authhttp

package

Go to main page

Versions in this module

v0

v0.59.0

Jun 23, 2026

v0.58.0

Jun 23, 2026

v0.57.0

Jun 23, 2026

v0.56.2

Jun 23, 2026

v0.56.0

Jun 23, 2026

Changes in this version

+ const RLPasskeyLogin

+ const RLPasskeyRegister

type ErrorCode

+ const ErrPasskeyFailed

+ type RemoteApplicationIssuerRegistration struct

+ AllowedOrigins []string

+ Issuer string

+ JWKSURI string

+ PublicKeys []core.RemoteAppKey

+ Slug string

+ type RemoteApplicationIssuersClient struct

+ func NewRemoteApplicationIssuersClient(opts ...RemoteApplicationIssuersClientOption) *RemoteApplicationIssuersClient

+ func (fc *RemoteApplicationIssuersClient) RegisterIssuer(ctx context.Context, acceptURL string, reg RemoteApplicationIssuerRegistration) error

+ type RemoteApplicationIssuersClientOption func(*RemoteApplicationIssuersClient)

+ func WithRemoteApplicationIssuersAuthToken(token string) RemoteApplicationIssuersClientOption

+ func WithRemoteApplicationIssuersHTTPClient(c *http.Client) RemoteApplicationIssuersClientOption

type RouteGroup

+ const RoutePasskeys

v0.54.1

Jun 23, 2026

v0.54.0

Jun 23, 2026

Changes in this version

+ const RLUserPreferredLanguage

+ var Sensitive = verify.Sensitive

+ var SensitiveClaims = verify.SensitiveClaims

type ErrorCode

+ const ErrFailedToUpdatePreferredLanguage

+ const ErrInvalidPreferredLanguage

+ const ErrPreferredLanguageLookupFailed

+ const ErrTwoFAEnrollmentRequired

+ const ErrUserRecoverFailed

type RouteGroup

+ const RouteBrowserOIDC

+ const RoutePublic

+ const RouteSession

+ type SensitiveOptions = verify.SensitiveOptions

v0.53.0

Jun 23, 2026

Changes in this version

+ const RL2FAStartTOTP

v0.52.0

Jun 23, 2026

Changes in this version

+ var RequireACR = verify.RequireACR

+ var RequireAMR = verify.RequireAMR

+ var RequireFreshAuth = verify.RequireFreshAuth

+ var RequireMFA = verify.RequireMFA

v0.51.0

Jun 23, 2026

v0.50.0

Jun 22, 2026

v0.49.0

Jun 22, 2026

Changes in this version

type RouteGroup

+ const RoutePermissionGroups

type Routes

+ func (r Routes) PermissionGroups() []RouteSpec

type Service

+ func (s *Service) PermissionGroupRoutes() []RouteSpec

v0.48.0

Jun 22, 2026

Changes in this version

type Service

+ func (s *Service) SetEntitlementsProvider(p core.EntitlementsProvider)

v0.47.0

Jun 22, 2026

Changes in this version

type Option

+ func WithResourceScopeAuthorizer(fn core.ResourceScopeAuthorizer) Option

+ func WithSolanaSNSResolver(r core.SolanaSNSResolver) Option

v0.46.0

Jun 22, 2026

Changes in this version

+ type ErrorCode string

+ const ErrAbandonFailed

+ const ErrAccessTokenCreateFailed

+ const ErrAccessTokenListFailed

+ const ErrAccessTokenNotFound

+ const ErrAccessTokenRevokeFailed

+ const ErrAccountAlreadyClaimed

+ const ErrAccountClaimOrgFailed

+ const ErrAccountClaimUserFailed

+ const ErrAccountExistsLinkRequired

+ const ErrAccountParkFailed

+ const ErrAccountRestrictFailed

+ const ErrAccountUnrestrictFailed

+ const ErrAddMemberFailed

+ const ErrAddressMismatch

+ const ErrAddressRequired

+ const ErrAssignPlatformRoleFailed

+ const ErrAssignRoleFailed

+ const ErrAttributeDefNotFound

+ const ErrAttributeDefRegisterFailed

+ const ErrAttributeDefResolveFailed

+ const ErrAuthRequiredForLink

+ const ErrAuthenticationFailed

+ const ErrAuthenticationRequired

+ const ErrAuthkitNotInitialized

+ const ErrAuthlogUnavailable

+ const ErrCancelFailed

+ const ErrCannotRemoveLastOwner

+ const ErrCannotRemovePersonalOrgOwner

+ const ErrCannotUnlinkLastLoginMethod

+ const ErrChallengeExpired

+ const ErrChallengeFailed

+ const ErrChallengeVerifyFailed

+ const ErrDatabaseError

+ const ErrDefineRoleFailed

+ const ErrDeleteRoleFailed

+ const ErrDisableTwoFAFailed

+ const ErrDuplicateResource

+ const ErrEmailAlreadyVerified

+ const ErrEmailDeliveryFailed

+ const ErrEmailInUse

+ const ErrEmailNotVerified

+ const ErrEmailPasswordResetUnavailable

+ const ErrEmailRegistrationUnavailable

+ const ErrEmailSenderUnavailable

+ const ErrEmailUnavailable

+ const ErrEmailUnchanged

+ const ErrEmailVerificationFailed

+ const ErrEmailVerificationUnavailable

+ const ErrEnableTwoFAFailed

+ const ErrEntitlementFilterUnavailable

+ const ErrExchangeFailed

+ const ErrFailedToBan

+ const ErrFailedToDelete

+ const ErrFailedToList

+ const ErrFailedToListDeletedUsers

+ const ErrFailedToListSignins

+ const ErrFailedToListUsers

+ const ErrFailedToLogout

+ const ErrFailedToRequestEmailChange

+ const ErrFailedToRequestPhoneChange

+ const ErrFailedToRestoreUser

+ const ErrFailedToRevoke

+ const ErrFailedToRevokeAll

+ const ErrFailedToRevokeSessions

+ const ErrFailedToSetPassword

+ const ErrFailedToUnban

+ const ErrFailedToUnlink

+ const ErrFailedToUpdateBiography

+ const ErrFailedToUpdateEmail

+ const ErrFailedToUpdatePreferredLocale

+ const ErrFailedToUpdateUsername

+ const ErrForbidden

+ const ErrHashFailed

+ const ErrInvalidAddress

+ const ErrInvalidAllowedOrigins

+ const ErrInvalidBaseURL

+ const ErrInvalidChallenge

+ const ErrInvalidCode

+ const ErrInvalidCredentials

+ const ErrInvalidDefinition

+ const ErrInvalidEmail

+ const ErrInvalidExpiresAt

+ const ErrInvalidExpiry

+ const ErrInvalidFederationIssuer

+ const ErrInvalidFederationTrustSource

+ const ErrInvalidIdentifier

+ const ErrInvalidMessageEncoding

+ const ErrInvalidMethod

+ const ErrInvalidOrExpiredCode

+ const ErrInvalidOrExpiredResetSession

+ const ErrInvalidOrExpiredToken

+ const ErrInvalidOrgOwner

+ const ErrInvalidOrgSlug

+ const ErrInvalidOwnerNamespaceTransition

+ const ErrInvalidPassword

+ const ErrInvalidPhoneNumber

+ const ErrInvalidPreferredLocale

+ const ErrInvalidProvider

+ const ErrInvalidRefreshToken

+ const ErrInvalidRequest

+ const ErrInvalidResource

+ const ErrInvalidRole

+ const ErrInvalidSignature

+ const ErrInvalidSignatureEncoding

+ const ErrInvalidSlug

+ const ErrInvalidState

+ const ErrInvalidToken

+ const ErrInvalidTrustSource

+ const ErrInvalidUI

+ const ErrInvalidUntil

+ const ErrInvalidVersion

+ const ErrInviteNotFound

+ const ErrIssuerOwnedByOtherOrg

+ const ErrIssuerReserved

+ const ErrLinkFailed

+ const ErrMemberPermissionsLookupFailed

+ const ErrMemberRolesLookupFailed

+ const ErrMissingFields

+ const ErrMissingName

+ const ErrMissingRole

+ const ErrMissingSessionID

+ const ErrMissingSidClaim

+ const ErrNoEmail

+ const ErrNoPendingEmailChange

+ const ErrNoPendingPhoneChange

+ const ErrNotAuthenticated

+ const ErrNotFound

+ const ErrNotOrgMember

+ const ErrOIDCBeginFailed

+ const ErrOIDCExchangeFailed

+ const ErrOrgAlreadyClaimed

+ const ErrOrgCreateFailed

+ const ErrOrgDetailFailed

+ const ErrOrgInviteAcceptFailed

+ const ErrOrgInviteCreateFailed

+ const ErrOrgInviteDeclineFailed

+ const ErrOrgInviteExpired

+ const ErrOrgInviteNotPending

+ const ErrOrgInviteRevokeFailed

+ const ErrOrgInvitesLookupFailed

+ const ErrOrgLimitExceeded

+ const ErrOrgLookupFailed

+ const ErrOrgManagementDisabled

+ const ErrOrgMembershipLookupFailed

+ const ErrOrgMembershipsLookupFailed

+ const ErrOrgNotFound

+ const ErrOrgRecoverFailed

+ const ErrOrgRenameFailed

+ const ErrOrgRestoreFailed

+ const ErrOrgRolesLookupFailed

+ const ErrOrgSoftDeleteFailed

+ const ErrOrgTransferOwnerFailed

+ const ErrOrgsListFailed

+ const ErrOrgsLookupFailed

+ const ErrOwnerMembershipRequired

+ const ErrOwnerNamespaceInfoFailed

+ const ErrOwnerSlugTaken

+ const ErrOwnerUserNotFound

+ const ErrPKCEGenerationFailed

+ const ErrPasswordChangeFailed

+ const ErrPasswordResetRequestFailed

+ const ErrPasswordResetRequired

+ const ErrPasswordTooShort

+ const ErrPendingRegistrationNotFound

+ const ErrPermissionCheckFailed

+ const ErrPermissionGrantDenied

+ const ErrPermissionValidateFailed

+ const ErrPermissionsLookupFailed

+ const ErrPersonalOrgLocked

+ const ErrPersonalOrgLookupFailed

+ const ErrPhoneAlreadyVerified

+ const ErrPhoneAndCodeRequired

+ const ErrPhoneChangeUnavailable

+ const ErrPhoneInUse

+ const ErrPhoneNotVerified

+ const ErrPhoneNumberMustBeE164

+ const ErrPhoneRegistrationUnavailable

+ const ErrPhoneTwoFAUnavailable

+ const ErrPhoneUnavailable

+ const ErrPhoneUnchanged

+ const ErrPhoneVerificationFailed

+ const ErrPhoneVerificationUnavailable

+ const ErrPlatformPermissionLookupFailed

+ const ErrPlatformPermissionsLookupFailed

+ const ErrPlatformRoleDefineFailed

+ const ErrPlatformRoleDeleteFailed

+ const ErrPlatformRoleLookupFailed

+ const ErrPlatformRoleMembersFailed

+ const ErrPlatformRoleSetPermsFailed

+ const ErrPlatformRolesListFailed

+ const ErrPreferredLocaleLookupFailed

+ const ErrProtectedRole

+ const ErrProviderAlreadyLinked

+ const ErrProviderLinkFailed

+ const ErrProviderNotLinked

+ const ErrRateLimited

+ const ErrReauthFailed

+ const ErrReauthRequired

+ const ErrRegenerateCodesFailed

+ const ErrRegistrationDisabled

+ const ErrRegistrationFailed

+ const ErrRemoteApplicationDeleteFailed

+ const ErrRemoteApplicationLookupFailed

+ const ErrRemoteApplicationMembershipFailed

+ const ErrRemoteApplicationNotFound

+ const ErrRemoteApplicationOwnerLookupFailed

+ const ErrRemoteApplicationRegisterFailed

+ const ErrRemoveMemberFailed

+ const ErrRenameRateLimited

+ const ErrResendFailed

+ const ErrReservedAccountNotFound

+ const ErrResourceScopeDenied

+ const ErrRevokePlatformRoleFailed

+ const ErrRoleExceedsGrantor

+ const ErrRoleNotFound

+ const ErrRoleNotGrantableToAPIKey

+ const ErrRolePermissionsLookupFailed

+ const ErrRolePermissionsUpdateFailed

+ const ErrSMSDeliveryFailed

+ const ErrSMSUnavailable

+ const ErrSendCodeFailed

+ const ErrSessionCreationFailed

+ const ErrSessionIssueFailed

+ const ErrStateStoreFailed

+ const ErrTokenCreationFailed

+ const ErrTokenIssueFailed

+ const ErrTwoFAChallengeFailed

+ const ErrTwoFASendFailed

+ const ErrUnassignRoleFailed

+ const ErrUnauthorized

+ const ErrUnknownPermission

+ const ErrUnknownProvider

+ const ErrUnknownRole

+ const ErrUserBanned

+ const ErrUserCreationFailed

+ const ErrUserInvitesLookupFailed

+ const ErrUserLookupFailed

+ const ErrUserNotFound

+ const ErrUserinfoFailed

+ const ErrUsernameCannotContainAt

+ const ErrUsernameCannotStartWithPlus

+ const ErrUsernameInUse

+ const ErrUsernameInvalidCharacters

+ const ErrUsernameMissing

+ const ErrUsernameMustStartWithLetter

+ const ErrUsernameNotAllowed

+ const ErrUsernameTooLong

+ const ErrUsernameTooShort

+ const ErrVerificationLinkExpired

+ const ErrVerificationRequestFailed

+ const ErrWalletAlreadyLinked

+ func (c ErrorCode) String() string

+ type Option func(*Server)

+ func WithAuthLogReader(r core.AuthEventLogReader) Option

+ func WithAuthLogger(l core.AuthEventLogger) Option

+ func WithClientIPFunc(fn ClientIPFunc) Option

+ func WithEmailSender(es core.EmailSender) Option

+ func WithEntitlements(p core.EntitlementsProvider) Option

+ func WithEphemeralStore(store core.EphemeralStore, mode core.EphemeralMode) Option

+ func WithErrorLogger(fn func(context.Context, InternalErrorEvent)) Option

+ func WithLanguageConfig(cfg LanguageConfig) Option

+ func WithRateLimiter(rl RateLimiter) Option

+ func WithRedis(rd *redis.Client) Option

+ func WithSMSSender(sender core.SMSSender) Option

+ func WithSolanaDomain(domain string) Option

+ func WithoutRateLimiter() Option

+ type Server = Service

+ func NewServer(cfg core.Config, pg *pgxpool.Pool, opts ...Option) (*Server, error)

v0.45.0

Jun 22, 2026

Changes in this version

+ type Enricher = verify.Enricher

v0.44.0

Jun 21, 2026

v0.43.1

Jun 20, 2026

v0.43.0

Jun 20, 2026

v0.42.0

Jun 20, 2026

Changes in this version

type VerifierOption

+ func WithPermissions(fn PermissionValidator) VerifierOption

v0.41.0

Jun 20, 2026

Changes in this version

+ const ServicePrincipalType

type VerifierOption

+ func WithAPIKeyPrefix(prefix string) VerifierOption

v0.40.0

Jun 19, 2026

v0.39.0

Jun 19, 2026

v0.38.0

Jun 19, 2026

v0.37.6

Jun 18, 2026

Changes in this version

+ func NewSSRFGuardedClient() *http.Client

+ func RemoteApplicationCORS(v *Verifier) func(http.Handler) http.Handler

+ func RequireDelegatedOrigin(v *Verifier, allowNoOrigin bool) func(http.Handler) http.Handler

type IssuerOptions

+ IsLocal bool

type OrgIssuersRegistration

+ AllowedOrigins []string

type Verifier

+ func (v *Verifier) OriginAllowedForIssuer(ctx context.Context, issuer, origin string, allowNoOrigin bool) (bool, error)

+ func (v *Verifier) RemoteApplicationAllowedOrigins(ctx context.Context) ([]string, error)

type VerifierOption

+ func WithSSRFGuard() VerifierOption

v0.37.5

Jun 17, 2026

v0.37.4

Jun 17, 2026

v0.37.3

Jun 17, 2026

v0.37.2

Jun 17, 2026

v0.37.1

Jun 17, 2026

v0.37.0

Jun 17, 2026

v0.36.0

Jun 16, 2026

v0.35.0

Jun 16, 2026

v0.34.0

Jun 15, 2026

v0.31.0

Jun 15, 2026

v0.30.0

Jun 14, 2026

Changes in this version

type Claims

+ OrgID string

type IssuerOptions

+ OrgSlug string

+ type OrgIssuersClient struct

+ func NewOrgIssuersClient(opts ...OrgIssuersClientOption) *OrgIssuersClient

+ func (fc *OrgIssuersClient) RegisterIssuer(ctx context.Context, acceptURL string, reg OrgIssuersRegistration) error

+ type OrgIssuersClientOption func(*OrgIssuersClient)

+ func WithOrgIssuersAuthToken(token string) OrgIssuersClientOption

+ func WithOrgIssuersHTTPClient(c *http.Client) OrgIssuersClientOption

+ type OrgIssuersRegistration struct

+ Issuer string

+ JWKSURI string

+ PublicKeys []core.RemoteAppKey

+ Slug string

type RouteGroup

+ const RouteOrgIssuers

+ const RouteOrgs

type ServiceJWTPrincipal

+ Org string

v0.29.0

Jun 14, 2026

v0.28.1

Jun 14, 2026

v0.28.0

Jun 14, 2026

Changes in this version

+ const RemoteApplicationAccessTokenType

+ const RemoteApplicationTokenType

type Claims

+ RemoteApplicationID string

+ RemoteApplicationSlug string

+ func (c Claims) IsRemoteApplication() bool

+ type RemoteApplicationAuthoritySource interface

+ ResolveRemoteApplicationAuthority func(ctx context.Context, appID string) (memberships []core.TenantMembership, permissions []string, err error)

v0.27.0

Jun 14, 2026

Changes in this version

+ const DefaultOutboundTimeout

+ type AttributeDefResolver func(ctx context.Context, issuer, key, ref string) (json.RawMessage, error)

type Claims

+ func (c Claims) AttributeIsReference(key string) bool

+ func (c Claims) AttributeReference(key string) (ref string, ok bool)

+ type RemoteApplicationSource interface

+ GetRemoteApplication func(ctx context.Context, issuer string) (*core.RemoteApplication, error)

+ ListRemoteApplications func(ctx context.Context, enabledOnly bool) ([]core.RemoteApplication, error)

type TenantIssuersRegistration

+ Slug string

type Verifier

+ func (v *Verifier) LoadRemoteApplications(ctx context.Context, src RemoteApplicationSource, audiences []string) error

type VerifierOption

+ func WithAttributeHydration(resolver AttributeDefResolver) VerifierOption

v0.26.0

Jun 13, 2026

Changes in this version

+ func HasRoleDBCheckInSchema(ctx context.Context, pg *pgxpool.Pool, schema, userID, role string) (bool, error)

+ func IsAdminInSchema(ctx context.Context, pg *pgxpool.Pool, schema, userID string) (bool, error)

+ func RequireAdminInSchema(pg *pgxpool.Pool, schema string) func(http.Handler) http.Handler

v0.25.0

Jun 13, 2026

Changes in this version

type Claims

+ DelegatedRoles []string

type DelegatedAccessParams

+ Roles []string

v0.24.0

Jun 13, 2026

v0.23.1

Jun 12, 2026

Changes in this version

+ func RequireAnyEntitlement(ents ...string) func(http.Handler) http.Handler

+ func RequireEntitlement(ent string) func(http.Handler) http.Handler

v0.23.0

Jun 12, 2026

Changes in this version

type IssuerOptions

+ TenantSlug string

v0.22.0

Jun 12, 2026

v0.21.0

Jun 11, 2026

v0.20.0

Jun 11, 2026

v0.19.0

Jun 11, 2026

v0.18.2

Jun 11, 2026

Changes in this version

type Claims

+ TenantID string

type DelegatedAccessParams

+ TenantID string

type DelegatedPrincipal

+ TenantID string

v0.18.1

Jun 10, 2026

v0.18.0

Jun 10, 2026

Changes in this version

type TenantIssuersRegistration

+ PublicKeys []core.TenantIssuerKey

v0.17.0

Jun 10, 2026

v0.16.0

Jun 9, 2026

v0.15.7

Jun 9, 2026

v0.15.6

Jun 9, 2026

v0.15.5

Jun 9, 2026

Changes in this version

+ const RLUserEmailChangeCancel

+ const RLUserPhoneChangeCancel

v0.15.4

Jun 9, 2026

Changes in this version

+ const RLAuthRegisterAbandon

type Service

+ func (s *Service) CheckSMSHealth(ctx context.Context) error

+ func (s *Service) SMSAvailable() bool

+ func (s *Service) SMSHealthReason() string

+ func (s *Service) SMSHealthy() bool

v0.15.3

Jun 8, 2026

v0.15.2

Jun 7, 2026

v0.15.1

Jun 7, 2026

v0.15.0

Jun 7, 2026

v0.14.0

Jun 7, 2026

Changes in this version

+ const RLUserPreferredLocale

v0.13.3

Jun 7, 2026

v0.13.2

Jun 7, 2026

v0.13.1

Jun 7, 2026

Changes in this version

+ func RequiredServiceJWT(v *Verifier, opts ...ServiceJWTVerifyOption) func(http.Handler) http.Handler

+ type ServiceJWTPrincipal struct

+ Audiences []string

+ ExpiresAt time.Time

+ Issuer string

+ JTI string

+ Permissions []string

+ Resources []core.ServiceTokenResource

+ Subject string

+ Tenant string

+ func ServiceJWTPrincipalFromContext(ctx context.Context) (ServiceJWTPrincipal, bool)

+ type ServiceJWTReplayChecker func(ctx context.Context, claims core.ServiceJWTClaims) error

+ type ServiceJWTVerifyOption func(*serviceJWTVerifyConfig)

+ func WithServiceJWTMaxLifetime(d time.Duration) ServiceJWTVerifyOption

+ func WithServiceJWTReplayChecker(fn ServiceJWTReplayChecker) ServiceJWTVerifyOption

type Verifier

+ func (v *Verifier) VerifyServiceJWT(ctx context.Context, tokenStr string, opts ...ServiceJWTVerifyOption) (core.ServiceJWTClaims, ServiceJWTPrincipal, error)

v0.13.0

Jun 7, 2026

v0.12.5

Jun 6, 2026

v0.12.4

Jun 6, 2026

Changes in this version

+ func CheckTenantAccess(ctx context.Context, svc *core.Service, userID, tenantSlug string) (canonicalTenant string, memberRoles []string, isMember bool, err error)

+ func HasAnyTenantRole(roles []string, want ...string) bool

type Claims

+ Resources []core.ServiceTokenResource

+ TenantRoles []string

type IssuerOptions

+ JWKSURI string

type RouteGroup

+ const RouteTenantIssuers

+ const RouteTenants

+ type TenantIssuerSource interface

+ GetTenantIssuer func(ctx context.Context, issuerID string) (*core.TenantIssuer, error)

+ ListTenantIssuers func(ctx context.Context, enabledOnly bool) ([]core.TenantIssuer, error)

+ type TenantIssuersClient struct

+ func NewTenantIssuersClient(opts ...TenantIssuersClientOption) *TenantIssuersClient

+ func (fc *TenantIssuersClient) RegisterIssuer(ctx context.Context, acceptURL string, reg TenantIssuersRegistration) error

+ type TenantIssuersClientOption func(*TenantIssuersClient)

+ func WithTenantIssuersAuthToken(token string) TenantIssuersClientOption

+ func WithTenantIssuersHTTPClient(c *http.Client) TenantIssuersClientOption

+ type TenantIssuersRegistration struct

+ Issuer string

+ JWKSURI string

+ Tenant string

type Verifier

+ func (v *Verifier) LoadTenantIssuers(ctx context.Context, src TenantIssuerSource, audiences []string) error

type VerifierOption

+ func WithServiceTokenPrefix(prefix string) VerifierOption

+ func WithTenantMode(mode string) VerifierOption

v0.12.3

Jun 3, 2026

v0.12.2

Jun 3, 2026

Changes in this version

+ const AccessTokenType

type IssuerOptions

+ TrustedResourceAccount string

v0.12.1

Jun 2, 2026

v0.12.0

Jun 2, 2026

Changes in this version

+ const DelegatedAccessTokenType

+ func MintDelegatedAccessToken(ctx context.Context, signer jwtkit.Signer, p DelegatedAccessParams) (string, error)

+ type AttributesValidator func(attributes map[string]json.RawMessage) error

type Claims

+ Attributes map[string]json.RawMessage

+ TokenTyp string

+ func (c Claims) Attribute(key string) (json.RawMessage, bool)

+ func (c Claims) DelegatedAccess() (DelegatedPrincipal, bool)

+ func (c Claims) HasPermission(perm string) bool

+ func (c Claims) IsDelegatedAccessToken() bool

+ type DelegatedAccessParams struct

+ Attributes map[string]any

+ Audiences []string

+ CompatOrg bool

+ DelegatedSubject string

+ Issuer string

+ JTI string

+ NotBefore time.Time

+ Permissions []string

+ TTL time.Duration

+ Tenant string

type DelegatedPrincipal

+ Attributes map[string]json.RawMessage

+ JTI string

+ Permissions []string

+ type PermissionValidator func(permissions []string) error

type Verifier

+ func (v *Verifier) VerifyDelegatedAccess(tokenStr string) (Claims, DelegatedPrincipal, error)

type VerifierOption

+ func WithAttributesPolicy(fn AttributesValidator) VerifierOption

+ func WithPermissionCatalog(fn PermissionValidator) VerifierOption

v0.11.5

May 25, 2026

v0.11.4

May 24, 2026

v0.11.3

May 24, 2026

v0.11.2

May 24, 2026

Changes in this version

type Verifier

+ func (v *Verifier) VerifyClaims(tokenStr string) (jwt.MapClaims, error)

v0.11.1

May 23, 2026

v0.11.0

May 23, 2026

Changes in this version

+ const RLAdminPasswordReset

+ const ServiceTokenType

type Claims

+ Permissions []string

+ TokenType string

+ func (c Claims) IsService() bool

+ type OATGrantAuthorizer interface

+ CanGrantOAT func(ctx context.Context, caller OATGrantCaller, org string, permissions []string) (allowed bool, offending []string, err error)

+ type OATGrantCaller struct

+ GlobalRoles []string

+ UserID string

type Service

+ func (s *Service) WithOATGrantAuthorizer(a OATGrantAuthorizer) *Service

type VerifierOption

+ func WithTokenPrefix(prefix string) VerifierOption

v0.10.2

May 22, 2026

v0.10.1

May 22, 2026

Changes in this version

type FederatedIssuerSource

+ GetFederatedOrgIssuer func(ctx context.Context, issuerID string) (*core.FederatedOrgIssuer, error)

v0.10.0

May 22, 2026

Changes in this version

+ type FederatedIssuerSource interface

+ ListFederatedOrgIssuers func(ctx context.Context, activeOnly bool) ([]core.FederatedOrgIssuer, error)

+ type FederationClient struct

+ func NewFederationClient(opts ...FederationClientOption) *FederationClient

+ func (fc *FederationClient) RegisterIssuer(ctx context.Context, acceptURL string, reg FederationRegistration) error

+ type FederationClientOption func(*FederationClient)

+ func WithFederationAuthToken(token string) FederationClientOption

+ func WithFederationHTTPClient(c *http.Client) FederationClientOption

+ type FederationRegistration struct

+ IssuerID string

+ JWKSURL string

+ Org string

type RouteGroup

+ const RouteFederation

type Verifier

+ func (v *Verifier) LoadFederatedIssuers(ctx context.Context, src FederatedIssuerSource, audiences []string) error

v0.9.7

May 21, 2026

Changes in this version

type Claims

+ GlobalRoles []string

v0.9.6

May 21, 2026

Changes in this version

+ func MintDelegatedToken(ctx context.Context, signer jwtkit.Signer, p DelegatedTokenParams) (string, error)

type Claims

+ DelegatedSubject string

+ Tenant string

+ func (c Claims) Delegated() (DelegatedPrincipal, bool)

+ func (c Claims) IsDelegated() bool

+ type DelegatedPrincipal struct

+ DelegatedSubject string

+ Issuer string

+ Roles []string

+ Tenant string

+ UserTier string

+ type DelegatedTokenParams struct

+ Audiences []string

+ DelegatedSubject string

+ Issuer string

+ Roles []string

+ TTL time.Duration

+ Tenant string

+ UserTier string

v0.9.5

May 21, 2026

v0.9.4

May 21, 2026

Changes in this version

+ const ActionRequestEmailVerification

+ const ActionRequestPasswordReset

+ const ActionRequestPhoneVerification

+ const ActionUpdateUsername

+ type ActionAvailability struct

+ Action string

+ Allowed bool

+ CooldownSeconds *int64

+ Limit *int

+ NextAllowedAt *time.Time

+ Reason string

+ Remaining *int

+ RetryAfterSeconds int64

+ WindowSeconds *int64

type RateLimitResult

+ Availability *ActionAvailability

+ type RateLimiterWithResult interface

+ AllowNamedResult func(bucket string, key string) (ratelimit.Result, error)

v0.9.3

May 21, 2026

v0.9.2

May 21, 2026

v0.9.1

May 21, 2026

Changes in this version

type ClientIPFunc

+ func PublicRemoteAddrClientIP() ClientIPFunc

type Limit

+ Cooldown time.Duration

+ type RateLimitResult struct

+ Allowed bool

+ RetryAfter time.Duration

+ type RateLimiterWithRetryAfter interface

+ AllowNamedWithRetryAfter func(bucket string, key string) (bool, time.Duration, error)

v0.9.0

May 20, 2026

v0.8.7

May 12, 2026

Changes in this version

+ type InternalErrorEvent struct

+ Code string

+ Err error

+ Method string

+ Path string

+ Route string

+ Stage string

+ func (e InternalErrorEvent) Error() string

type Service

+ func (s *Service) WithErrorLogger(fn func(context.Context, InternalErrorEvent)) *Service

v0.8.6

May 8, 2026

v0.8.5

May 8, 2026

Changes in this version

+ type RouteGroup string

+ const RouteAccountOIDCLinking

+ const RouteAdmin

+ const RouteCore

+ const RouteEmailVerification

+ const RouteOIDCBrowser

+ const RouteOrganizations

+ const RouteOwners

+ const RoutePassword

+ const RoutePhoneVerification

+ const RouteRegister

+ const RouteSolana

+ const RouteTwoFactor

+ const RouteUser

+ type RouteSpec struct

+ Group RouteGroup

+ Handler http.Handler

+ Method string

+ Path string

+ type Routes struct

+ func (r Routes) DefaultAPI() []RouteSpec

+ func (r Routes) Groups(groups ...RouteGroup) []RouteSpec

+ func (r Routes) OIDCBrowser() []RouteSpec

type Service

+ func (s *Service) APIRoutes(groups ...RouteGroup) []RouteSpec

+ func (s *Service) OIDCBrowserRoutes(groups ...RouteGroup) []RouteSpec

+ func (s *Service) Routes() Routes

v0.8.4

May 7, 2026

Changes in this version

+ const RLAuthRegisterAvailability

v0.8.3

May 7, 2026

v0.8.2

May 6, 2026

v0.8.1

May 6, 2026

v0.8.0

May 6, 2026

Changes in this version

+ const RL2FADisable

+ const RL2FAEnable

+ const RL2FARegenerateCodes

+ const RL2FAStartPhone

+ const RL2FAVerify

+ const RLAdminRolesGrant

+ const RLAdminRolesRevoke

+ const RLAdminUserSessionsList

+ const RLAdminUserSessionsRevoke

+ const RLAdminUserSessionsRevokeAll

+ const RLAuthLogout

+ const RLAuthRegister

+ const RLAuthRegisterResendEmail

+ const RLAuthRegisterResendPhone

+ const RLAuthSessionsCurrent

+ const RLAuthSessionsList

+ const RLAuthSessionsRevoke

+ const RLAuthSessionsRevokeAll

+ const RLAuthToken

+ const RLEmailVerifyConfirm

+ const RLEmailVerifyRequest

+ const RLOIDCCallback

+ const RLOIDCStart

+ const RLPasswordLogin

+ const RLPasswordResetConfirm

+ const RLPasswordResetRequest

+ const RLPhoneVerifyConfirm

+ const RLPhoneVerifyRequest

+ const RLSolanaChallenge

+ const RLSolanaLink

+ const RLSolanaLogin

+ const RLUserDelete

+ const RLUserEmailChangeConfirm

+ const RLUserEmailChangeRequest

+ const RLUserEmailChangeResend

+ const RLUserMe

+ const RLUserPasswordChange

+ const RLUserPhoneChangeConfirm

+ const RLUserPhoneChangeRequest

+ const RLUserPhoneChangeResend

+ const RLUserUnlinkProvider

+ const RLUserUpdateEmail

+ const RLUserUpdateUsername

+ func AllowNamed(r *http.Request, rl RateLimiter, bucket string) bool

+ func CheckOrgAccess(ctx context.Context, svc *core.Service, userID, orgSlug string) (canonicalOrg string, memberRoles []string, isMember bool, err error)

+ func DefaultRateLimits() map[string]Limit

+ func HasAnyOrgRole(roles []string, want ...string) bool

+ func HasRoleDBCheck(ctx context.Context, pg *pgxpool.Pool, userID, role string) (bool, error)

+ func IsAdmin(ctx context.Context, pg *pgxpool.Pool, userID string) (bool, error)

+ func JWKSHandler(jwks jwtkit.JWKS) http.Handler

+ func LanguageMiddleware(cfg *LanguageConfig) func(http.Handler) http.Handler

+ func Optional(v *Verifier) func(http.Handler) http.Handler

+ func RequireAdmin(pg *pgxpool.Pool) func(http.Handler) http.Handler

+ func Required(v *Verifier) func(http.Handler) http.Handler

+ func ToMemoryLimits(in map[string]Limit) map[string]memorylimiter.Limit

+ func ToRedisLimits(in map[string]Limit) map[string]redislimiter.Limit

+ type Claims struct

+ DiscordUsername string

+ Email string

+ EmailVerified bool

+ Entitlements []string

+ Issuer string

+ JTI string

+ Org string

+ OrgRoles []string

+ Roles []string

+ SessionID string

+ UserID string

+ UserTier string

+ Username string

+ func ClaimsFromContext(ctx context.Context) (Claims, bool)

+ func (c Claims) HasEntitlement(ent string) bool

+ func (c Claims) HasRole(role string) bool

+ type ClientIPFunc func(r *http.Request) string

+ func ClientIPFromForwardedHeaders(trustedProxies []netip.Prefix) ClientIPFunc

+ func DefaultClientIP() ClientIPFunc

+ type IssuerKey struct

+ KID string

+ PublicKeyPEM string

+ type IssuerOptions struct

+ CacheTTL time.Duration

+ JWKSURL string

+ Keys []IssuerKey

+ MaxStale time.Duration

+ RawKeys map[string]*rsa.PublicKey

+ type LanguageConfig struct

+ CookieName string

+ Default string

+ QueryParam string

+ Supported []string

+ type Limit struct

+ Limit int

+ Window time.Duration

+ type RateLimiter interface

+ AllowNamed func(bucket string, key string) (bool, error)

+ type Service struct

+ func NewService(cfg core.Config) (*Service, error)

+ func (s *Service) APIHandler() http.Handler

+ func (s *Service) Core() *core.Service

+ func (s *Service) DisableRateLimiter() *Service

+ func (s *Service) JWKSHandler() http.Handler

+ func (s *Service) OIDCHandler() http.Handler

+ func (s *Service) Verifier() *Verifier

+ func (s *Service) WithAuthLogReader(r core.AuthEventLogReader) *Service

+ func (s *Service) WithAuthLogger(l core.AuthEventLogger) *Service

+ func (s *Service) WithClientIPFunc(fn ClientIPFunc) *Service

+ func (s *Service) WithEmailSender(es core.EmailSender) *Service

+ func (s *Service) WithEntitlements(p core.EntitlementsProvider) *Service

+ func (s *Service) WithEphemeralStore(store core.EphemeralStore, mode core.EphemeralMode) *Service

+ func (s *Service) WithLanguageConfig(cfg LanguageConfig) *Service

+ func (s *Service) WithPostgres(pg *pgxpool.Pool) *Service

+ func (s *Service) WithRateLimiter(rl RateLimiter) *Service

+ func (s *Service) WithRedis(rd *redis.Client) *Service

+ func (s *Service) WithSMSSender(sender core.SMSSender) *Service

+ func (s *Service) WithSolanaDomain(domain string) *Service

+ type Verifier struct

+ func NewVerifier(opts ...VerifierOption) *Verifier

+ func (v *Verifier) AddIssuer(issuerID string, audiences []string, opts IssuerOptions) error

+ func (v *Verifier) RemoveIssuer(issuerID string)

+ func (v *Verifier) Verify(tokenStr string) (Claims, error)

+ func (v *Verifier) WithService(svc *core.Service) *Verifier

+ type VerifierOption func(*Verifier)

+ func WithAlgorithms(algs ...string) VerifierOption

+ func WithHTTPClient(c *http.Client) VerifierOption

+ func WithOrgMode(mode string) VerifierOption

+ func WithSkew(d time.Duration) VerifierOption

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL