Documentation
¶
Overview ¶
Package authhandlers is an opt-in HTTP route group for authit's user plane: register, login, refresh, logout, password reset, email verification, two-factor auth, and session management, wired over the same user.Service a host would otherwise call directly.
It depends on nothing beyond net/http and authit itself — no router, no OpenAPI generator, no framework of any kind. NewUserHandler returns a plain http.Handler (a *http.ServeMux using Go 1.22's method+pattern routing), which a host mounts wherever it likes:
mux := http.NewServeMux()
mux.Handle("/auth/", http.StripPrefix("/auth", authhandlers.NewUserHandler(svc, signer)))
It is a separate module (its own go.mod) so that importing authit's core never pulls this in, and importing this never pulls anything beyond authit's core in turn — the same shape as sqlbstore.
Scope ¶
This package covers the user plane only. team, superuser, pat, and device are not wired here; a host that wants HTTP routes for those follows the same pattern (a thin http.Handler over the service) itself, or authhandlers grows a matching NewXHandler later.
What it does not do ¶
CORS, rate limiting, request logging, TLS, and routing beyond this handler's own subtree are the host's job — this package assumes it is mounted behind whatever the host already has. Protected routes (session management, password change, 2FA management) authenticate the caller by validating the request's bearer token with the same authitjwt.Signer the host's user.Service uses (via authithttp.Validate) and using claims.Subject as the user id; there is no cookie or CSRF handling.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewUserHandler ¶
NewUserHandler builds the user-plane route group. svc is a *user.Service the host has already constructed; signer must be the same authitjwt.Signer svc was given, since protected routes validate bearer tokens against it directly.
Public routes (no Authorization header required):
POST /register POST /login POST /login/two-factor POST /refresh POST /logout POST /password/reset-request POST /password/reset POST /email/verify POST /email/verification-request
Protected routes (Authorization: Bearer <access token>):
POST /password/change
POST /me/email/verification-request
GET /me/sessions
DELETE /me/sessions/{id}
POST /me/sessions/revoke-others
POST /me/two-factor/setup
POST /me/two-factor/confirm
POST /me/two-factor/disable
POST /me/two-factor/backup-codes/regenerate
GET /me/two-factor
Types ¶
type Option ¶
type Option func(*options)
Option configures NewUserHandler.
func WithIPExtractor ¶
WithIPExtractor overrides how the client IP recorded on login/refresh is read from a request — e.g. to trust X-Forwarded-For behind a reverse proxy. The default reads the host part of r.RemoteAddr, which is only correct for a directly-connected client.
type UserHandler ¶
type UserHandler struct {
// contains filtered or unexported fields
}
UserHandler serves authit's user-plane routes.
Source Files