Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

engine

package

Go to main page

Versions in this module

v1

v1.0.3

Sep 30, 2026

v1.0.2

Sep 30, 2026

v0

v0.149.0

Sep 30, 2026

Changes in this version

type Engine

+ func (s *Engine) ConsumeOIDCResult(ctx context.Context, code string) (json.RawMessage, bool, error)

+ func (s *Engine) Disable2FA(ctx context.Context, userID string) error

+ func (s *Engine) Disable2FAFactor(ctx context.Context, userID, factorID string) error

+ func (s *Engine) EmailAvailable() bool

+ func (s *Engine) EmailHealth() (time.Time, error)

+ func (s *Engine) PutOIDCResult(ctx context.Context, code string, result json.RawMessage) error

+ func (s *Engine) RelabelDeviceKey(ctx context.Context, userID, id, label string) (iam.DeviceKey, error)

+ func (s *Engine) RemovePhone(ctx context.Context, a iam.Actor, userID string) error

+ func (s *Engine) SetDefault2FAFactor(ctx context.Context, userID, factorID string) (authflow.TwoFactorFactor, error)

+ func (s *Engine) UserSecurity(ctx context.Context, in authflow.ProfileInput) (authflow.UserSecurity, error)

v0.148.0

Sep 30, 2026

Changes in this version

+ func ParseBootstrapManifestYAML(raw []byte) (iam.BootstrapManifest, error)

type Engine

+ func (s *Engine) RolePermissions(role iam.Role) ([]iam.Perm, error)

+ func (s *Engine) TwoFactorMethods() []iam.TwoFactorMethod

v0.147.0

Sep 30, 2026

Changes in this version

+ func Migrate(ctx context.Context, pool *pgxpool.Pool, cfg config.Config, ...) error

+ type Authenticator struct

+ func (a *Authenticator) CheckIssuerKeys(ctx context.Context) error

+ func (a *Authenticator) IssuerKeyStatuses() []verify.IssuerKeyStatus

+ func (a *Authenticator) Verify(ctx context.Context, token string) (verify.Claims, error)

+ func (a *Authenticator) VerifyRequest(r *http.Request) (verify.Claims, error)

+ func (a *Authenticator) VerifyServiceJWT(ctx context.Context, token string, opts ...verify.ServiceJWTVerifyOption) (iam.ServiceJWTClaims, error)

+ type Engine struct

+ func New(ctx context.Context, cfg config.Config, deps config.Deps) (_ *Engine, err error)

+ func (s *Engine) AddMFAEnrollmentExemptRoutes(paths []string)

+ func (s *Engine) ApplyBootstrapManifest(ctx context.Context, manifest iam.BootstrapManifest, opts iam.BootstrapOptions, ...) (iam.BootstrapResult, error)

+ func (s *Engine) Ban(ctx context.Context, a iam.Actor, userID string, b iam.Ban, opts ...ops.Option) error

+ func (s *Engine) BeginDeviceKeyEnrollment(ctx context.Context, email, publicKey, label string) (authflow.DeviceKeyChallenge, error)

+ func (s *Engine) BeginDeviceKeyLogin(ctx context.Context, deviceKeyID string) (authflow.DeviceKeyChallenge, error)

+ func (s *Engine) BeginPasskeyLogin(ctx context.Context) (*protocol.CredentialAssertion, error)

+ func (s *Engine) BeginPasskeyRegistration(ctx context.Context, userID string) (*protocol.CredentialCreation, error)

+ func (s *Engine) BeginTwoFactorEnrollment(ctx context.Context, userID string, enrollmentToken bool, sessionID string) (authflow.TwoFactorEnrollmentScope, error)

+ func (s *Engine) Can(ctx context.Context, a iam.Actor, ref iam.GroupRef, perm iam.Perm) (bool, error)

+ func (s *Engine) ChangePassword(ctx context.Context, userID, current, new string, keepSessionID *string) error

+ func (s *Engine) CheckIssuerKeys(ctx context.Context) error

+ func (s *Engine) CheckPendingRegistrationConflict(ctx context.Context, email, username string) (bool, bool, error)

+ func (s *Engine) CheckPhoneRegistrationConflict(ctx context.Context, phone, username string) (bool, bool, error)

+ func (s *Engine) CheckRecentSignIn(ctx context.Context, cl verify.Claims) error

+ func (s *Engine) CheckSession(ctx context.Context, cl verify.Claims) error

+ func (s *Engine) CheckUserPassword(ctx context.Context, userID, pass string) error

+ func (s *Engine) CheckUsername(ctx context.Context, name string) error

+ func (s *Engine) ClaimDPoPProof(ctx context.Context, key string, ttl time.Duration) (bool, error)

+ func (s *Engine) Close()

+ func (s *Engine) CompleteExternalLogin(ctx context.Context, in authflow.ExternalLoginInput) (authflow.LoginOutcome, error)

+ func (s *Engine) CompleteLoginChallenge(ctx context.Context, in authflow.LoginChallengeInput) (authflow.LoginOutcome, error)

+ func (s *Engine) Config() config.Config

+ func (s *Engine) ConfirmAccountRecovery(ctx context.Context, token string) error

+ func (s *Engine) ConfirmPasswordReset(ctx context.Context, token, newPassword string) (string, error)

+ func (s *Engine) ConfirmVerification(ctx context.Context, in authflow.VerificationInput) (authflow.LoginOutcome, error)

+ func (s *Engine) ConsumeOIDCState(ctx context.Context, state string) (oidcstate.StateData, bool, error)

+ func (s *Engine) ContinueRefreshMFA(ctx context.Context, userID, sessionID string) (authflow.LoginOutcome, error)

+ func (s *Engine) CreateAPIKey(ctx context.Context, a iam.Actor, ref iam.GroupRef, k iam.NewAPIKey, ...) (iam.APIKeyCreated, error)

+ func (s *Engine) CreateGroup(ctx context.Context, ng iam.NewGroup, opts ...ops.Option) (iam.Group, error)

+ func (s *Engine) CreateInvitation(ctx context.Context, a iam.Actor, ref iam.GroupRef, n iam.NewInvitation, ...) (iam.InvitationCreated, error)

+ func (s *Engine) CreateUser(ctx context.Context, n iam.NewUser, opts ...ops.Option) (iam.User, error)

+ func (s *Engine) DelegationAuthorizer() iam.DelegationAuthorizer

+ func (s *Engine) DeleteGroup(ctx context.Context, ref iam.GroupRef, opts ...ops.Option) error

+ func (s *Engine) DeletePasskey(ctx context.Context, userID, id string) error

+ func (s *Engine) DeletePendingPhoneRegistrationByPhone(ctx context.Context, phone string) error

+ func (s *Engine) DeletePendingRegistrationByEmail(ctx context.Context, email string) error

+ func (s *Engine) DeleteRemoteApplication(ctx context.Context, actor iam.Actor, ref iam.GroupRef, id string, ...) error

+ func (s *Engine) DeleteUsers(ctx context.Context, a iam.Actor, ids []string, opts ...ops.Option) ([]iam.OpResult, error)

+ func (s *Engine) DeviceKeys(ctx context.Context, userID string) ([]iam.DeviceKey, error)

+ func (s *Engine) Disable2FAFactorWithRemovedRoles(ctx context.Context, userID, factorID string) ([]authflow.RemovedMFARoleAssignment, error)

+ func (s *Engine) Disable2FAWithRemovedRoles(ctx context.Context, userID string) ([]authflow.RemovedMFARoleAssignment, error)

+ func (s *Engine) EffectivePermissions(ctx context.Context, a iam.Actor, refs []iam.GroupRef) (map[string][]iam.Perm, error)

+ func (s *Engine) EnrollTwoFactor(ctx context.Context, in authflow.TwoFactorEnrollInput) (authflow.TwoFactorEnrollOutcome, error)

+ func (s *Engine) EnsureUserRole(ctx context.Context, ref iam.GroupRef, u iam.UserRef, role iam.Role, ...) (iam.User, error)

+ func (s *Engine) ExchangeRefreshToken(ctx context.Context, refreshToken string, ua string, ip net.IP) (idToken string, expiresAt time.Time, newRefresh string, err error)

+ func (s *Engine) FinishDeviceKeyEnrollment(ctx context.Context, enrollmentID, code, signature, secondFactor string) (authflow.DeviceKeyAuthResult, error)

+ func (s *Engine) FinishDeviceKeyLogin(ctx context.Context, challengeID, signature string) (authflow.DeviceKeyAuthResult, error)

+ func (s *Engine) FinishPasskeyLogin(ctx context.Context, response []byte, userAgent string, ip net.IP) (authflow.LoginOutcome, error)

+ func (s *Engine) FinishPasskeyRegistration(ctx context.Context, userID string, response []byte) (authflow.Passkey, error)

+ func (s *Engine) GenerateSIWSChallenge(ctx context.Context, domain, address, username string) (siws.SignInInput, error)

+ func (s *Engine) Get2FASettings(ctx context.Context, userID string) (*authflow.TwoFactorSettings, error)

+ func (s *Engine) GetPendingPhoneRegistrationByPhone(ctx context.Context, phone string) (*authflow.PendingRegistration, error)

+ func (s *Engine) GetPendingRegistrationByEmail(ctx context.Context, email string) (*authflow.PendingRegistration, error)

+ func (s *Engine) GetProviderLinkByIssuer(ctx context.Context, issuer, subject string) (string, *string, error)

+ func (s *Engine) GetRemoteApplication(ctx context.Context, issuer string) (*iam.RemoteApplication, error)

+ func (s *Engine) Group(ctx context.Context, ref iam.GroupRef) (iam.Group, error)

+ func (s *Engine) GroupRoles(ctx context.Context, ref iam.GroupRef, subjects []iam.Subject) (map[iam.Subject]iam.Role, error)

+ func (s *Engine) Groups(ctx context.Context, ids []string) (map[string]iam.Group, error)

+ func (s *Engine) HasEmailSender() bool

+ func (s *Engine) HasPassword(ctx context.Context, userID string) (bool, error)

+ func (s *Engine) HasProviderLink(ctx context.Context, userID, issuer, providerSlug string) (bool, error)

+ func (s *Engine) HasUsableMFA(ctx context.Context, userID string) (bool, error)

+ func (s *Engine) ImportSolanaLinks(ctx context.Context, rows []iam.ImportSolanaLink, opts ...ops.Option) (iam.ImportSolanaLinksResult, error)

+ func (s *Engine) ImportUsers(ctx context.Context, rows []iam.ImportUser, opts iam.ImportOptions, ...) (iam.ImportResult, error)

+ func (s *Engine) IssuerKeyStatuses() []verify.IssuerKeyStatus

+ func (s *Engine) JWKS() keys.JWKS

+ func (s *Engine) KnownPermission(perm iam.Perm) bool

+ func (s *Engine) LinkProvider(ctx context.Context, userID string, l iam.ProviderLink, opts ...ops.Option) error

+ func (s *Engine) LinkSolanaWallet(ctx context.Context, userID string, output siws.SignInOutput) error

+ func (s *Engine) ListAPIKeys(ctx context.Context, ref iam.GroupRef, p iam.PageRequest) (iam.ListPage[iam.APIKey], error)

+ func (s *Engine) ListDeviceKeys(ctx context.Context, userID, currentID string) ([]iam.DeviceKey, error)

+ func (s *Engine) ListEnabledRemoteApplications(ctx context.Context) ([]iam.RemoteApplication, error)

+ func (s *Engine) ListGroupMembers(ctx context.Context, ref iam.GroupRef, q iam.MemberQuery) (iam.ListPage[iam.GroupMember], error)

+ func (s *Engine) ListGroups(ctx context.Context, q iam.GroupQuery) (iam.ListPage[iam.Group], error)

+ func (s *Engine) ListInvitations(ctx context.Context, ref iam.GroupRef, p iam.PageRequest) (iam.ListPage[iam.Invitation], error)

+ func (s *Engine) ListMemberships(ctx context.Context, subject iam.Subject, p iam.PageRequest) (iam.ListPage[iam.Membership], error)

+ func (s *Engine) ListPasskeys(ctx context.Context, userID string) ([]authflow.Passkey, error)

+ func (s *Engine) ListRemoteApplications(ctx context.Context, ref iam.GroupRef, page iam.PageRequest) (iam.ListPage[iam.RemoteApplication], error)

+ func (s *Engine) ListSessionEvents(ctx context.Context, userID string, q iam.SessionEventQuery) (iam.ListPage[iam.SessionEvent], error)

+ func (s *Engine) ListUserSessions(ctx context.Context, userID string) ([]authflow.Session, error)

+ func (s *Engine) ListUsers(ctx context.Context, q iam.UserQuery) (iam.ListPage[iam.UserEntry], error)

+ func (s *Engine) LogSessionFailed(ctx context.Context, userID string, sessionID string, reason *string, ...)

+ func (s *Engine) MarkSessionAuthenticated(ctx context.Context, userID, sessionID string) error

+ func (s *Engine) MarkSessionAuthenticatedWithMethods(ctx context.Context, userID, sessionID string, authMethods []string) error

+ func (s *Engine) MintAccessToken(ctx context.Context, userID string, o iam.AccessTokenOptions, ...) (iam.Token, error)

+ func (s *Engine) MintDelegatedAccessToken(ctx context.Context, actor iam.Actor, d iam.DelegatedAccess, ...) (iam.Token, error)

+ func (s *Engine) MintServiceJWT(ctx context.Context, opts iam.ServiceJWT, options ...ops.Option) (iam.Token, iam.ServiceJWTClaims, error)

+ func (s *Engine) MintSessionAccessToken(ctx context.Context, userID, sessionID string) (string, time.Time, error)

+ func (s *Engine) NewAuthenticator(audiences []string, opts ...verify.VerifierOption) (*Authenticator, error)

+ func (s *Engine) ParseBootstrapManifestYAML(raw []byte) (iam.BootstrapManifest, error)

+ func (s *Engine) PasskeysEnabled() bool

+ func (s *Engine) PasswordLogin(ctx context.Context, in authflow.PasswordLoginInput) (authflow.LoginOutcome, error)

+ func (s *Engine) PasswordlessLogin(ctx context.Context, in authflow.PasswordlessLoginInput) (authflow.LoginOutcome, error)

+ func (s *Engine) PatchUserMetadata(ctx context.Context, a iam.Actor, userID string, patch map[string]any, ...) error

+ func (s *Engine) Permission(text string) (iam.Perm, error)

+ func (s *Engine) PermissionGroupSchema() *rbac.Schema

+ func (s *Engine) Persona(name string) (iam.Persona, error)

+ func (s *Engine) ProviderSlugs(ctx context.Context, userID string) ([]string, error)

+ func (s *Engine) PublicKeysByKID() map[string]crypto.PublicKey

+ func (s *Engine) PublicNativeUserRegistrationEnabled() bool

+ func (s *Engine) PublicUsers(ctx context.Context, ids []string) (map[string]iam.PublicUser, error)

+ func (s *Engine) PurgeGroup(ctx context.Context, ref iam.GroupRef, opts ...ops.Option) error

+ func (s *Engine) PurgeUsers(ctx context.Context, ids []string, opts ...ops.Option) ([]iam.OpResult, error)

+ func (s *Engine) PutOIDCState(ctx context.Context, state string, data oidcstate.StateData) error

+ func (s *Engine) RecordFailedDeviceKeyEnrollment(ctx context.Context, enrollmentID string)

+ func (s *Engine) RedeemInvitation(ctx context.Context, a iam.Actor, code string) (authflow.InviteRedemption, error)

+ func (s *Engine) RegenerateBackupCodes(ctx context.Context, userID string) ([]string, error)

+ func (s *Engine) Register(ctx context.Context, in authflow.RegisterInput) (authflow.RegisterOutcome, error)

+ func (s *Engine) RegistrationVerificationEnabled() bool

+ func (s *Engine) RemoteApplication(ctx context.Context, ref iam.AppRef) (iam.RemoteApplication, error)

+ func (s *Engine) RemoveGroupMember(ctx context.Context, a iam.Actor, ref iam.GroupRef, subject iam.Subject, ...) error

+ func (s *Engine) RenamePasskey(ctx context.Context, userID, id, label string) error

+ func (s *Engine) RequestEmailChange(ctx context.Context, userID, newEmail string) error

+ func (s *Engine) RequestEmailVerification(ctx context.Context, email string, ttl time.Duration) error

+ func (s *Engine) RequestPasswordReset(ctx context.Context, email string, ttl time.Duration, ip *string, ua *string) error

+ func (s *Engine) RequestPhoneChange(ctx context.Context, userID, newPhone string) error

+ func (s *Engine) RequestPhonePasswordReset(ctx context.Context, phone string, ttl time.Duration, ip *string, ua *string) error

+ func (s *Engine) RequestPhoneVerification(ctx context.Context, phone string, ttl time.Duration) error

+ func (s *Engine) Require2FAForStepUpMethod(ctx context.Context, userID, sessionID, method string) (destination, selectedMethod string, factor authflow.TwoFactorFactor, err error)

+ func (s *Engine) RequireProvenContact(ctx context.Context, userID string) error

+ func (s *Engine) ResendLoginChallenge(ctx context.Context, userID, nonce, factorID string) (*authflow.TwoFactorChallenge, error)

+ func (s *Engine) ResetAccountMFA(ctx context.Context, userID string, opts ...ops.Option) error

+ func (s *Engine) ResolveAPIKey(ctx context.Context, token string) (iam.APIKeyPrincipal, error)

+ func (s *Engine) ResolveUsername(ctx context.Context, name string) (iam.NameResolution, error)

+ func (s *Engine) RestoreUsers(ctx context.Context, a iam.Actor, ids []string, opts ...ops.Option) ([]iam.OpResult, error)

+ func (s *Engine) RevokeAPIKey(ctx context.Context, a iam.Actor, ref iam.GroupRef, id string, ...) error

+ func (s *Engine) RevokeAccountSessions(ctx context.Context, a iam.Actor, userID string, opts ...ops.Option) (iam.AccountSessionRevocation, error)

+ func (s *Engine) RevokeDeviceKey(ctx context.Context, userID, currentID, targetID string) error

+ func (s *Engine) RevokeInvitation(ctx context.Context, a iam.Actor, ref iam.GroupRef, id string, ...) error

+ func (s *Engine) RevokeIssuerSessions(ctx context.Context, userID string, keepSessionID *string) error

+ func (s *Engine) RevokeOtherDeviceKeys(ctx context.Context, userID, currentID string) error

+ func (s *Engine) RevokeSession(ctx context.Context, a iam.Actor, userID, sessionID string, opts ...ops.Option) error

+ func (s *Engine) RevokeSessionByIDForUser(ctx context.Context, userID, sessionID string) error

+ func (s *Engine) RiverJobs() riverhelpers.Contribution

+ func (s *Engine) Role(text string) (iam.Role, error)

+ func (s *Engine) SMSAvailable() bool

+ func (s *Engine) SMSHealth() (time.Time, error)

+ func (s *Engine) SendWelcome(ctx context.Context, userID string)

+ func (s *Engine) SessionFreshness(ctx context.Context, userID, sessionID string, now time.Time) (authflow.SessionFreshness, error)

+ func (s *Engine) Sessions(ctx context.Context, userID string) ([]iam.Session, error)

+ func (s *Engine) SetGroupRole(ctx context.Context, a iam.Actor, ref iam.GroupRef, subject iam.Subject, ...) (iam.GroupMember, error)

+ func (s *Engine) SetPasswordAfterFreshAuth(ctx context.Context, userID, new string, keepSessionID *string) error

+ func (s *Engine) Start(ctx context.Context) error

+ func (s *Engine) StartPasswordless(ctx context.Context, req authflow.PasswordlessStartRequest) (authflow.PasswordlessStartResult, error)

+ func (s *Engine) StepUpRequired(ctx context.Context, userID string) error

+ func (s *Engine) TwoFactorAllowedMethods() []string

+ func (s *Engine) TwoFactorEnabled() bool

+ func (s *Engine) Unban(ctx context.Context, a iam.Actor, userID string, opts ...ops.Option) error

+ func (s *Engine) UnlinkProviderUnlessLast(ctx context.Context, userID, provider string) (bool, error)

+ func (s *Engine) UpdateUser(ctx context.Context, a iam.Actor, userID string, u iam.UserUpdate, ...) (iam.User, error)

+ func (s *Engine) UpsertRemoteApplication(ctx context.Context, actor iam.Actor, ref iam.GroupRef, ...) (iam.RemoteApplication, error)

+ func (s *Engine) User(ctx context.Context, ref iam.UserRef, opts ...ops.Option) (iam.User, error)

+ func (s *Engine) UserEntry(ctx context.Context, userID string) (iam.UserEntry, error)

+ func (s *Engine) UserMetadata(ctx context.Context, userID string) (map[string]any, error)

+ func (s *Engine) UserNamingState(ctx context.Context, id string) (naming.State, error)

+ func (s *Engine) UserProfile(ctx context.Context, in authflow.ProfileInput) (authflow.UserProfile, error)

+ func (s *Engine) Users(ctx context.Context, ids []string) (map[string]iam.User, error)

+ func (s *Engine) ValidatePassword(value string, identifiers ...string) error

+ func (s *Engine) ValidateUsername(username string) error

+ func (s *Engine) ValidateUsernameForRegistration(ctx context.Context, username string) (string, error)

+ func (s *Engine) Verify(ctx context.Context, token string) (verify.Claims, error)

+ func (s *Engine) Verify2FAStepUpMethodCode(ctx context.Context, userID, sessionID, method, code string) (bool, error)

+ func (s *Engine) VerifyBackupCode(ctx context.Context, userID, backupCode string) (bool, error)

+ func (s *Engine) VerifyPendingPassword(ctx context.Context, email, pass string) bool

+ func (s *Engine) VerifyPendingPhonePassword(ctx context.Context, phone, pass string) bool

+ func (s *Engine) VerifyRequest(r *http.Request) (verify.Claims, error)

+ func (s *Engine) VerifySIWSAndLogin(ctx context.Context, output siws.SignInOutput, extra map[string]any) (authflow.LoginOutcome, error)

+ func (s *Engine) VerifyServiceJWT(ctx context.Context, token string, opts ...verify.ServiceJWTVerifyOption) (iam.ServiceJWTClaims, error)

+ type SolanaSNSResolver interface

+ ResolvePrimaryName func(ctx context.Context, address string) (string, error)