Documentation
¶
Overview ¶
Package auth holds what the admin HTTP layer and the GraphQL resolvers share: argon2id password hashing, admin permissions and the signed-in principal on a request context.
Index ¶
- Constants
- Variables
- func HashPassword(password string) (string, error)
- func ValidatePassword(password string) error
- func ValidatePermissions(perms []string) error
- func ValidateUsername(name string) error
- func VerifyPassword(hash, password string) bool
- func WithPrincipal(ctx context.Context, p Principal) context.Context
- type Principal
Constants ¶
const ( PermRead = "admin:read" PermWrite = "admin:write" PermPublish = "admin:publish" PermAccounts = "admin:accounts" PermAll = "admin:*" )
Admin permissions. PermAll grants every permission.
Variables ¶
var ( ErrForbidden = errors.New("admin: permission denied") ErrWeakPassword = errors.New("admin: password must be at least 12 characters") ErrBadPermission = errors.New("admin: unknown permission") ErrBadUsername = errors.New("admin: username must match [a-z0-9][a-z0-9_.-]{0,63}") )
Errors.
var ErrOutOfScope = errors.New("admin: outside the token's datasources")
ErrOutOfScope: the principal is limited to other datasources.
Functions ¶
func HashPassword ¶
HashPassword returns a PHC-encoded argon2id hash.
func ValidatePassword ¶
ValidatePassword enforces the minimum password length.
func ValidatePermissions ¶
ValidatePermissions rejects unknown or duplicate permissions.
func ValidateUsername ¶
ValidateUsername checks the account name charset.
func VerifyPassword ¶
VerifyPassword compares password with a PHC argon2id hash in constant time. An empty hash (unknown account) still spends one hash computation.
Types ¶
type Principal ¶
type Principal struct {
Username string
Permissions []string
// Datasources limits the principal to these datasources (a token's
// scope); nil does not limit it.
Datasources []string
}
Principal is the signed-in administrator of a request.
func PrincipalFrom ¶
PrincipalFrom returns the signed-in administrator.
func RequireDatasource ¶ added in v0.1.13
RequireDatasource returns the principal when it holds perm and may act on datasource.
func RequireUnlimited ¶ added in v0.1.13
RequireUnlimited returns the principal when it holds perm and is not limited to some datasources: what it reads spans every datasource.
func (Principal) Allows ¶ added in v0.1.13
Allows reports whether the principal may act on datasource.
Source Files