oneauth

Mar 17, 2026

Changes in this version

+ func CSRFTemplateField(r *http.Request) template.HTML

+ func CSRFToken(r *http.Request) string

+ type CSRFMiddleware struct

+ CookieName string

+ ErrorHandler http.HandlerFunc

+ ExemptFunc func(*http.Request) bool

+ FieldName string

+ HeaderName string

+ MaxAge int

+ Path string

+ SameSite http.SameSite

+ Secure bool

+ func (m *CSRFMiddleware) Protect(next http.Handler) http.Handler

Mar 17, 2026

Changes in this version

+ var ErrAdminForbidden = fmt.Errorf("admin access denied")

+ var ErrAdminUnauthorized = fmt.Errorf("admin authentication required")

+ func GetCustomClaimsFromContext(ctx context.Context) map[string]any

+ func MintResourceToken(userID, appClientID, appSecret string, quota AppQuota, scopes []string) (string, error)

+ func MintResourceTokenWithKey(userID, appClientID string, signingKey any, quota AppQuota, scopes []string) (string, error)

type APIAuth

+ JWTSigningKey any

+ JWTVerifyKey any

+ type APIKeyAuth struct

+ func NewAPIKeyAuth(key string) *APIKeyAuth

+ func (a *APIKeyAuth) Authenticate(r *http.Request) error

type APIMiddleware

+ TokenQueryParam string

+ type AdminAuth interface

+ Authenticate func(r *http.Request) error

+ type AppQuota struct

+ MaxMsgRate float64

+ MaxRooms int

+ type AppRegistrar struct

+ Auth AdminAuth

+ KeyStore WritableKeyStore

+ func (h *AppRegistrar) Handler() http.Handler

+ func (h *AppRegistrar) RLockApps(fn func(map[string]*AppRegistration))

+ type AppRegistration struct

+ ClientDomain string

+ ClientID string

+ CreatedAt time.Time

+ MaxMsgRate float64

+ MaxRooms int

+ Revoked bool

+ SigningAlg string

+ type EncryptedKeyStore struct

+ func NewEncryptedKeyStore(inner WritableKeyStore, masterKeyHex string) (*EncryptedKeyStore, error)

+ func (e *EncryptedKeyStore) DeleteKey(clientID string) error

+ func (e *EncryptedKeyStore) GetExpectedAlg(clientID string) (string, error)

+ func (e *EncryptedKeyStore) GetSigningKey(clientID string) (any, error)

+ func (e *EncryptedKeyStore) GetVerifyKey(clientID string) (any, error)

+ func (e *EncryptedKeyStore) ListKeys() ([]string, error)

+ func (e *EncryptedKeyStore) RegisterKey(clientID string, key any, algorithm string) error

+ type JWKSHandler struct

+ CacheMaxAge int

+ KeyStore WritableKeyStore

+ func (h *JWKSHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ type JWKSKeyStore struct

+ HTTPClient *http.Client

+ JWKSURL string

+ MinRefreshGap time.Duration

+ RefreshInterval time.Duration

+ func NewJWKSKeyStore(jwksURL string, opts ...JWKSOption) *JWKSKeyStore

+ func (s *JWKSKeyStore) GetExpectedAlg(clientID string) (string, error)

+ func (s *JWKSKeyStore) GetSigningKey(clientID string) (any, error)

+ func (s *JWKSKeyStore) GetVerifyKey(clientID string) (any, error)

+ func (s *JWKSKeyStore) Start() error

+ func (s *JWKSKeyStore) Stop()

+ type JWKSOption func(*JWKSKeyStore)

+ func WithHTTPClient(c *http.Client) JWKSOption

+ func WithMinRefreshGap(d time.Duration) JWKSOption

+ func WithRefreshInterval(d time.Duration) JWKSOption

+ type NoAuth struct

+ func NewNoAuth() *NoAuth

+ func (a *NoAuth) Authenticate(r *http.Request) error

Mar 10, 2026

Changes in this version

+ var ErrAlgorithmMismatch = fmt.Errorf("algorithm mismatch")

+ var ErrKeyNotFound = fmt.Errorf("signing key not found")

type APIAuth

+ CustomClaimsFunc func(userID string, scopes []string) (map[string]any, error)

+ func (a *APIAuth) CreateAccessToken(userID string, scopes []string) (string, int64, error)

+ func (a *APIAuth) ValidateAccessTokenFull(tokenString string) (userID string, scopes []string, customClaims map[string]any, err error)

type APIMiddleware

+ KeyStore KeyStore

+ type InMemoryKeyStore struct

+ func NewInMemoryKeyStore() *InMemoryKeyStore

+ func (s *InMemoryKeyStore) DeleteKey(clientID string) error

+ func (s *InMemoryKeyStore) GetExpectedAlg(clientID string) (string, error)

+ func (s *InMemoryKeyStore) GetSigningKey(clientID string) (any, error)

+ func (s *InMemoryKeyStore) GetVerifyKey(clientID string) (any, error)

+ func (s *InMemoryKeyStore) ListKeys() ([]string, error)

+ func (s *InMemoryKeyStore) RegisterKey(clientID string, key any, algorithm string) error

+ type KeyStore interface

+ GetExpectedAlg func(clientID string) (string, error)

+ GetSigningKey func(clientID string) (any, error)

+ GetVerifyKey func(clientID string) (any, error)

+ type WritableKeyStore interface

+ DeleteKey func(clientID string) error

+ ListKeys func() ([]string, error)

+ RegisterKey func(clientID string, key any, algorithm string) error

Feb 17, 2026

Changes in this version

type LocalAuth

+ ForgotPasswordURL string

+ ResetPasswordURL string

Jan 20, 2026

Changes in this version

type Channel

+ ExpiresAt time.Time

+ Version int

+ func (c *Channel) IsExpired() bool

type Identity

+ UpdatedAt time.Time

+ Version int

Jan 20, 2026

Changes in this version

+ const ErrCodeEmailExists

+ const ErrCodeInvalidCreds

+ const ErrCodeInvalidEmail

+ const ErrCodeInvalidPhone

+ const ErrCodeInvalidUsername

+ const ErrCodeMissingField

+ const ErrCodeUsernameTaken

+ const ErrCodeWeakPassword

+ var PolicyEmailOnly = SignupPolicy

+ var PolicyFlexible = SignupPolicy

+ var PolicyUsernameRequired = SignupPolicy

+ func LinkLocalCredentials(config EnsureAuthUserConfig, userID string, username, password, email string) error

+ func NewEnsureAuthUserFunc(config EnsureAuthUserConfig) ...

+ type AuthError struct

+ Code string

+ Field string

+ Message string

+ func NewAuthError(code, message, field string) *AuthError

+ func (e *AuthError) Error() string

+ type AuthErrorHandler func(err *AuthError, w http.ResponseWriter, r *http.Request) bool

type CredentialsValidator

+ func NewCredentialsValidatorWithUsername(identityStore IdentityStore, channelStore ChannelStore, userStore UserStore, ...) CredentialsValidator

+ type EnsureAuthUserConfig struct

+ ChannelStore ChannelStore

+ IdentityStore IdentityStore

+ UserStore UserStore

+ UsernameStore UsernameStore

+ type GetLoggedInUserFunc func(r *http.Request) (userID string, err error)

+ type LinkCredentialsConfig struct

+ ChannelStore ChannelStore

+ IdentityStore IdentityStore

+ UserStore UserStore

+ UsernameStore UsernameStore

+ type LinkOAuthConfig struct

+ ChannelStore ChannelStore

+ IdentityStore IdentityStore

+ UserStore UserStore

type LocalAuth

+ LoginURL string

+ OnLoginError AuthErrorHandler

+ OnSignupError AuthErrorHandler

+ SignupPolicy *SignupPolicy

+ SignupURL string

+ UsernameStore UsernameStore

+ func (a *LocalAuth) HandleLinkCredentials(config LinkCredentialsConfig, getUser GetLoggedInUserFunc) http.HandlerFunc

type OneAuth

+ func (a *OneAuth) GetLinkingUserID(r *http.Request) string

+ func (a *OneAuth) HandleLinkOAuthCallback(config LinkOAuthConfig, linkingUserID, provider string, ...)

+ func (a *OneAuth) StartLinkOAuth(r *http.Request, userID string)

+ type SignupPolicy struct

+ EnforceEmailUnique bool

+ EnforceUsernameUnique bool

+ MinPasswordLength int

+ RequireEmail bool

+ RequirePassword bool

+ RequirePhone bool

+ RequireUsername bool

+ UsernamePattern string

+ func DefaultSignupPolicy() SignupPolicy

+ func (p SignupPolicy) GetMinPasswordLength() int

+ func (p SignupPolicy) GetUsernamePattern() *regexp.Regexp

+ type UsernameStore interface

+ ChangeUsername func(oldUsername, newUsername, userID string) error

+ GetUserByUsername func(username string) (userID string, err error)

+ ReleaseUsername func(username string) error

+ ReserveUsername func(username string, userID string) error

Jan 14, 2026

Changes in this version

type APIAuth

+ func (a *APIAuth) VerifyTokenFunc() func(tokenString string) (userID string, token any, err error)

Jan 13, 2026

Changes in this version

+ const DefaultUserParamName

+ const ScopeAdmin

+ const ScopeOffline

+ const ScopeProfile

+ const ScopeRead

+ const ScopeWrite

+ const TokenExpiryAccessToken

+ const TokenExpiryRefreshToken

+ var ErrAPIKeyNotFound = fmt.Errorf("api key not found")

+ var ErrInvalidGrant = fmt.Errorf("invalid grant")

+ var ErrInvalidScope = fmt.Errorf("invalid scope")

+ var ErrTokenExpired = fmt.Errorf("token expired")

+ var ErrTokenNotFound = fmt.Errorf("token not found")

+ var ErrTokenReused = fmt.Errorf("token reuse detected")

+ var ErrTokenRevoked = fmt.Errorf("token revoked")

+ func AllBuiltinScopes() []string

+ func ContainsAllScopes(granted, required []string) bool

+ func ContainsScope(scopes []string, scope string) bool

+ func GenerateAPIKeyID() (string, error)

+ func GenerateAPIKeySecret() (string, error)

+ func GetAuthTypeFromAPIContext(ctx context.Context) string

+ func GetScopesFromAPIContext(ctx context.Context) []string

+ func GetUserIDFromAPIContext(ctx context.Context) string

+ func GetUserIDFromContext(ctx context.Context) string

+ func IntersectScopes(requested, allowed []string) []string

+ func JoinScopes(scopes []string) string

+ func ParseScopes(scopeString string) []string

+ func ScopesEqual(a, b []string) bool

+ func SetUserIDInContext(ctx context.Context, userID string) context.Context

+ func ValidateRequestedScopes(requested, allowed []string) (valid, invalid []string)

+ type APIAuth struct

+ APIKeyStore APIKeyStore

+ AccessTokenExpiry time.Duration

+ GetUserScopes GetUserScopesFunc

+ JWTAudience string

+ JWTIssuer string

+ JWTSecretKey string

+ JWTSigningAlg string

+ OnLoginFailure func(username string, r *http.Request, err error)

+ OnLoginSuccess func(userID string, r *http.Request)

+ RateLimiter RateLimiter

+ RefreshTokenExpiry time.Duration

+ RefreshTokenStore RefreshTokenStore

+ ValidateCredentials CredentialsValidator

+ func (a *APIAuth) HandleAPIKeys(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) HandleListSessions(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) HandleLogout(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) HandleLogoutAll(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) HandleRevokeAPIKey(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (a *APIAuth) ValidateAccessToken(tokenString string) (userID string, scopes []string, err error)

+ type APIKey struct

+ CreatedAt time.Time

+ ExpiresAt *time.Time

+ KeyHash string

+ KeyID string

+ LastUsedAt time.Time

+ Name string

+ Revoked bool

+ RevokedAt *time.Time

+ Scopes []string

+ UserID string

+ func (k *APIKey) IsExpired() bool

+ func (k *APIKey) IsValid() bool

+ type APIKeyStore interface

+ CreateAPIKey func(userID, name string, scopes []string, expiresAt *time.Time) (fullKey string, apiKey *APIKey, err error)

+ GetAPIKeyByID func(keyID string) (*APIKey, error)

+ ListUserAPIKeys func(userID string) ([]*APIKey, error)

+ RevokeAPIKey func(keyID string) error

+ UpdateAPIKeyLastUsed func(keyID string) error

+ ValidateAPIKey func(fullKey string) (*APIKey, error)

+ type APIMiddleware struct

+ APIKeyStore APIKeyStore

+ AuthHeader string

+ JWTAudience string

+ JWTIssuer string

+ JWTSecretKey string

+ JWTSigningAlg string

+ OnAuthError func(w http.ResponseWriter, r *http.Request, err error)

+ func (m *APIMiddleware) Optional(next http.Handler) http.Handler

+ func (m *APIMiddleware) RequireScopes(requiredScopes ...string) func(http.Handler) http.Handler

+ func (m *APIMiddleware) ValidateToken(next http.Handler) http.Handler

+ type GetUserScopesFunc func(userID string) ([]string, error)

+ func DefaultGetUserScopes() GetUserScopesFunc

+ type RateLimiter interface

+ Allow func(key string) bool

+ type RefreshToken struct

+ ClientID string

+ CreatedAt time.Time

+ DeviceInfo map[string]any

+ ExpiresAt time.Time

+ Family string

+ Generation int

+ LastUsedAt time.Time

+ Revoked bool

+ RevokedAt *time.Time

+ Scopes []string

+ Token string

+ TokenHash string

+ UserID string

+ func (t *RefreshToken) IsExpired() bool

+ func (t *RefreshToken) IsValid() bool

+ type RefreshTokenStore interface

+ CleanupExpiredTokens func() error

+ CreateRefreshToken func(userID, clientID string, deviceInfo map[string]any, scopes []string) (*RefreshToken, error)

+ GetRefreshToken func(token string) (*RefreshToken, error)

+ GetUserTokens func(userID string) ([]*RefreshToken, error)

+ RevokeRefreshToken func(token string) error

+ RevokeTokenFamily func(family string) error

+ RevokeUserTokens func(userID string) error

+ RotateRefreshToken func(oldToken string) (*RefreshToken, error)

+ type TokenError struct

+ Error string

+ ErrorDescription string

+ type TokenPair struct

+ AccessToken string

+ ExpiresIn int64

+ RefreshToken string

+ Scope string

+ TokenType string

+ type TokenRequest struct

+ ClientID string

+ GrantType string

+ Password string

+ RefreshToken string

+ Scope string

+ Username string

type TokenType

+ const TokenTypeRefresh

Nov 7, 2025

Changes in this version

+ const TokenExpiryEmailVerification

+ const TokenExpiryPasswordReset

+ func DetectUsernameType(username string) string

+ func GenerateSecureToken() (string, error)

+ func IdentityKey(identityType, identityValue string) string

+ type AuthToken struct

+ CreatedAt time.Time

+ Email string

+ ExpiresAt time.Time

+ Token string

+ Type TokenType

+ UserID string

+ func (t *AuthToken) IsExpired() bool

+ func (t *AuthToken) IsValid(expectedType TokenType) bool

+ type AuthUserStore interface

+ EnsureAuthUser func(authtype string, provider string, token *oauth2.Token, userInfo map[string]any) (User, error)

+ type Channel struct

+ CreatedAt time.Time

+ Credentials map[string]any

+ IdentityKey string

+ Profile map[string]any

+ Provider string

+ UpdatedAt time.Time

+ type ChannelStore interface

+ GetChannel func(provider string, identityKey string, createIfMissing bool) (channel *Channel, newCreated bool, err error)

+ GetChannelsByIdentity func(identityKey string) ([]*Channel, error)

+ SaveChannel func(channel *Channel) error

+ type ConsoleEmailSender struct

+ func (c *ConsoleEmailSender) SendPasswordResetEmail(to string, resetLink string) error

+ func (c *ConsoleEmailSender) SendVerificationEmail(to string, verificationLink string) error

+ type CreateUserFunc func(creds *Credentials) (User, error)

+ func NewCreateUserFunc(userStore UserStore, identityStore IdentityStore, channelStore ChannelStore) CreateUserFunc

+ type Credentials struct

+ Email *string

+ Password string

+ Phone *string

+ Username string

+ type CredentialsValidator func(username, password, usernameType string) (User, error)

+ func NewCredentialsValidator(identityStore IdentityStore, channelStore ChannelStore, userStore UserStore) CredentialsValidator

+ type Identity struct

+ CreatedAt time.Time

+ Type string

+ UserID string

+ Value string

+ Verified bool

+ type IdentityStore interface

+ GetIdentity func(identityType, identityValue string, createIfMissing bool) (identity *Identity, newCreated bool, err error)

+ GetUserIdentities func(userId string) ([]*Identity, error)

+ MarkIdentityVerified func(identityType, identityValue string) error

+ SaveIdentity func(identity *Identity) error

+ SetUserForIdentity func(identityType, identityValue string, newUserId string) error

type LocalAuth

+ BaseURL string

+ CreateUser CreateUserFunc

+ EmailField string

+ EmailSender SendEmail

+ PhoneField string

+ RequireEmailVerification bool

+ TokenStore TokenStore

+ UpdatePassword UpdatePasswordFunc

+ ValidateCredentials CredentialsValidator

+ ValidateSignup SignupValidator

+ VerifyEmail VerifyEmailFunc

+ func (a *LocalAuth) HandleForgotPassword(w http.ResponseWriter, r *http.Request)

+ func (a *LocalAuth) HandleForgotPasswordForm(w http.ResponseWriter, r *http.Request)

+ func (a *LocalAuth) HandleResetPassword(w http.ResponseWriter, r *http.Request)

+ func (a *LocalAuth) HandleResetPasswordForm(w http.ResponseWriter, r *http.Request)

+ func (a *LocalAuth) HandleSignup(w http.ResponseWriter, r *http.Request)

+ func (a *LocalAuth) HandleVerifyEmail(w http.ResponseWriter, r *http.Request)

+ type SendEmail interface

+ SendPasswordResetEmail func(to string, resetLink string) error

+ SendVerificationEmail func(to string, verificationLink string) error

+ type SignupValidator func(creds *Credentials) error

+ var DefaultSignupValidator SignupValidator = func(creds *Credentials) error { ... }

+ type TokenStore interface

+ CreateToken func(userID, email string, tokenType TokenType, expiryDuration time.Duration) (*AuthToken, error)

+ DeleteToken func(token string) error

+ DeleteUserTokens func(userID string, tokenType TokenType) error

+ GetToken func(token string) (*AuthToken, error)

+ type TokenType string

+ const TokenTypeEmailVerification

+ const TokenTypePasswordReset

+ type UpdatePasswordFunc func(email, newPassword string) error

+ func NewUpdatePasswordFunc(identityStore IdentityStore, channelStore ChannelStore) UpdatePasswordFunc

type UserStore

+ CreateUser func(userId string, isActive bool, profile map[string]any) (User, error)

+ GetUserById func(userId string) (User, error)

+ SaveUser func(user User) error

+ type VerifyEmailFunc func(token string) error

+ func NewVerifyEmailFunc(identityStore IdentityStore, tokenStore TokenStore) VerifyEmailFunc

Apr 25, 2025

Changes in this version

type OneAuth

+ SessionTimeoutInSeconds int

Apr 22, 2025

Changes in this version

type BasicUser

+ func (b *BasicUser) Profile() map[string]any

+ type HandleUserFunc func(authtype string, provider string, token *oauth2.Token, userInfo map[string]any, ...)

+ type LocalAuth struct

+ HandleUser HandleUserFunc

+ PasswordField string

+ Provider string

+ UsernameField string

+ ValidateUsernamePassword func(username string, password string) (User, error)

+ func (a *LocalAuth) ServeHTTP(w http.ResponseWriter, r *http.Request)

type User

+ Profile func() map[string]any

Jan 30, 2025

Changes in this version

type Middleware

+ AuthTokenCookieName string

+ AuthTokenHeaderName string

Jan 30, 2025

Changes in this version

type OneAuth

+ AppName string

+ CookieDomains []string

+ ValidateUsernamePassword func(username string, password string) bool

+ func (a *OneAuth) AddAuth(prefix string, handler http.Handler) *OneAuth

+ func (a *OneAuth) Handler() http.Handler

Jan 5, 2025

Changes in this version

+ type BasicUser struct

+ func (b *BasicUser) Id() string

+ type Middleware struct

+ CallbackURLParam string

+ DefaultRedirectURL string

+ GetRedirURL func(r *http.Request) string

+ SessionGetter func(r *http.Request, param string) any

+ UserParamName string

+ VerifyToken func(tokenString string) (loggedInUserId string, token any, err error)

+ func (a *Middleware) EnsureReasonableDefaults()

+ func (a *Middleware) EnsureUser(next http.Handler) http.Handler

+ func (a *Middleware) ExtractUser(next http.Handler) http.Handler

+ func (a *Middleware) GetLoggedInUserId(r *http.Request) string

+ type OneAuth struct

+ AuthTokenSessionVar string

+ BaseUrl *url.URL

+ JWTSecretKey string

+ JwtIssuer string

+ Middleware *Middleware

+ Session *scs.SessionManager

+ UserStore UserStore

+ func New() *OneAuth

+ func (a *OneAuth) EnsureDefaults() *OneAuth

+ func (a *OneAuth) SaveUserAndRedirect(authtype, provider string, token *oauth2.Token, ...)

+ func (a *OneAuth) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (a *OneAuth) SetupRoutes(router *mux.Router)

+ type User interface

+ Id func() string

+ type UserStore interface

+ EnsureAuthUser func(authtype string, provider string, token *oauth2.Token, userInfo map[string]any) (User, error)

+ GetUserByID func(userId string) (User, error)