controller

package
v0.42.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 6, 2025 License: MIT Imports: 46 Imported by: 0

Documentation

Index

Constants

View Source
const (
	In30Days   = 720 * time.Hour
	InAMonth   = 30 * 24 * time.Hour
	In5Minutes = 5 * time.Minute
)
View Source
const JWTContextKey = "nhost/auth/jwt"

Variables

View Source
var (
	ErrJWTConfiguration = errors.New("jwt-configuration")

	ErrAnonymousUsersDisabled          = &APIError{api.DisabledEndpoint}
	ErrUserEmailNotFound               = &APIError{api.InvalidEmailPassword}
	ErrUserPhoneNumberNotFound         = &APIError{api.InvalidRequest}
	ErrInvalidOTP                      = &APIError{api.InvalidRequest}
	ErrUserProviderNotFound            = &APIError{api.InvalidRequest}
	ErrSecurityKeyNotFound             = &APIError{api.InvalidRequest}
	ErrUserProviderAlreadyLinked       = &APIError{api.InvalidRequest}
	ErrEmailAlreadyInUse               = &APIError{api.EmailAlreadyInUse}
	ErrForbiddenAnonymous              = &APIError{api.ForbiddenAnonymous}
	ErrInternalServerError             = &APIError{api.InternalServerError}
	ErrInvalidEmailPassword            = &APIError{api.InvalidEmailPassword}
	ErrPasswordTooShort                = &APIError{api.PasswordTooShort}
	ErrPasswordInHibpDatabase          = &APIError{api.PasswordInHibpDatabase}
	ErrRoleNotAllowed                  = &APIError{api.RoleNotAllowed}
	ErrDefaultRoleMustBeInAllowedRoles = &APIError{api.DefaultRoleMustBeInAllowedRoles}
	ErrRedirecToNotAllowed             = &APIError{api.RedirectToNotAllowed}
	ErrDisabledUser                    = &APIError{api.DisabledUser}
	ErrUnverifiedUser                  = &APIError{api.UnverifiedUser}
	ErrUserNotAnonymous                = &APIError{api.UserNotAnonymous}
	ErrInvalidPat                      = &APIError{api.InvalidPat}
	ErrInvalidTicket                   = &APIError{api.InvalidTicket}
	ErrInvalidRequest                  = &APIError{api.InvalidRequest}
	ErrSignupDisabled                  = &APIError{api.SignupDisabled}
	ErrUnauthenticatedUser             = &APIError{api.InvalidRequest}
	ErrDisabledEndpoint                = &APIError{api.DisabledEndpoint}
	ErrEmailAlreadyVerified            = &APIError{api.EmailAlreadyVerified}
	ErrInvalidRefreshToken             = &APIError{api.InvalidRefreshToken}
	ErrDisabledMfaTotp                 = &APIError{api.DisabledMfaTotp}
	ErrNoTotpSecret                    = &APIError{api.NoTotpSecret}
	ErrInvalidTotp                     = &APIError{api.InvalidTotp}
	ErrMfaTypeNotFound                 = &APIError{api.MfaTypeNotFound}
	ErrTotpAlreadyActive               = &APIError{api.TotpAlreadyActive}
	ErrInvalidState                    = &APIError{api.InvalidState}
	ErrOauthTokenExchangeFailed        = &APIError{api.OauthTokenEchangeFailed}
	ErrOauthProfileFetchFailed         = &APIError{api.OauthProfileFetchFailed}
	ErrOauthProviderError              = &APIError{api.OauthProviderError}
	ErrCannotSendSMS                   = &APIError{api.CannotSendSms}
)
View Source
var ErrElevatedClaimRequired = errors.New("elevated-claim-required")

Functions

func GenLink(serverURL url.URL, typ LinkType, ticket, redirectTo string) (string, error)

func GravatarURLFunc

func GravatarURLFunc(enabled bool, def string, rating string) func(string) string

func ValidateEmail added in v0.28.0

func ValidateEmail(
	blockedEmailDomains []string,
	blockedEmails []string,
	allowedEmailDomains []string,
	allowedEmails []string,
) func(email string) bool

func ValidateRedirectTo

func ValidateRedirectTo(
	allowedRedirectURLs []string,
) (
	func(redirectTo string) bool,
	error,
)

Types

type APIError added in v0.28.0

type APIError struct {
	// contains filtered or unexported fields
}

func (*APIError) Error added in v0.28.0

func (e *APIError) Error() string

type Config

type Config struct {
	HasuraGraphqlURL            string        `json:"HASURA_GRAPHQL_GRAPHQL_URL"`
	HasuraAdminSecret           string        `json:"HASURA_GRAPHQL_ADMIN_SECRET"`
	AnonymousUsersEnabled       bool          `json:"AUTH_ANONYMOUS_USERS_ENABLED"`
	MfaEnabled                  bool          `json:"AUTH_MFA_ENABLED"`
	AllowedEmailDomains         stringlice    `json:"AUTH_ACCESS_CONTROL_ALLOWED_EMAIL_DOMAINS"`
	AllowedEmails               stringlice    `json:"AUTH_ACCESS_CONTROL_ALLOWED_EMAILS"`
	AllowedRedirectURLs         []string      `json:"AUTH_ACCESS_CONTROL_ALLOWED_REDIRECT_URLS"`
	BlockedEmailDomains         stringlice    `json:"AUTH_ACCESS_CONTROL_BLOCKED_EMAIL_DOMAINS"`
	BlockedEmails               stringlice    `json:"AUTH_ACCESS_CONTROL_BLOCKED_EMAILS"`
	ClientURL                   *url.URL      `json:"AUTH_CLIENT_URL"`
	CustomClaims                string        `json:"AUTH_JWT_CUSTOM_CLAIMS"`
	CustomClaimsDefaults        string        `json:"AUTH_JWT_CUSTOM_CLAIMS_DEFAULTS"`
	ConcealErrors               bool          `json:"AUTH_CONCEAL_ERRORS"`
	DisableSignup               bool          `json:"AUTH_DISABLE_SIGNUP"`
	DisableNewUsers             bool          `json:"AUTH_DISABLE_NEW_USERS"`
	DefaultAllowedRoles         []string      `json:"AUTH_DEFAULT_ALLOWED_ROLES"`
	DefaultRole                 string        `json:"AUTH_DEFAULT_ROLE"`
	DefaultLocale               string        `json:"AUTH_DEFAULT_LOCALE"`
	AllowedLocales              stringlice    `json:"AUTH_LOCALE_ALLOWED_LOCALES"`
	GravatarEnabled             bool          `json:"AUTH_GRAVATAR_ENABLED"`
	GravatarDefault             string        `json:"AUTH_GRAVATAR_DEFAULT"`
	GravatarRating              string        `json:"AUTH_GRAVATAR_RATING"`
	PasswordMinLength           int           `json:"AUTH_PASSWORD_MIN_LENGTH"`
	PasswordHIBPEnabled         bool          `json:"AUTH_PASSWORD_HIBP_ENABLED"`
	RefreshTokenExpiresIn       int           `json:"AUTH_REFRESH_TOKEN_EXPIRES_IN"`
	AccessTokenExpiresIn        int           `json:"AUTH_ACCESS_TOKEN_EXPIRES_IN"`
	JWTSecret                   string        `json:"HASURA_GRAPHQL_JWT_SECRET"`
	RequireEmailVerification    bool          `json:"AUTH_EMAIL_SIGNIN_EMAIL_VERIFIED_REQUIRED"`
	ServerURL                   *url.URL      `json:"AUTH_SERVER_URL"`
	EmailPasswordlessEnabled    bool          `json:"AUTH_EMAIL_PASSWORDLESS_ENABLED"`
	WebauthnEnabled             bool          `json:"AUTH_WEBAUTHN_ENABLED"`
	WebauthnRPID                string        `json:"AUTH_WEBAUTHN_RPID"`
	WebauthnRPName              string        `json:"AUTH_WEBAUTHN_RPNAME"`
	WebauthnRPOrigins           []string      `json:"AUTH_WEBAUTHN_RP_ORIGINS"`
	WebauhtnAttestationTimeout  time.Duration `json:"AUTH_WEBAUTHN_ATTESTATION_TIMEOUT"`
	OTPEmailEnabled             bool          `json:"AUTH_OTP_EMAIL_ENABLED"`
	SMSPasswordlessEnabled      bool          `json:"AUTH_SMS_PASSWORDLESS_ENABLED"`
	SMSProvider                 string        `json:"AUTH_SMS_PROVIDER"`
	SMSTwilioAccountSid         string        `json:"AUTH_SMS_TWILIO_ACCOUNT_SID"`
	SMSTwilioAuthToken          string        `json:"AUTH_SMS_TWILIO_AUTH_TOKEN"`
	SMSTwilioMessagingServiceID string        `json:"AUTH_SMS_TWILIO_MESSAGING_SERVICE_ID"`
	SMSModicaUsername           string        `json:"AUTH_SMS_MODICA_USERNAME"`
	SMSModicaPassword           string        `json:"AUTH_SMS_MODICA_PASSWORD"`
	ServerPrefix                string        `json:"AUTH_SERVER_PREFIX"`
}

func (*Config) UnmarshalJSON

func (c *Config) UnmarshalJSON(b []byte) error

func (*Config) UseSecureCookies added in v0.39.0

func (c *Config) UseSecureCookies() bool

type Controller

type Controller struct {
	Webauthn  *Webauthn
	Providers providers.Map
	// contains filtered or unexported fields
}

func New

func New(
	db DBClient,
	config Config,
	jwtGetter *JWTGetter,
	emailer Emailer,
	sms SMSer,
	hibp HIBPClient,
	providers providers.Map,
	idTokenValidator *oidc.IDTokenValidatorProviders,
	totp *Totp,
	version string,
) (*Controller, error)

func (*Controller) AddSecurityKey added in v0.40.2

func (*Controller) ChangeUserEmail added in v0.40.2

func (*Controller) ChangeUserMfa added in v0.40.2

func (*Controller) ChangeUserPassword added in v0.40.2

func (*Controller) CreatePAT added in v0.40.2

func (*Controller) DeanonymizeUser added in v0.40.2

func (*Controller) ElevateWebauthn added in v0.40.2

func (*Controller) GetJWKs added in v0.40.2

func (*Controller) GetUser added in v0.40.0

func (*Controller) GetVersion added in v0.28.0

func (*Controller) HealthCheckGet added in v0.40.2

func (*Controller) HealthCheckHead added in v0.40.2

func (*Controller) LinkIdToken added in v0.40.2

func (*Controller) PostChangeEnv

func (ctrl *Controller) PostChangeEnv(c *gin.Context)

func (*Controller) RefreshToken added in v0.40.2

func (*Controller) SendPasswordResetEmail added in v0.40.2

func (*Controller) SendVerificationEmail added in v0.40.2

func (*Controller) SignInAnonymous added in v0.40.2

func (*Controller) SignInEmailPassword added in v0.40.2

func (*Controller) SignInIdToken added in v0.40.2

func (*Controller) SignInOTPEmail added in v0.40.2

func (*Controller) SignInPAT added in v0.40.2

func (*Controller) SignInPasswordlessEmail added in v0.40.2

func (*Controller) SignInPasswordlessSms added in v0.40.2

func (*Controller) SignInProvider added in v0.40.2

func (*Controller) SignInProviderCallbackGet added in v0.40.2

func (*Controller) SignInProviderCallbackPost added in v0.40.2

func (*Controller) SignInWebauthn added in v0.40.2

func (*Controller) SignOut added in v0.40.2

func (*Controller) SignUpEmailPassword added in v0.40.2

func (*Controller) SignUpWebauthn added in v0.40.2

func (*Controller) VerifyAddSecurityKey added in v0.40.2

func (*Controller) VerifyChangeUserMfa added in v0.40.2

func (*Controller) VerifyElevateWebauthn added in v0.40.2

func (*Controller) VerifySignInMfaTotp added in v0.40.2

func (*Controller) VerifySignInOTPEmail added in v0.40.2

func (*Controller) VerifySignInPasswordlessSms added in v0.40.2

func (*Controller) VerifySignInWebauthn added in v0.40.2

func (*Controller) VerifySignInWebauthnUserHandle added in v0.40.2

func (ctrl *Controller) VerifySignInWebauthnUserHandle(
	ctx context.Context,
	response *protocol.ParsedCredentialAssertionData,
	logger *slog.Logger,
) webauthn.DiscoverableUserHandler

func (*Controller) VerifySignUpWebauthn added in v0.40.2

func (*Controller) VerifyTicket added in v0.40.2

func (*Controller) VerifyToken added in v0.40.2

type CustomClaimer

type CustomClaimer interface {
	GetClaims(ctx context.Context, userID string) (map[string]any, error)
}

type CustomClaims

type CustomClaims struct {
	// contains filtered or unexported fields
}

func NewCustomClaims

func NewCustomClaims(
	rawClaims map[string]string,
	httpclient *http.Client,
	graphqlURL string,
	defaults map[string]any,
	requestInterceptor ...RequestInterceptor,
) (*CustomClaims, error)

func (*CustomClaims) ExtractClaims

func (c *CustomClaims) ExtractClaims(data any) (map[string]any, error)

func (*CustomClaims) GetClaims

func (c *CustomClaims) GetClaims(ctx context.Context, userID string) (map[string]any, error)

func (*CustomClaims) GraphQLQuery

func (c *CustomClaims) GraphQLQuery() string

type DBClient

type DBClient interface {
	DBClientGetUser
	DBClientInsertUser
	DBClientUpdateUser
	DBClientUserProvider

	CountSecurityKeysUser(ctx context.Context, userID uuid.UUID) (int64, error)
	GetSecurityKeys(ctx context.Context, userID uuid.UUID) ([]sql.AuthUserSecurityKey, error)
	DeleteRefreshTokens(ctx context.Context, userID uuid.UUID) error
	DeleteRefreshToken(ctx context.Context, refreshTokenHash pgtype.Text) error
	DeleteUserRoles(ctx context.Context, userID uuid.UUID) error
	GetUserRoles(ctx context.Context, userID uuid.UUID) ([]sql.AuthUserRole, error)
	InsertRefreshtoken(ctx context.Context, arg sql.InsertRefreshtokenParams) (uuid.UUID, error)
	RefreshTokenAndGetUserRoles(
		ctx context.Context,
		arg sql.RefreshTokenAndGetUserRolesParams,
	) ([]sql.RefreshTokenAndGetUserRolesRow, error)
}

type DBClientGetUser added in v0.28.0

type DBClientGetUser interface {
	GetUser(ctx context.Context, id uuid.UUID) (sql.AuthUser, error)
	GetUserByEmail(ctx context.Context, email pgtype.Text) (sql.AuthUser, error)
	GetUserByPhoneNumber(ctx context.Context, phoneNumber pgtype.Text) (sql.AuthUser, error)
	GetUserByRefreshTokenHash(
		ctx context.Context, arg sql.GetUserByRefreshTokenHashParams,
	) (sql.AuthUser, error)
	GetUserByTicket(ctx context.Context, ticket pgtype.Text) (sql.AuthUser, error)
	GetUserByEmailAndTicket(
		ctx context.Context, arg sql.GetUserByEmailAndTicketParams,
	) (sql.AuthUser, error)
}

type DBClientInsertUser added in v0.28.0

type DBClientInsertUser interface {
	InsertUser(ctx context.Context, arg sql.InsertUserParams) (sql.InsertUserRow, error)
	InsertUserWithRefreshToken(
		ctx context.Context, arg sql.InsertUserWithRefreshTokenParams,
	) (sql.InsertUserWithRefreshTokenRow, error)
	InsertUserWithSecurityKeyAndRefreshToken(
		ctx context.Context,
		arg sql.InsertUserWithSecurityKeyAndRefreshTokenParams,
	) (sql.InsertUserWithSecurityKeyAndRefreshTokenRow, error)
}

type DBClientUpdateUser added in v0.28.0

type DBClientUpdateUser interface {
	UpdateUserChangeEmail(
		ctx context.Context,
		arg sql.UpdateUserChangeEmailParams,
	) (sql.AuthUser, error)
	UpdateUserDeanonymize(ctx context.Context, arg sql.UpdateUserDeanonymizeParams) error
	UpdateUserLastSeen(ctx context.Context, id uuid.UUID) (pgtype.Timestamptz, error)
	UpdateUserTicket(ctx context.Context, arg sql.UpdateUserTicketParams) (uuid.UUID, error)
	UpdateUserChangePassword(
		ctx context.Context, arg sql.UpdateUserChangePasswordParams,
	) (uuid.UUID, error)
	InsertUserWithSecurityKey(
		ctx context.Context, arg sql.InsertUserWithSecurityKeyParams,
	) (uuid.UUID, error)
	UpdateUserConfirmChangeEmail(ctx context.Context, id uuid.UUID) (sql.AuthUser, error)
	UpdateUserVerifyEmail(ctx context.Context, id uuid.UUID) (sql.AuthUser, error)
	UpdateUserTotpSecret(ctx context.Context, arg sql.UpdateUserTotpSecretParams) error
	UpdateUserActiveMFAType(ctx context.Context, arg sql.UpdateUserActiveMFATypeParams) error
	InsertSecurityKey(ctx context.Context, arg sql.InsertSecurityKeyParams) (uuid.UUID, error)
	UpdateUserOTPHash(ctx context.Context, arg sql.UpdateUserOTPHashParams) (uuid.UUID, error)
}

type DBClientUserProvider added in v0.35.0

type DBClientUserProvider interface {
	GetUserByProviderID(
		ctx context.Context, arg sql.GetUserByProviderIDParams,
	) (sql.AuthUser, error)
	FindUserProviderByProviderId(
		ctx context.Context, arg sql.FindUserProviderByProviderIdParams,
	) (sql.AuthUserProvider, error)
	InsertUserWithUserProvider(
		ctx context.Context, arg sql.InsertUserWithUserProviderParams,
	) (uuid.UUID, error)
	InsertUserWithUserProviderAndRefreshToken(
		ctx context.Context, arg sql.InsertUserWithUserProviderAndRefreshTokenParams,
	) (sql.InsertUserWithUserProviderAndRefreshTokenRow, error)
	InsertUserProvider(
		ctx context.Context, arg sql.InsertUserProviderParams,
	) (sql.AuthUserProvider, error)
}

type Emailer

type Emailer interface {
	SendEmail(
		ctx context.Context,
		to string,
		locale string,
		templateName notifications.TemplateName,
		data notifications.TemplateData,
	) error
}

type ErrorRedirectResponse added in v0.35.0

type ErrorRedirectResponse struct {
	Headers struct {
		Location string
	}
}

func (ErrorRedirectResponse) VisitSignInProviderCallbackGetResponse added in v0.40.2

func (response ErrorRedirectResponse) VisitSignInProviderCallbackGetResponse(
	w http.ResponseWriter,
) error

func (ErrorRedirectResponse) VisitSignInProviderCallbackPostResponse added in v0.40.2

func (response ErrorRedirectResponse) VisitSignInProviderCallbackPostResponse(
	w http.ResponseWriter,
) error

func (ErrorRedirectResponse) VisitSignInProviderResponse added in v0.40.2

func (response ErrorRedirectResponse) VisitSignInProviderResponse(
	w http.ResponseWriter,
) error

func (ErrorRedirectResponse) VisitVerifyTicketResponse added in v0.40.2

func (response ErrorRedirectResponse) VisitVerifyTicketResponse(w http.ResponseWriter) error

type ErrorResponse

type ErrorResponse api.ErrorResponse

func (ErrorResponse) VisitAddSecurityKeyResponse added in v0.40.2

func (response ErrorResponse) VisitAddSecurityKeyResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitChangeUserEmailResponse added in v0.40.2

func (response ErrorResponse) VisitChangeUserEmailResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitChangeUserMfaResponse added in v0.40.2

func (response ErrorResponse) VisitChangeUserMfaResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitChangeUserPasswordResponse added in v0.40.2

func (response ErrorResponse) VisitChangeUserPasswordResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitCreatePATResponse added in v0.40.2

func (response ErrorResponse) VisitCreatePATResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitDeanonymizeUserResponse added in v0.40.2

func (response ErrorResponse) VisitDeanonymizeUserResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitElevateWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitElevateWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitGetUserResponse added in v0.40.0

func (response ErrorResponse) VisitGetUserResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitLinkIdTokenResponse added in v0.40.2

func (response ErrorResponse) VisitLinkIdTokenResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitRefreshTokenResponse added in v0.40.2

func (response ErrorResponse) VisitRefreshTokenResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSendPasswordResetEmailResponse added in v0.40.2

func (response ErrorResponse) VisitSendPasswordResetEmailResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSendVerificationEmailResponse added in v0.40.2

func (response ErrorResponse) VisitSendVerificationEmailResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitSignInAnonymousResponse added in v0.40.2

func (response ErrorResponse) VisitSignInAnonymousResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInEmailPasswordResponse added in v0.40.2

func (response ErrorResponse) VisitSignInEmailPasswordResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInIdTokenResponse added in v0.40.2

func (response ErrorResponse) VisitSignInIdTokenResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitSignInOTPEmailResponse added in v0.40.2

func (response ErrorResponse) VisitSignInOTPEmailResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInPATResponse added in v0.40.2

func (response ErrorResponse) VisitSignInPATResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInPasswordlessEmailResponse added in v0.40.2

func (response ErrorResponse) VisitSignInPasswordlessEmailResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitSignInPasswordlessSmsResponse added in v0.40.2

func (response ErrorResponse) VisitSignInPasswordlessSmsResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInProviderCallbackGetResponse added in v0.40.2

func (response ErrorResponse) VisitSignInProviderCallbackGetResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitSignInProviderResponse added in v0.40.2

func (response ErrorResponse) VisitSignInProviderResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignInWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitSignInWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignOutResponse added in v0.40.2

func (response ErrorResponse) VisitSignOutResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignUpEmailPasswordResponse added in v0.40.2

func (response ErrorResponse) VisitSignUpEmailPasswordResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitSignUpWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitSignUpWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifyAddSecurityKeyResponse added in v0.40.2

func (response ErrorResponse) VisitVerifyAddSecurityKeyResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifyChangeUserMfaResponse added in v0.40.2

func (response ErrorResponse) VisitVerifyChangeUserMfaResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifyElevateWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitVerifyElevateWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifySignInMfaTotpResponse added in v0.40.2

func (response ErrorResponse) VisitVerifySignInMfaTotpResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifySignInOTPEmailResponse added in v0.40.2

func (response ErrorResponse) VisitVerifySignInOTPEmailResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifySignInPasswordlessSmsResponse added in v0.40.2

func (response ErrorResponse) VisitVerifySignInPasswordlessSmsResponse(
	w http.ResponseWriter,
) error

func (ErrorResponse) VisitVerifySignInWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitVerifySignInWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifySignUpWebauthnResponse added in v0.40.2

func (response ErrorResponse) VisitVerifySignUpWebauthnResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifyTicketResponse added in v0.40.2

func (response ErrorResponse) VisitVerifyTicketResponse(w http.ResponseWriter) error

func (ErrorResponse) VisitVerifyTokenResponse added in v0.40.2

func (response ErrorResponse) VisitVerifyTokenResponse(w http.ResponseWriter) error

type HIBPClient

type HIBPClient interface {
	IsPasswordPwned(ctx context.Context, password string) (bool, error)
}

type JWTGetter

type JWTGetter struct {
	// contains filtered or unexported fields
}

func NewJWTGetter

func NewJWTGetter(
	jwtSecretb []byte,
	accessTokenExpiresIn time.Duration,
	customClaimer CustomClaimer,
	elevatedClaimMode string,
	db DBClient,
) (*JWTGetter, error)

func (*JWTGetter) FromContext added in v0.28.0

func (j *JWTGetter) FromContext(ctx context.Context) (*jwt.Token, bool)

func (*JWTGetter) GetCustomClaim added in v0.28.0

func (j *JWTGetter) GetCustomClaim(token *jwt.Token, customClaim string) string

func (*JWTGetter) GetToken

func (j *JWTGetter) GetToken(
	ctx context.Context,
	userID uuid.UUID,
	isAnonymous bool,
	allowedRoles []string,
	defaultRole string,
	extraClaims map[string]any,
	logger *slog.Logger,
) (string, int64, error)

func (*JWTGetter) GetUserID added in v0.28.0

func (j *JWTGetter) GetUserID(token *jwt.Token) (uuid.UUID, error)

func (*JWTGetter) IsAnonymous added in v0.28.0

func (j *JWTGetter) IsAnonymous(token *jwt.Token) bool

func (*JWTGetter) MiddlewareFunc added in v0.28.0

func (j *JWTGetter) MiddlewareFunc(
	ctx context.Context, input *openapi3filter.AuthenticationInput,
) error

func (*JWTGetter) SignTokenWithClaims added in v0.39.0

func (j *JWTGetter) SignTokenWithClaims(
	claims jwt.MapClaims,
	exp time.Time,
) (string, error)

func (*JWTGetter) ToContext added in v0.28.0

func (j *JWTGetter) ToContext(ctx context.Context, jwtToken *jwt.Token) context.Context

func (*JWTGetter) Validate

func (j *JWTGetter) Validate(accessToken string) (*jwt.Token, error)

type JWTSecret

type JWTSecret struct {
	KeyID           string `json:"kid"`
	Key             any    `json:"key"`
	SigningKey      any    `json:"signing_key"`
	Type            string `json:"type"`
	Issuer          string `json:"issuer"`
	ClaimsNamespace string `json:"claims_namespace"`
}

type LinkType

type LinkType string
const (
	LinkTypeNone               LinkType = "none"
	LinkTypeEmailVerify        LinkType = "emailVerify"
	LinkTypeEmailConfirmChange LinkType = "emailConfirmChange"
	LinkTypePasswordlessEmail  LinkType = "signinPasswordless"
	LinkTypePasswordReset      LinkType = "passwordReset"
)

type RequestInterceptor

type RequestInterceptor func(*http.Request)

func CustomClaimerAddAdminSecret

func CustomClaimerAddAdminSecret(adminSecret string) RequestInterceptor

type SMSer added in v0.39.1

type SMSer interface {
	SendVerificationCode(ctx context.Context, to string, locale string) (string, time.Time, error)
	CheckVerificationCode(ctx context.Context, to string, code string) (sql.AuthUser, error)
}

type TicketType added in v0.28.0

type TicketType string
const (
	TicketTypeEmailConfirmChange TicketType = "emailConfirmChange"
	TicketTypePasswordLessEmail  TicketType = "passwordlessEmail"
	TicketTypeVerifyEmail        TicketType = "verifyEmail"
	TicketTypePasswordReset      TicketType = "passwordReset"
	TicketTypeOTP                TicketType = "otp"
)

type Totp added in v0.38.1

type Totp struct {
	// contains filtered or unexported fields
}

func NewTotp added in v0.38.1

func NewTotp(issuer string, timeGenerator func() time.Time) *Totp

func (*Totp) Generate added in v0.38.1

func (t *Totp) Generate(accountName string) (string, string, error)

func (*Totp) Validate added in v0.38.1

func (t *Totp) Validate(passcode string, secret string) bool

type Webauthn added in v0.28.0

type Webauthn struct {
	Storage map[string]WebauthnChallenge
	// contains filtered or unexported fields
}

func NewWebAuthn added in v0.28.0

func NewWebAuthn(config Config) (*Webauthn, error)

func (*Webauthn) BeginDiscoverableLogin added in v0.37.0

func (w *Webauthn) BeginDiscoverableLogin(
	ctx context.Context, logger *slog.Logger,
) (*protocol.CredentialAssertion, *APIError)

func (*Webauthn) BeginLogin added in v0.36.0

func (w *Webauthn) BeginLogin(
	ctx context.Context,
	user WebauthnUser,
	logger *slog.Logger,
) (*protocol.CredentialAssertion, *APIError)

func (*Webauthn) BeginRegistration added in v0.28.0

func (w *Webauthn) BeginRegistration(
	ctx context.Context,
	user WebauthnUser,
	options *api.SignUpOptions,
	logger *slog.Logger,
	opts ...webauthn.RegistrationOption,
) (*protocol.CredentialCreation, *APIError)

func (*Webauthn) FinishDiscoverableLogin added in v0.37.0

func (w *Webauthn) FinishDiscoverableLogin(
	ctx context.Context,
	response *protocol.ParsedCredentialAssertionData,
	userHandler webauthn.DiscoverableUserHandler,
	logger *slog.Logger,
) (*webauthn.Credential, WebauthnUser, *APIError)

func (*Webauthn) FinishLogin added in v0.36.0

func (*Webauthn) FinishRegistration added in v0.28.0

func (w *Webauthn) FinishRegistration(
	ctx context.Context,
	response *protocol.ParsedCredentialCreationData,
	logger *slog.Logger,
) (*webauthn.Credential, WebauthnUser, *APIError)

type WebauthnChallenge added in v0.28.0

type WebauthnChallenge struct {
	Session webauthn.SessionData
	User    WebauthnUser
	Options *api.SignUpOptions
}

type WebauthnUser added in v0.28.0

type WebauthnUser struct {
	ID           uuid.UUID
	Name         string
	Email        string
	Credentials  []webauthn.Credential
	Discoverable bool
}

func (WebauthnUser) WebAuthnCredentials added in v0.28.0

func (u WebauthnUser) WebAuthnCredentials() []webauthn.Credential

func (WebauthnUser) WebAuthnDisplayName added in v0.28.0

func (u WebauthnUser) WebAuthnDisplayName() string

func (WebauthnUser) WebAuthnID added in v0.28.0

func (u WebauthnUser) WebAuthnID() []byte

func (WebauthnUser) WebAuthnIcon added in v0.28.0

func (u WebauthnUser) WebAuthnIcon() string

func (WebauthnUser) WebAuthnName added in v0.28.0

func (u WebauthnUser) WebAuthnName() string

type Workflows added in v0.28.0

type Workflows struct {
	ValidateEmail func(email string) bool
	// contains filtered or unexported fields
}

func NewWorkflows added in v0.28.0

func NewWorkflows(
	cfg *Config,
	jwtGetter JWTGetter,
	db DBClient,
	hibp HIBPClient,
	email Emailer,
	sms SMSer,
	idTokenValidator *oidc.IDTokenValidatorProviders,
	gravatarURL func(string) string,
) (*Workflows, error)

func (*Workflows) ChangeEmail added in v0.28.0

func (wf *Workflows) ChangeEmail(
	ctx context.Context,
	userID uuid.UUID,
	newEmail string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) ChangePassword added in v0.34.0

func (wf *Workflows) ChangePassword(
	ctx context.Context,
	userID uuid.UUID,
	newPassword string,
	logger *slog.Logger,
) *APIError

func (*Workflows) DeanonymizeUser added in v0.28.0

func (wf *Workflows) DeanonymizeUser(
	ctx context.Context,
	userID uuid.UUID,
	email string,
	password string,
	ticket string,
	ticketExpiresAt time.Time,
	options *api.SignUpOptions,
	deleteRefreshTokens bool,
	logger *slog.Logger,
) *APIError

func (*Workflows) DeleteRefreshToken added in v0.40.0

func (wf *Workflows) DeleteRefreshToken(
	ctx context.Context,
	refreshToken string,
	logger *slog.Logger,
) *APIError

func (*Workflows) DeleteUserRefreshTokens added in v0.40.0

func (wf *Workflows) DeleteUserRefreshTokens(
	ctx context.Context,
	userID uuid.UUID,
	logger *slog.Logger,
) *APIError

func (*Workflows) GetJWTInContext added in v0.40.0

func (wf *Workflows) GetJWTInContext(
	ctx context.Context,
	logger *slog.Logger,
) (uuid.UUID, *APIError)

func (*Workflows) GetOIDCProfileFromIDToken added in v0.35.0

func (wf *Workflows) GetOIDCProfileFromIDToken(
	ctx context.Context,
	providerID api.IdTokenProvider,
	idToken string,
	pnonce *string,
	logger *slog.Logger,
) (oidc.Profile, *APIError)

func (*Workflows) GetUser added in v0.28.0

func (wf *Workflows) GetUser(
	ctx context.Context,
	id uuid.UUID,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByEmail added in v0.28.0

func (wf *Workflows) GetUserByEmail(
	ctx context.Context,
	email string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByEmailAndTicket added in v0.35.0

func (wf *Workflows) GetUserByEmailAndTicket(
	ctx context.Context,
	email string,
	ticket string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByPhoneNumber added in v0.39.1

func (wf *Workflows) GetUserByPhoneNumber(
	ctx context.Context,
	phoneNumber string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByProviderUserID added in v0.35.0

func (wf *Workflows) GetUserByProviderUserID(
	ctx context.Context,
	providerID string,
	providerUserID string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByRefreshTokenHash added in v0.28.0

func (wf *Workflows) GetUserByRefreshTokenHash(
	ctx context.Context,
	refreshToken string,
	refreshTokenType sql.RefreshTokenType,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserByTicket added in v0.34.0

func (wf *Workflows) GetUserByTicket(
	ctx context.Context,
	ticket string,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserFromJWTInContext added in v0.28.0

func (wf *Workflows) GetUserFromJWTInContext(
	ctx context.Context,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) GetUserSecurityKeys added in v0.36.0

func (wf *Workflows) GetUserSecurityKeys(
	ctx context.Context,
	userID uuid.UUID,
	logger *slog.Logger,
) ([]sql.AuthUserSecurityKey, *APIError)

func (*Workflows) InsertRefreshtoken added in v0.28.0

func (wf *Workflows) InsertRefreshtoken(
	ctx context.Context,
	userID uuid.UUID,
	refreshToken string,
	refreshTokenExpiresAt time.Time,
	refreshTokenType sql.RefreshTokenType,
	metadata map[string]any,
	logger *slog.Logger,
) (uuid.UUID, *APIError)

func (*Workflows) InsertUserProvider added in v0.35.0

func (wf *Workflows) InsertUserProvider(
	ctx context.Context,
	userID uuid.UUID,
	providerID string,
	providerUserID string,
	logger *slog.Logger,
) (sql.AuthUserProvider, *APIError)

func (*Workflows) NewSession added in v0.28.0

func (wf *Workflows) NewSession(
	ctx context.Context,
	user sql.AuthUser,
	customClaims map[string]any,
	logger *slog.Logger,
) (*api.Session, error)

func (*Workflows) SendEmail added in v0.28.0

func (wf *Workflows) SendEmail(
	ctx context.Context,
	to string,
	locale string,
	linkType LinkType,
	ticket string,
	redirectTo string,
	templateName notifications.TemplateName,
	displayName string,
	email string,
	newEmail string,
	logger *slog.Logger,
) *APIError

func (*Workflows) SetTicket added in v0.28.0

func (wf *Workflows) SetTicket(
	ctx context.Context,
	userID uuid.UUID,
	ticket string,
	expiresAt time.Time,
	logger *slog.Logger,
) *APIError

func (*Workflows) SignupAnonymousUser added in v0.38.0

func (wf *Workflows) SignupAnonymousUser(
	ctx context.Context,
	locale string,
	displayName string,
	reqMetadata map[string]any,
	logger *slog.Logger,
) (*api.Session, *APIError)

func (*Workflows) SignupUserWithFn added in v0.35.0

func (wf *Workflows) SignupUserWithFn(
	ctx context.Context,
	email string,
	options *api.SignUpOptions,
	sendConfirmationEmail bool,
	databaseWithSession databaseWithSessionFn,
	databaseWithoutSession databaseWithoutSessionFn,
	logger *slog.Logger,
) (*api.Session, *APIError)

func (*Workflows) SignupUserWithSession added in v0.35.0

func (wf *Workflows) SignupUserWithSession(
	ctx context.Context,
	email string,
	options *api.SignUpOptions,
	databaseWithUserSession databaseWithSessionFn,
	logger *slog.Logger,
) (*api.Session, *APIError)

func (*Workflows) SignupUserWithouthSession added in v0.35.0

func (wf *Workflows) SignupUserWithouthSession(
	ctx context.Context,
	email string,
	options *api.SignUpOptions,
	sendConfirmationEmail bool,
	databaseWithoutSession databaseWithoutSessionFn,
	logger *slog.Logger,
) *APIError

func (*Workflows) UpdateSession added in v0.29.0

func (wf *Workflows) UpdateSession(
	ctx context.Context,
	user sql.AuthUser,
	oldRefreshToken string,
	logger *slog.Logger,
) (*api.Session, *APIError)

func (*Workflows) UpdateUserConfirmChangeEmail added in v0.35.0

func (wf *Workflows) UpdateUserConfirmChangeEmail(
	ctx context.Context,
	userID uuid.UUID,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) UpdateUserVerifyEmail added in v0.35.0

func (wf *Workflows) UpdateUserVerifyEmail(
	ctx context.Context,
	userID uuid.UUID,
	logger *slog.Logger,
) (sql.AuthUser, *APIError)

func (*Workflows) UserByEmailExists added in v0.28.0

func (wf *Workflows) UserByEmailExists(
	ctx context.Context,
	email string,
	logger *slog.Logger,
) (bool, *APIError)

func (*Workflows) ValidateOptionsRedirectTo added in v0.28.0

func (wf *Workflows) ValidateOptionsRedirectTo(
	ctx context.Context,
	options *api.OptionsRedirectTo,
	logger *slog.Logger,
) (*api.OptionsRedirectTo, *APIError)

func (*Workflows) ValidatePassword added in v0.28.0

func (wf *Workflows) ValidatePassword(
	ctx context.Context, password string, logger *slog.Logger,
) *APIError

func (*Workflows) ValidateSignUpOptions added in v0.28.0

func (wf *Workflows) ValidateSignUpOptions(
	ctx context.Context, options *api.SignUpOptions, defaultName string, logger *slog.Logger,
) (*api.SignUpOptions, *APIError)

func (*Workflows) ValidateSignupEmail added in v0.28.0

func (wf *Workflows) ValidateSignupEmail(
	ctx context.Context, email types.Email, logger *slog.Logger,
) *APIError

func (*Workflows) ValidateUser added in v0.28.0

func (wf *Workflows) ValidateUser(
	ctx context.Context,
	user sql.AuthUser,
	logger *slog.Logger,
) *APIError

func (*Workflows) ValidateUserEmailOptional added in v0.39.0

func (wf *Workflows) ValidateUserEmailOptional(
	ctx context.Context,
	user sql.AuthUser,
	logger *slog.Logger,
) *APIError

func (*Workflows) VerifyJWTToken added in v0.40.0

func (wf *Workflows) VerifyJWTToken(
	ctx context.Context,
	token string,
	logger *slog.Logger,
) *APIError

Directories

Path Synopsis
Package mock is a generated GoMock package.
Package mock is a generated GoMock package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL