Documentation
¶
Overview ¶
Package auth holds what the admin HTTP layer and the GraphQL resolvers share: argon2id password hashing, admin permissions and the signed-in principal on a request context.
Index ¶
- Constants
- Variables
- func HashPassword(password string) (string, error)
- func ValidatePassword(password string) error
- func ValidatePermissions(perms []string) error
- func ValidateUsername(name string) error
- func VerifyPassword(hash, password string) bool
- func WithPrincipal(ctx context.Context, p Principal) context.Context
- type Principal
Constants ¶
View Source
const ( PermRead = "admin:read" PermWrite = "admin:write" PermPublish = "admin:publish" PermAccounts = "admin:accounts" PermAll = "admin:*" )
Admin permissions. PermAll grants every permission.
Variables ¶
View Source
var ( ErrForbidden = errors.New("admin: permission denied") ErrWeakPassword = errors.New("admin: password must be at least 12 characters") ErrBadPermission = errors.New("admin: unknown permission") ErrBadUsername = errors.New("admin: username must match [a-z0-9][a-z0-9_.-]{0,63}") )
Errors.
Functions ¶
func HashPassword ¶
HashPassword returns a PHC-encoded argon2id hash.
func ValidatePassword ¶
ValidatePassword enforces the minimum password length.
func ValidatePermissions ¶
ValidatePermissions rejects unknown or duplicate permissions.
func ValidateUsername ¶
ValidateUsername checks the account name charset.
func VerifyPassword ¶
VerifyPassword compares password with a PHC argon2id hash in constant time. An empty hash (unknown account) still spends one hash computation.
Types ¶
Source Files
Click to show internal directories.
Click to hide internal directories.