Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

user

package

Go to main page

Versions in this module

v0

v0.7.0

Oct 19, 2026

Changes in this version

+ var ErrNoMemberStore = errors.New("authit/user: switching teams needs Stores.Members")

+ var ErrNotTeamMember = errors.New("authit/user: not an active member of that team")

+ type LoginMethod string

+ const LoginMethodMagicLink

+ const LoginMethodOIDC

+ const LoginMethodPasskey

+ const LoginMethodSignInCode

+ func (m LoginMethod) ProvesEmail() bool

+ func (m LoginMethod) SatisfiesTwoFactor() bool

type Service

+ func (s *Service) IssueSession(ctx context.Context, userID string, method LoginMethod, ...) (AuthResult, error)

+ func (s *Service) SwitchTeam(ctx context.Context, sessionToken, teamID, userAgent, ipAddress string) (TokenPair, error)

type Session

+ TeamID string

type Stores

+ Members store.MemberStore

v0.6.0

Oct 19, 2026

v0.5.0

Oct 19, 2026

v0.4.0

Oct 19, 2026

Changes in this version

+ var ErrCurrentSessionRequired = errors.New("authit/user: the current session must be identified")

+ var ErrRateLimited = ratelimit.ErrRateLimited

+ var ErrWeakPassword = authitcrypto.ErrWeakPassword

+ var ErrWrongSessionMode = errors.New("authit/user: operation is not available in the configured session mode")

+ type AccountState struct

+ Email string

+ EmailVerified bool

+ Locked bool

+ Throttled bool

+ TwoFactor bool

type Config

+ Hooks Hooks

+ PasswordHasher authitcrypto.Hasher

+ PasswordValidator authitcrypto.PasswordValidator

+ RateLimiter ratelimit.Limiter

+ SessionMode SessionMode

+ SessionSlidingWindow time.Duration

+ type Hooks struct

+ AfterAuthenticate func(ctx context.Context, u store.User) error

+ AfterPasswordChange func(ctx context.Context, u store.User) error

+ AfterRegister func(ctx context.Context, u store.User) error

+ BeforeAuthenticate func(ctx context.Context, email string) error

+ BeforeRegister func(ctx context.Context, email string) error

type Service

+ func (s *Service) AccountState(ctx context.Context, userID string) (AccountState, error)

+ func (s *Service) ResetTwoFactor(ctx context.Context, operatorID, userID string) error

+ func (s *Service) RevokeAllSessions(ctx context.Context, operatorID, userID string) (int, error)

+ func (s *Service) SendPasswordReset(ctx context.Context, userID string) error

+ func (s *Service) SessionMode() SessionMode

+ func (s *Service) Unlock(ctx context.Context, operatorID, userID string) error

+ func (s *Service) ValidateSession(ctx context.Context, token string) (authitjwt.Claims, error)

+ type SessionMode int

+ const SessionModeJWT

+ const SessionModeOpaque

type Stores

+ Tx store.TxRunner

v0.3.0

Aug 26, 2026

Changes in this version

+ var ErrAccountLocked = errors.New("authit/user: account locked")

+ var ErrEmailNotVerified = errors.New("authit/user: email not verified")

+ var ErrEmailTaken = errors.New("authit/user: email already registered")

+ var ErrInvalidCredentials = errors.New("authit/user: invalid credentials")

+ var ErrInvalidToken = errors.New("authit/user: invalid or expired token")

+ var ErrInvalidTwoFactor = errors.New("authit/user: invalid two-factor code")

+ var ErrSessionNotFound = errors.New("authit/user: session not found")

+ var ErrTwoFactorEnabled = errors.New("authit/user: two-factor already enabled")

+ var ErrTwoFactorNotEnabled = errors.New("authit/user: two-factor not enabled")

+ var ErrTwoFactorRequired = errors.New("authit/user: two-factor code required")

+ type AuthResult struct

+ PendingTwoFactorToken string

+ RequiresTwoFactor bool

+ Tokens *TokenPair

+ User store.User

+ type Config struct

+ AccessTokenTTL time.Duration

+ AuditLogger audit.Logger

+ BackupCodeCount int

+ EmailVerification EmailVerificationPolicy

+ EmailVerificationTTL time.Duration

+ FailedLoginWindow time.Duration

+ MaxFailedLoginAttempts int

+ PasswordResetTTL time.Duration

+ PendingTwoFactorTTL time.Duration

+ RefreshTokenTTL time.Duration

+ TOTPEncryptionKey []byte

+ TOTPIssuer string

+ type EmailSender interface

+ SendEmailVerification func(ctx context.Context, email, token string) error

+ SendPasswordReset func(ctx context.Context, email, token string) error

+ type EmailVerificationPolicy int

+ const EmailVerificationOptional

+ const EmailVerificationRequired

+ type NoopEmailSender struct

+ func (NoopEmailSender) SendEmailVerification(ctx context.Context, email, token string) error

+ func (NoopEmailSender) SendPasswordReset(ctx context.Context, email, token string) error

+ type Service struct

+ func NewService(stores Stores, signer authitjwt.Signer, emailer EmailSender, cfg Config) (*Service, error)

+ func (s *Service) Authenticate(ctx context.Context, email, password, userAgent, ipAddress string) (AuthResult, error)

+ func (s *Service) BeginTwoFactorSetup(ctx context.Context, userID, accountEmail string) (TwoFactorSetup, error)

+ func (s *Service) ChangePassword(ctx context.Context, userID, currentPassword, newPassword string) error

+ func (s *Service) ConfirmTwoFactorSetup(ctx context.Context, userID, code string) (TwoFactorEnrollment, error)

+ func (s *Service) DisableTwoFactor(ctx context.Context, userID, code string) error

+ func (s *Service) ListSessions(ctx context.Context, userID, currentRefreshToken string) ([]Session, error)

+ func (s *Service) Logout(ctx context.Context, refreshToken string) error

+ func (s *Service) MarkEmailVerified(ctx context.Context, userID string) error

+ func (s *Service) Refresh(ctx context.Context, refreshToken, userAgent, ipAddress string) (TokenPair, error)

+ func (s *Service) RegenerateBackupCodes(ctx context.Context, userID, totpCode string) ([]string, error)

+ func (s *Service) Register(ctx context.Context, email, password string) (store.User, error)

+ func (s *Service) RequestEmailVerification(ctx context.Context, userID string) error

+ func (s *Service) RequestEmailVerificationByEmail(ctx context.Context, email string) error

+ func (s *Service) RequestPasswordReset(ctx context.Context, email string) error

+ func (s *Service) ResetPassword(ctx context.Context, rawToken, newPassword string) error

+ func (s *Service) RevokeOtherSessions(ctx context.Context, userID, currentRefreshToken string) error

+ func (s *Service) RevokeSession(ctx context.Context, userID, sessionID string) error

+ func (s *Service) TwoFactorStatus(ctx context.Context, userID string) (TwoFactorStatus, error)

+ func (s *Service) ValidatePasswordResetToken(ctx context.Context, rawToken string) error

+ func (s *Service) VerifyEmail(ctx context.Context, rawToken string) error

+ func (s *Service) VerifyTwoFactorLogin(ctx context.Context, pendingToken, code, userAgent, ipAddress string) (AuthResult, error)

+ type Session struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ IPAddress string

+ IsCurrent bool

+ UserAgent string

+ type Stores struct

+ EmailVerifications store.EmailVerificationStore

+ Lockouts store.LockoutStore

+ PasswordResets store.PasswordResetStore

+ PendingTwoFactor store.PendingTwoFactorStore

+ RefreshTokens store.RefreshTokenStore

+ TOTP store.TOTPStore

+ Users store.UserStore

+ type TokenPair struct

+ AccessToken string

+ ExpiresAt time.Time

+ RefreshToken string

+ type TwoFactorEnrollment struct

+ BackupCodes []string

+ type TwoFactorSetup struct

+ OTPAuthURL string

+ Secret string

+ type TwoFactorStatus struct

+ Enabled bool

+ RemainingBackupCodes int

+ VerifiedAt *time.Time

v0.2.0

Aug 25, 2026