Documentation
¶
Overview ¶
Package auth defines the Identity and UserInfo types, the auth.Provider interface, and the default JWT-based implementation (bcrypt passwords, 15-minute access tokens, 7-day rotating refresh tokens).
Identity is propagated exclusively through context.Context via auth.FromContext — never through globals or extra parameters (TAD §1.2).
See TAD §9.1 and PRD §15 for the full specification. Implemented in Phase 5.
Index ¶
- func CheckPassword(hashedPassword, password string) bool
- func HashPassword(password string) (string, error)
- func NewContext(ctx context.Context, id Identity) context.Context
- type Identity
- type JWTClaims
- type JWTProvider
- func (p *JWTProvider) GenerateTokenPair(id Identity) (accessToken string, refreshToken string, err error)
- func (p *JWTProvider) GetUserInfo(ctx context.Context, tokenString string) (*UserInfo, error)
- func (p *JWTProvider) RefreshToken(ctx context.Context, refreshTokenString string) (newAccess, newRefresh string, err error)
- func (p *JWTProvider) ValidateToken(ctx context.Context, tokenString string) (*Identity, error)
- type Provider
- type UserInfo
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckPassword ¶
CheckPassword compares a bcrypt hashed password with a plain-text candidate.
func HashPassword ¶
HashPassword generates a bcrypt hash of the given plain-text password.
Types ¶
type Identity ¶
type Identity struct {
// UserID is the ULID of the authenticated User record.
UserID string
// Email is the user's email address.
Email string
// FullName is the display name of the user.
FullName string
// Roles is the list of role names this user holds (e.g. "HR Manager").
Roles []string
// Tenant is the tenant identifier for post-MVP multi-tenancy (§15).
// Always empty string in MVP (site.Config.MultiTenant = false).
Tenant string
// Source indicates authentication origin ("local", "oauth:google", etc.).
Source string
}
Identity carries the authenticated caller's information through context. It is the sole mechanism by which the permission engine, document engine, and agent runtime know who is making a request. See TAD §1.2.
func FromContext ¶
FromContext extracts the Identity from ctx. Returns a zero Identity if none was injected — callers that require authentication must check UserID != "".
type JWTClaims ¶
type JWTClaims struct {
jwt.RegisteredClaims
Email string `json:"email,omitempty"`
FullName string `json:"full_name,omitempty"`
Roles []string `json:"roles,omitempty"`
Tenant string `json:"tenant,omitempty"`
Source string `json:"source,omitempty"`
Type string `json:"type"` // "access" or "refresh"
}
JWTClaims defines the claims stored inside Orjanda JWT tokens.
type JWTProvider ¶
type JWTProvider struct {
// contains filtered or unexported fields
}
JWTProvider implements Provider using JWT tokens and bcrypt password hashing. See PRD §15.1 and TAD §9.1.
func NewJWTProvider ¶
func NewJWTProvider(secretKey []byte, accessTTL, refreshTTL time.Duration) *JWTProvider
NewJWTProvider initializes a JWTProvider with secret key and TTLs. Defaults: accessTTL = 15m, refreshTTL = 7 days.
func (*JWTProvider) GenerateTokenPair ¶
func (p *JWTProvider) GenerateTokenPair(id Identity) (accessToken string, refreshToken string, err error)
GenerateTokenPair issues a new access token (15m) and refresh token (7 days) for id.
func (*JWTProvider) GetUserInfo ¶
GetUserInfo retrieves UserInfo from a valid access token.
func (*JWTProvider) RefreshToken ¶
func (p *JWTProvider) RefreshToken(ctx context.Context, refreshTokenString string) (newAccess, newRefresh string, err error)
RefreshToken validates the refresh token, revokes it, and issues a rotated pair. Reused or revoked refresh tokens are rejected.
func (*JWTProvider) ValidateToken ¶
ValidateToken parses and validates a JWT token (access token).
type Provider ¶
type Provider interface {
ValidateToken(ctx context.Context, token string) (*Identity, error)
GetUserInfo(ctx context.Context, token string) (*UserInfo, error)
}
Provider is the extension point for authentication backends. The built-in JWT provider (Phase 5) is itself just the default implementation. See TAD §9.1.
Source Files