Documentation
¶
Overview ¶
Package jwt provides authit's token signing/verification, kept deliberately free of any notion of users, sessions, or storage — it knows only how to turn claims into a signed string and back.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidSecret = errors.New("authit/jwt: secret must be at least 32 bytes")
ErrInvalidSecret is returned by NewHMACSigner when the secret is too short to be a safe HMAC-SHA256 key.
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
jwt.RegisteredClaims
Email string `json:"email,omitempty"`
// ActorID, when set, means this token was minted by an operator
// impersonating this Subject rather than the user logging in directly
// (see the superuser package's Impersonate). It carries no special
// privilege on its own — it exists purely so downstream audit/log code
// can record who was really acting.
ActorID string `json:"actor_id,omitempty"`
}
Claims is the default access-token claim set for regular users. Subject carries the user ID. Host applications that need extra fields (e.g. a team ID) can define their own struct embedding jwtlib.RegisteredClaims and sign it directly through Signer.Sign/Verify instead of using this type.
func (Claims) IsImpersonation ¶
IsImpersonation reports whether these claims were minted by an operator impersonating the subject rather than by the subject logging in themselves.
type Defaults ¶
Defaults are applied by Signer.Generate/Validate (the Claims-typed convenience methods); callers using Sign/Verify with a custom claims type apply them explicitly.
type HMACSigner ¶
type HMACSigner struct {
// contains filtered or unexported fields
}
HMACSigner is a Signer backed by HMAC-SHA256 with a shared secret.
func NewHMACSigner ¶
func NewHMACSigner(secret []byte, defaults Defaults) (*HMACSigner, error)
NewHMACSigner constructs an HMACSigner. secret must be at least 32 bytes.
func (*HMACSigner) Defaults ¶
func (s *HMACSigner) Defaults() Defaults
func (*HMACSigner) Generate ¶
func (s *HMACSigner) Generate(claims Claims) (string, error)
Generate signs claims after applying issuer/TTL defaults for any zero fields.
func (*HMACSigner) Sign ¶
func (s *HMACSigner) Sign(claims jwt.Claims) (string, error)
Sign signs an arbitrary claims value.
type Signer ¶
type Signer interface {
Sign(claims jwt.Claims) (string, error)
Verify(token string, dst jwt.Claims) error
Generate(claims Claims) (string, error)
Validate(token string) (Claims, error)
Defaults() Defaults
}
Signer signs and verifies JWTs. The generic Sign/Verify methods work with any jwt.Claims-satisfying type, so a host application can define its own claims struct (e.g. embedding a team ID) without authit needing to know about it. Generate/Validate are a convenience pair fixed to Claims.
Source Files