Documentation
¶
Overview ¶
Package localauth implements a built-in username/password auth provider.
Unlike the other auth providers, which are external binaries launched as daemons by the dispatcher, this provider runs in-process so that it can share Obot's database. It speaks the same HTTP protocol as the external providers (/oauth2/start, /oauth2/callback, /oauth2/sign_out, /obot-get-state, /obot-get-user-info), so the rest of the auth stack treats it like any other.
Index ¶
- Constants
- Variables
- func AuthProvider() *v1.AuthProvider
- func HashPassword(password string) (string, error)
- func VerifyPassword(encodedHash, password string) error
- type InvalidUserError
- type Provider
- func (p *Provider) CreateUser(ctx context.Context, email, password string) (*types.LocalAuthUser, error)
- func (p *Provider) DeleteUser(ctx context.Context, id uint) error
- func (p *Provider) EmailDomainAllowed(ctx context.Context, email string) (bool, error)
- func (p *Provider) GetUser(ctx context.Context, id uint) (*types.LocalAuthUser, error)
- func (p *Provider) SetPassword(ctx context.Context, id uint, password string) error
- func (p *Provider) Start(ctx context.Context) (url.URL, error)
- func (p *Provider) Users(ctx context.Context) ([]types.LocalAuthUser, error)
Constants ¶
const ( // ProviderName is the name of the AuthProvider resource for this provider. ProviderName = system.LocalAuthProvider // EmailDomainsEnvVar is the configuration parameter that restricts which email domains // can be used for local users. It matches the name used by the external auth providers. EmailDomainsEnvVar = "OBOT_AUTH_PROVIDER_EMAIL_DOMAINS" // LoginPath is the UI route that renders the login form. LoginPath = "/login/local" )
Variables ¶
var ( // ErrInvalidPassword is returned when a password does not match its hash. ErrInvalidPassword = errors.New("invalid password") )
Functions ¶
func AuthProvider ¶
func AuthProvider() *v1.AuthProvider
AuthProvider returns the AuthProvider resource for the built-in local auth provider. It has no Command: the dispatcher serves it from within the Obot process instead of launching a daemon for it.
func HashPassword ¶
HashPassword hashes a plaintext password with argon2id and returns it in the PHC string format, which carries the parameters and salt alongside the derived key.
func VerifyPassword ¶
VerifyPassword checks a plaintext password against a PHC-encoded argon2id hash. It returns ErrInvalidPassword if the password does not match.
Types ¶
type InvalidUserError ¶
type InvalidUserError struct {
// contains filtered or unexported fields
}
InvalidUserError is returned when a local user cannot be created or updated as requested. It is a user error, not a server error: the message is safe to return to the caller.
func (InvalidUserError) Error ¶
func (e InvalidUserError) Error() string
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
func (*Provider) CreateUser ¶
func (p *Provider) CreateUser(ctx context.Context, email, password string) (*types.LocalAuthUser, error)
CreateUser creates a local user with the given email and plaintext password.
func (*Provider) DeleteUser ¶
DeleteUser removes a local user and their sessions. It does not delete the Obot user that the local user logged in as: that is managed from the Users page like any other user.
func (*Provider) EmailDomainAllowed ¶
EmailDomainAllowed reports whether the given email is allowed by the provider's configured email domain restriction. An unconfigured provider allows nothing.
func (*Provider) SetPassword ¶
SetPassword sets a local user's password, which also signs them out everywhere.
Source Files