emaillogin

type Config struct {
	// LinkTTL is how long a magic link stays valid. Defaults to 15
	// minutes. It is short because the link is a bearer credential sitting
	// in an inbox, and inboxes are forwarded, synced and breached.
	LinkTTL time.Duration
	// CodeTTL defaults to 10 minutes, shorter still: the shorter a
	// low-entropy credential is live, the less an attacker's guessing
	// budget is worth.
	CodeTTL time.Duration
	// CodeLength defaults to 6 digits. Raising it buys entropy that
	// MaxCodeAttempts mostly makes unnecessary, at the cost of a code
	// people mistype.
	CodeLength int
	// MaxCodeAttempts is how many wrong guesses destroy a code. Defaults
	// to 5.
	//
	// This is the control the whole flow rests on. Six digits is a million
	// possibilities; five guesses per code makes a hit a one-in-two-hundred-
	// thousand event, and requesting a fresh code costs an email and starts
	// again from zero. Without it the code is guessable in an afternoon.
	MaxCodeAttempts int
	// DisableSignUp refuses to create an account for an address that
	// matches no existing user. The default is to create one, which is
	// safe here because the account is created on redemption -- proof of
	// inbox control -- and not on request.
	DisableSignUp bool
	// RateLimiter throttles issuing either credential, and redeeming a
	// code. Nil means ratelimit.Noop. Keys:
	//
	//	email-login:request:<email>  a new link or code for an address
	//	email-login:redeem:<email>   a code redemption attempt
	//
	// Redeeming a magic link is deliberately not metered. There is nothing
	// to meter it on: the address is not known until the token resolves,
	// so there is no key before the lookup -- and a 256-bit token does not
	// need one, where six digits do.
	//
	// The request key bounds using this flow to flood somebody's inbox.
	// The redeem key is a second line behind MaxCodeAttempts, bounding an
	// attacker who burns codes and requests fresh ones.
	RateLimiter ratelimit.Limiter
	// AuditLogger receives request and redemption events.
	AuditLogger audit.Logger
}

type NoopSender struct{}

type Result struct {
	// User is the account this sign-in resolved to.
	User store.User
	// CreatedUser reports whether redeeming created the account, so a host
	// can run its own onboarding.
	CreatedUser bool
}

type Sender interface {
	SendMagicLink(ctx context.Context, email, token string) error
	SendSignInCode(ctx context.Context, email, code string) error
}

type Service struct {
	// contains filtered or unexported fields
}

type Stores struct {
	Users  store.UserStore
	Tokens store.EmailLoginStore
	// Tx is optional; see store.TxRunner. With it, creating an account and
	// consuming the token that authorised it are atomic.
	Tx store.TxRunner
}