Documentation
¶
Overview ¶
Package auth provides email services for user invitations.
Package auth provides authentication and authorization handlers for the PDVD backend.
Package auth provides authentication handlers for Fiber.
Package auth provides invitation management logic.
Package auth provides invitation management handlers for user onboarding.
Package auth provides authentication and authorization middleware for Fiber applications.
Package auth provides authentication and authorization utilities.
Package auth provides RBAC handlers for Fiber.
Package auth provides authentication and authorization utilities.
Package auth provides authentication and authorization types for the REST API.
Package auth provides authentication and authorization utilities.
Index ¶
- func AcceptInvitation(ctx context.Context, db database.DBConnection, token, password string) (*model.User, error)
- func AcceptInvitationHandler(db database.DBConnection) fiber.Handler
- func ApplyRBACConfig(db database.DBConnection, config *RBACConfig) (int, int, int, []error)
- func ApplyRBACConfigFromFile(db database.DBConnection, filepath string) (int, int, int, []error)
- func ApplyRBACFromBody(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
- func ApplyRBACFromFile(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
- func ApplyRBACFromUpload(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
- func BootstrapAdmin(db database.DBConnection) error
- func ChangePassword(db database.DBConnection) fiber.Handler
- func CheckPasswordHash(password, hash string) bool
- func CleanupExpiredInvitations(ctx context.Context, db database.DBConnection) (int, error)
- func CreateInvitation(ctx context.Context, db database.DBConnection, emailConfig *EmailConfig, ...) (*model.Invitation, error)
- func CreateUser(db database.DBConnection) fiber.Handler
- func DeleteUser(db database.DBConnection) fiber.Handler
- func EnsureDefaultRoles(db database.DBConnection) error
- func ExportRBACConfigToFile(db database.DBConnection, filepath string) error
- func ForgotPassword(_ database.DBConnection) fiber.Handler
- func GenerateJWT(username string) (string, error)
- func GenerateRandomString(length int) (string, error)
- func GenerateSecureToken(length int) (string, error)
- func GetInvitation(ctx context.Context, db database.DBConnection, token string) (*model.Invitation, error)
- func GetInvitationHandler(db database.DBConnection) fiber.Handler
- func GetJWTExpirationTime() time.Duration
- func GetRBACConfig(db database.DBConnection) fiber.Handler
- func GetUser(db database.DBConnection) fiber.Handler
- func GetUserOrgs(ctx context.Context, db database.DBConnection, username string) ([]string, error)
- func GitHubCallback(db database.DBConnection) fiber.Handler
- func GitHubLogin(c *fiber.Ctx) error
- func HandleRBACApply(db database.DBConnection) fiber.Handler
- func HandleRBACValidate(_ database.DBConnection) fiber.Handler
- func HashPassword(password string) (string, error)
- func IsStrongPassword(password string) bool
- func ListPendingInvitationsHandler(db database.DBConnection) fiber.Handler
- func ListUsers(db database.DBConnection) fiber.Handler
- func Login(db database.DBConnection) fiber.Handler
- func Logout() fiber.Handler
- func Me(db database.DBConnection) fiber.Handler
- func OptionalAuth(db database.DBConnection) fiber.Handler
- func RefreshJWT(oldTokenString string) (string, error)
- func RefreshToken(_ database.DBConnection) fiber.Handler
- func RequireAuth(db database.DBConnection) fiber.Handler
- func RequireRole(allowedRoles ...string) fiber.Handler
- func ResendInvitation(ctx context.Context, db database.DBConnection, emailConfig *EmailConfig, ...) error
- func ResendInvitationHandler(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
- func SendInvitationEmail(config *EmailConfig, username, email, token, role string) error
- func SendPasswordResetEmail(config *EmailConfig, email, token string) error
- func SetAuthCookie(c *fiber.Ctx, token string)
- func SetJWTSecret(secret string)
- func Signup(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
- func SyncRBACFromFile(db database.DBConnection, filepath string) error
- func UpdateUser(db database.DBConnection) fiber.Handler
- func UserHasOrgAccess(ctx context.Context, db database.DBConnection, username, org string) (bool, error)
- func ValidatePasswordStrength(password string) error
- func ValidateRBAC(_ database.DBConnection) fiber.Handler
- func ValidateRBACConfig(config *RBACConfig) error
- type AcceptInvitationRequest
- type Claims
- type CtxKey
- type EmailConfig
- type ForgotPasswordRequest
- type InvitationEmailData
- type LoginRequest
- type OrgDefinition
- type OrgMember
- type PeriobolosConfig
- type PeriobolosUser
- type RBACApplyRequest
- type RBACApplyResponse
- type RBACConfig
- type RBACResult
- type RoleConfig
- type RoleDefinition
- type UserConfig
- type UserResponse
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AcceptInvitation ¶ added in v12.0.233
func AcceptInvitation(ctx context.Context, db database.DBConnection, token, password string) (*model.User, error)
AcceptInvitation accepts an invitation and activates the user
func AcceptInvitationHandler ¶ added in v12.0.233
func AcceptInvitationHandler(db database.DBConnection) fiber.Handler
AcceptInvitationHandler handles activation and immediate login
func ApplyRBACConfig ¶ added in v12.0.240
func ApplyRBACConfig(db database.DBConnection, config *RBACConfig) (int, int, int, []error)
ApplyRBACConfig applies the RBAC configuration to the database
func ApplyRBACConfigFromFile ¶ added in v12.0.240
ApplyRBACConfigFromFile loads and applies RBAC configuration from a file
func ApplyRBACFromBody ¶ added in v12.0.233
func ApplyRBACFromBody(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
ApplyRBACFromBody applies RBAC config from request body (YAML only)
func ApplyRBACFromFile ¶ added in v12.0.233
func ApplyRBACFromFile(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
ApplyRBACFromFile applies RBAC config from filesystem
func ApplyRBACFromUpload ¶ added in v12.0.233
func ApplyRBACFromUpload(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
ApplyRBACFromUpload applies RBAC config from uploaded file
func BootstrapAdmin ¶
func BootstrapAdmin(db database.DBConnection) error
BootstrapAdmin creates a default admin user if no users exist in the database
func ChangePassword ¶ added in v12.0.240
func ChangePassword(db database.DBConnection) fiber.Handler
ChangePassword handles password change
func CheckPasswordHash ¶
CheckPasswordHash compares a password with a hash
func CleanupExpiredInvitations ¶ added in v12.0.233
CleanupExpiredInvitations removes expired invitations
func CreateInvitation ¶ added in v12.0.233
func CreateInvitation(ctx context.Context, db database.DBConnection, emailConfig *EmailConfig, username, email, role string) (*model.Invitation, error)
CreateInvitation creates a new user invitation and sends email
func CreateUser ¶ added in v12.0.240
func CreateUser(db database.DBConnection) fiber.Handler
CreateUser creates a new user
func DeleteUser ¶ added in v12.0.240
func DeleteUser(db database.DBConnection) fiber.Handler
DeleteUser deletes a user
func EnsureDefaultRoles ¶ added in v12.0.240
func EnsureDefaultRoles(db database.DBConnection) error
EnsureDefaultRoles ensures the default roles exist in the database
func ExportRBACConfigToFile ¶ added in v12.0.240
func ExportRBACConfigToFile(db database.DBConnection, filepath string) error
ExportRBACConfigToFile exports the current RBAC configuration to a YAML file
func ForgotPassword ¶
func ForgotPassword(_ database.DBConnection) fiber.Handler
ForgotPassword handles password reset requests
func GenerateJWT ¶
GenerateJWT generates a JWT token for a user UPDATED: Removed role and orgs arguments
func GenerateRandomString ¶
GenerateRandomString generates a secure random string of the specified length.
func GenerateSecureToken ¶ added in v12.0.240
GenerateSecureToken generates a cryptographically secure random token Used for invitation tokens, password reset tokens, etc.
func GetInvitation ¶ added in v12.0.233
func GetInvitation(ctx context.Context, db database.DBConnection, token string) (*model.Invitation, error)
GetInvitation retrieves an invitation by token
func GetInvitationHandler ¶ added in v12.0.233
func GetInvitationHandler(db database.DBConnection) fiber.Handler
GetInvitationHandler handles GET /api/v1/invitation/:token
func GetJWTExpirationTime ¶ added in v12.0.240
GetJWTExpirationTime returns the configured JWT expiration duration
func GetRBACConfig ¶ added in v12.0.233
func GetRBACConfig(db database.DBConnection) fiber.Handler
GetRBACConfig exports current RBAC configuration from DB to YAML
func GetUser ¶ added in v12.0.240
func GetUser(db database.DBConnection) fiber.Handler
GetUser retrieves a user by username
func GetUserOrgs ¶ added in v12.0.240
GetUserOrgs returns the list of orgs a user can access
func GitHubCallback ¶ added in v12.0.306
func GitHubCallback(db database.DBConnection) fiber.Handler
GitHubCallback handles the callback from GitHub
func GitHubLogin ¶ added in v12.0.306
GitHubLogin initiates the GitHub App Installation flow
func HandleRBACApply ¶ added in v12.0.240
func HandleRBACApply(db database.DBConnection) fiber.Handler
HandleRBACApply handles POST /api/v1/rbac/apply
func HandleRBACValidate ¶ added in v12.0.240
func HandleRBACValidate(_ database.DBConnection) fiber.Handler
HandleRBACValidate handles POST /api/v1/rbac/validate
func HashPassword ¶
HashPassword generates a bcrypt hash of the password
func IsStrongPassword ¶ added in v12.0.240
IsStrongPassword validates password strength Requires at least 8 characters
func ListPendingInvitationsHandler ¶ added in v12.0.233
func ListPendingInvitationsHandler(db database.DBConnection) fiber.Handler
ListPendingInvitationsHandler handles GET /api/v1/admin/invitations (admin only)
func ListUsers ¶ added in v12.0.240
func ListUsers(db database.DBConnection) fiber.Handler
ListUsers lists all users
func Login ¶
func Login(db database.DBConnection) fiber.Handler
Login handles user login and sets auth cookie
func Me ¶
func Me(db database.DBConnection) fiber.Handler
Me returns current authenticated user info with strict GitHub validation
func OptionalAuth ¶ added in v12.0.233
func OptionalAuth(db database.DBConnection) fiber.Handler
OptionalAuth identifies the user if a token is present but does not block guests. This allows a single endpoint to serve both public and private data based on status. UPDATED: Now requires DB connection to look up user details.
func RefreshJWT ¶ added in v12.0.240
RefreshJWT generates a new token with extended expiration for an existing valid token
func RefreshToken ¶ added in v12.0.240
func RefreshToken(_ database.DBConnection) fiber.Handler
RefreshToken refreshes JWT token
func RequireAuth ¶ added in v12.0.233
func RequireAuth(db database.DBConnection) fiber.Handler
RequireAuth middleware validates JWT token from cookie and blocks guests. UPDATED: Now requires DB connection to look up user details (Role/Orgs) not present in JWT.
func RequireRole ¶ added in v12.0.233
RequireRole middleware checks if user has one of the required roles
func ResendInvitation ¶ added in v12.0.233
func ResendInvitation(ctx context.Context, db database.DBConnection, emailConfig *EmailConfig, token string) error
ResendInvitation resends an invitation email
func ResendInvitationHandler ¶ added in v12.0.233
func ResendInvitationHandler(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
ResendInvitationHandler handles POST /api/v1/invitation/:token/resend
func SendInvitationEmail ¶ added in v12.0.233
func SendInvitationEmail(config *EmailConfig, username, email, token, role string) error
SendInvitationEmail sends an invitation email to a new user
func SendPasswordResetEmail ¶ added in v12.0.233
func SendPasswordResetEmail(config *EmailConfig, email, token string) error
SendPasswordResetEmail sends a password reset email
func SetAuthCookie ¶ added in v12.0.233
SetAuthCookie sets the authentication cookie for a user session.
func SetJWTSecret ¶ added in v12.0.240
func SetJWTSecret(secret string)
SetJWTSecret sets the JWT secret (call this on startup with env var)
func Signup ¶ added in v12.0.274
func Signup(db database.DBConnection, emailConfig *EmailConfig) fiber.Handler
Signup handles public user registration requests via GitOps flow
func SyncRBACFromFile ¶ added in v12.0.240
func SyncRBACFromFile(db database.DBConnection, filepath string) error
SyncRBACFromFile is a convenience function that combines load, validate, and apply
func UpdateUser ¶ added in v12.0.240
func UpdateUser(db database.DBConnection) fiber.Handler
UpdateUser updates a user
func UserHasOrgAccess ¶ added in v12.0.240
func UserHasOrgAccess(ctx context.Context, db database.DBConnection, username, org string) (bool, error)
UserHasOrgAccess checks if a user has access to a specific org
func ValidatePasswordStrength ¶ added in v12.0.240
ValidatePasswordStrength validates password meets security requirements Returns error with specific requirement that failed
func ValidateRBAC ¶ added in v12.0.242
func ValidateRBAC(_ database.DBConnection) fiber.Handler
ValidateRBAC validates RBAC config without applying changes
func ValidateRBACConfig ¶ added in v12.0.240
func ValidateRBACConfig(config *RBACConfig) error
ValidateRBACConfig validates the RBAC configuration
Types ¶
type AcceptInvitationRequest ¶ added in v12.0.233
type AcceptInvitationRequest struct {
Password string `json:"password"`
PasswordConfirm string `json:"password_confirm"`
Token string `json:"token"`
}
AcceptInvitationRequest defines the activation body
type Claims ¶ added in v12.0.240
type Claims struct {
Username string `json:"username"`
jwt.RegisteredClaims
}
Claims represents JWT claims UPDATED: Kept only Username (Subject) to minimize payload size. Role and Orgs are now fetched from the database in the middleware.
func ValidateJWT ¶
ValidateJWT validates a JWT token and returns the claims
type CtxKey ¶ added in v12.0.291
type CtxKey string
CtxKey defines a type for context keys to ensure type safety and avoid collisions.
type EmailConfig ¶ added in v12.0.233
type EmailConfig struct {
SMTPHost string
SMTPPort string
SMTPUsername string
SMTPPassword string
FromEmail string
FromName string
BaseURL string // Base URL for invitation links
}
EmailConfig holds email service configuration
func LoadEmailConfig ¶ added in v12.0.233
func LoadEmailConfig() *EmailConfig
LoadEmailConfig loads email configuration from environment
type ForgotPasswordRequest ¶
type ForgotPasswordRequest struct {
Email string `json:"email"`
}
ForgotPasswordRequest handles the invite/reset flow
type InvitationEmailData ¶ added in v12.0.233
type InvitationEmailData struct {
Username string
Email string
Role string
InvitationLink string
ExpiresIn string
SupportEmail string
}
InvitationEmailData holds data for invitation email template
type LoginRequest ¶
LoginRequest defines the body for Basic Auth login
type OrgDefinition ¶ added in v12.0.242
type OrgDefinition struct {
Name string `yaml:"name"`
DisplayName string `yaml:"display_name,omitempty"`
Description string `yaml:"description,omitempty"`
Metadata map[string]string `yaml:"metadata,omitempty"`
Members []OrgMember `yaml:"members,omitempty"` // Added Members list
}
OrgDefinition represents an organization configuration
type PeriobolosConfig ¶ added in v12.0.233
type PeriobolosConfig struct {
Orgs []OrgDefinition `yaml:"orgs,omitempty"`
Users []PeriobolosUser `yaml:"users"`
Roles []RoleDefinition `yaml:"roles,omitempty"`
}
PeriobolosConfig represents the RBAC configuration structure compatible with Peribolos-style YAML
func LoadPeriobolosConfig ¶ added in v12.0.233
func LoadPeriobolosConfig(yamlContent string) (*PeriobolosConfig, error)
LoadPeriobolosConfig parses RBAC configuration from YAML content
type PeriobolosUser ¶ added in v12.0.233
type PeriobolosUser struct {
Username string `yaml:"username"`
Email string `yaml:"email"`
AuthProvider string `yaml:"auth_provider,omitempty"`
}
PeriobolosUser represents a user configuration in the RBAC system
type RBACApplyRequest ¶ added in v12.0.240
type RBACApplyRequest struct {
Config string `json:"config"` // YAML config as string
DryRun bool `json:"dry_run,omitempty"`
}
RBACApplyRequest represents the request body for applying RBAC config
type RBACApplyResponse ¶ added in v12.0.240
type RBACApplyResponse struct {
Success bool `json:"success"`
Message string `json:"message"`
UsersCreated int `json:"users_created,omitempty"`
UsersUpdated int `json:"users_updated,omitempty"`
RolesCreated int `json:"roles_created,omitempty"`
Errors []string `json:"errors,omitempty"`
}
RBACApplyResponse represents the response from applying RBAC config
type RBACConfig ¶ added in v12.0.240
type RBACConfig struct {
Users []UserConfig `yaml:"users"`
Roles []RoleConfig `yaml:"roles"`
}
RBACConfig represents the top-level RBAC configuration
func ExportRBACConfig ¶ added in v12.0.240
func ExportRBACConfig(db database.DBConnection) (*RBACConfig, error)
ExportRBACConfig exports the current RBAC configuration to YAML
func LoadRBACConfig ¶ added in v12.0.240
func LoadRBACConfig(filepath string) (*RBACConfig, error)
LoadRBACConfig loads RBAC configuration from a YAML file
func LoadRBACConfigFromString ¶ added in v12.0.240
func LoadRBACConfigFromString(yamlContent string) (*RBACConfig, error)
LoadRBACConfigFromString loads RBAC configuration from a YAML string
type RBACResult ¶ added in v12.0.233
type RBACResult struct {
OrgsCreated []string `json:"orgs_created"`
OrgsUpdated []string `json:"orgs_updated"`
Created []string `json:"created"`
Updated []string `json:"updated"`
Removed []string `json:"removed"`
Invited []string `json:"invited"`
Invitations map[string]string `json:"invitations,omitempty"`
}
RBACResult contains the outcome of applying RBAC configuration
func ApplyRBAC ¶ added in v12.0.233
func ApplyRBAC(db database.DBConnection, config *PeriobolosConfig, emailConfig *EmailConfig) (*RBACResult, error)
ApplyRBAC implements Option 2: Org-Centric Sync with normalized org names
type RoleConfig ¶ added in v12.0.240
type RoleConfig struct {
Name string `yaml:"name"`
Permissions []string `yaml:"permissions"`
Description string `yaml:"description,omitempty"`
}
RoleConfig represents a role in the RBAC configuration
type RoleDefinition ¶ added in v12.0.242
type RoleDefinition struct {
Name string `yaml:"name"`
Description string `yaml:"description,omitempty"`
Permissions []string `yaml:"permissions,omitempty"`
}
RoleDefinition represents a role configuration with associated permissions
type UserConfig ¶ added in v12.0.240
type UserConfig struct {
Username string `yaml:"username"`
Email string `yaml:"email,omitempty"`
Role string `yaml:"role"`
Orgs []string `yaml:"orgs,omitempty"`
Password string `yaml:"password,omitempty"`
PasswordHash string `yaml:"password_hash,omitempty"`
IsActive *bool `yaml:"is_active,omitempty"`
AuthProvider string `yaml:"auth_provider,omitempty"`
ExternalID string `yaml:"external_id,omitempty"`
}
UserConfig represents a user in the RBAC configuration
type UserResponse ¶
UserResponse defines the session info returned to the frontend