("refusing to leave the orchestrator with no admin user")
ErrLastAdmin is returned when an operation would leave the orchestrator with no admin user.
var ErrUnknownRole = errors.New("unknown role")
ErrUnknownRole is returned when a role string is not a known rbac role.
var ErrWeakPassword = errors.New("password too weak")
ErrWeakPassword is returned when a password fails ValidatePassword.
var ErrWrongPassword = errors.New("current password is incorrect")
ErrWrongPassword is returned when a change-password call presents an old password that does not match the stored hash.
Functions ¶
func ChangePassword ¶ added in v0.0.3
ChangePassword replaces the given user's password hash after verifying the old password. Sessions are not revoked so the caller stays signed in on the device they used to change it; a separate "sign out everywhere" is a future feature. Returns ErrWrongPassword if oldPass does not match, or ErrWeakPassword if newPass fails ValidatePassword.
func ShemsAdd ¶
ShemsAdd generates a random 32-byte hex API key, stores its bcrypt hash, and prints the raw key once to stdout.
func ShemsAddOrUpdate ¶
ShemsAddOrUpdate creates a shem with the given name and API key, or updates its key hash if the shem already exists. Used for env-var-based auto-setup.
func ShemsRemove ¶
ShemsRemove hard-deletes the shem with the given name.
func UsersAdd ¶
UsersAdd prompts for a password (or reads GOLEM_ADMIN_PASSWORD), bcrypt-hashes it, and inserts a new User with the given role. The env var allows non-interactive use in Docker.
func UsersAddOrUpdate ¶
UsersAddOrUpdate creates a user with the given username, password and role, or updates the password hash and role if the user already exists.
func UsersRemove ¶
UsersRemove hard-deletes the user with the given username along with all their sessions, so their access is revoked immediately. It refuses to remove the last admin, and reports an error if the user does not exist.
func UsersSetRole ¶ added in v0.0.3
UsersSetRole changes a user's role, refusing to demote the last admin.
func ValidatePassword ¶ added in v0.0.3
ValidatePassword returns ErrWeakPassword if pass is unacceptable. Keep this the single source of truth so the UI, CLI, and env-var seed can't drift.
Types ¶
This section is empty.
Source Files