authn

package
v1.21.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 29, 2026 License: GPL-3.0 Imports: 23 Imported by: 0

Documentation

Overview

Package authn implements the authentication subdomain of the identity module: account existence checks, password, code and device sign-in, registration, password resets and, through its oauth subpackage, OAuth sign-in. Every flow reads the client address and user agent from the request metadata.

Index

Constants

View Source 
const (
	ExistenceChecksPerMinute = 20
)

The existence checks tell whether an address or number has an account, which a sign-up form asks once per address a person types; a script asking for many is enumerating accounts. Each client address gets ExistenceChecksPerMinute checks per minute.

Variables

This section is empty.

Functions

This section is empty.

Types

type Deps 

type Deps struct {
	Store Store
	Redis *redis.Client
	// Config snapshots the runtime-mutable settings per request.
	Config func() Snapshot
	// OAuth runs the OAuth provider round trips; built from Store and Redis
	// when nil.
	OAuth *oauthflow.Flow
	// VerifyTurnstile overrides the Cloudflare Turnstile client; nil selects
	// it.
	VerifyTurnstile registerpolicy.TurnstileVerifier
	// NotifyPasswordChanged tells the account, best effort, that its
	// password was reset and which third-party sign-in methods stay bound;
	// optional.
	NotifyPasswordChanged func(ctx context.Context, userID int64, bindings []string) error
}

Deps declares the subdomain's dependencies; the identity facade forwards them from the composition root.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service is the authentication subdomain entry point used by the identity facade.

func NewService 

func NewService(deps Deps) *Service

NewService builds the subdomain with its account policy and, unless Deps carries one, its OAuth round trip.

func (*Service) AppleLoginCallback 

func (s *Service) AppleLoginCallback(ctx context.Context, req *dto.AppleLoginCallbackRequest) (*oauth.AppleLoginRedirect, error)

func (*Service) BindDeviceToUser added in v1.21.0 

func (s *Service) BindDeviceToUser(ctx context.Context, deviceIdentifier string, userID int64) (*user.Device, error)

BindDeviceToUser creates a binding or refreshes the current owner's device. An identifier is not proof of ownership: never move another user's binding or disable that account. Anonymous users can add email/mobile credentials through authenticated profile binding without abandoning their account.

func (*Service) CheckUser 

func (s *Service) CheckUser(ctx context.Context, req *dto.CheckUserRequest) (*dto.CheckUserResponse, error)

CheckUser reports whether an account signs in with the email address.

func (*Service) CheckUserTelephone 

func (s *Service) CheckUserTelephone(ctx context.Context, req *dto.TelephoneCheckUserRequest) (*dto.TelephoneCheckUserResponse, error)

CheckUserTelephone reports whether an account signs in with the phone number.

func (*Service) DeviceLogin 

func (s *Service) DeviceLogin(ctx context.Context, req *dto.DeviceLoginRequest) (resp *dto.LoginResponse, err error)

DeviceLogin signs in with a device identifier. A device seen for the first time registers a new account when registration is open.

The identifier is a bearer credential, so guessing it is capped like a password: per identifier and per client address, counted before the lookup so a burst cannot exceed the limit, and the identifier's count is cleared by a successful sign-in. The Turnstile challenge for sign-ins applies when it is switched on; a first-time device then needs no second challenge for its registration, since a Turnstile token is redeemed once.

func (*Service) OAuthLogin 

func (s *Service) OAuthLogin(ctx context.Context, req *dto.OAuthLoginRequest) (*dto.OAuthLoginResponse, error)

func (*Service) OAuthLoginGetToken 

func (s *Service) OAuthLoginGetToken(ctx context.Context, req *dto.OAuthLoginGetTokenRequest) (*dto.LoginResponse, error)

func (*Service) Policy 

func (s *Service) Policy() registerpolicy.Policy

Policy exposes the account policy to sibling subdomains (the profile and verification-code flows gate on the same switches).

func (*Service) ResetPassword 

func (s *Service) ResetPassword(ctx context.Context, req *dto.ResetPasswordRequest) (*dto.LoginResponse, error)

ResetPassword sets a new password for the account of an email address, proven by a security code sent to it, and signs the account in.

func (*Service) TelephoneLogin 

func (s *Service) TelephoneLogin(ctx context.Context, req *dto.TelephoneLoginRequest) (resp *dto.LoginResponse, err error)

TelephoneLogin signs in with a phone number and either its password or a security code sent to the number.

func (*Service) TelephoneResetPassword 

func (s *Service) TelephoneResetPassword(ctx context.Context, req *dto.TelephoneResetPasswordRequest) (*dto.LoginResponse, error)

TelephoneResetPassword sets a new password for the account of a phone number, proven by a security code sent to it, and signs the account in.

func (*Service) TelephoneUserRegister 

func (s *Service) TelephoneUserRegister(ctx context.Context, req *dto.TelephoneRegisterRequest) (resp *dto.LoginResponse, err error)

TelephoneUserRegister creates an account that signs in with a phone number, proven by a registration code sent to it, and signs it in.

func (*Service) UserLogin 

func (s *Service) UserLogin(ctx context.Context, req *dto.UserLoginRequest) (resp *dto.LoginResponse, err error)

UserLogin signs in with an email address and password.

func (*Service) UserRegister 

func (s *Service) UserRegister(ctx context.Context, req *dto.UserRegisterRequest) (resp *dto.LoginResponse, err error)

UserRegister creates an account that signs in with an email address and password, and signs it in.

type Snapshot 

type Snapshot struct {
	JWTAccessSecret string
	JWTAccessExpire int64

	EmailEnabled            bool
	EmailVerifyEnabled      bool
	EmailDomainSuffixList   string
	EmailEnableDomainSuffix bool
	MobileEnabled           bool
	DeviceEnabled           bool
	DeviceOnlyReal          bool

	InviteForced      bool
	OnlyFirstPurchase bool

	StopRegister bool
	// RegisterVerify, LoginVerify and ResetPasswordVerify switch the
	// Turnstile challenge on for registration, sign-in and password reset.
	RegisterVerify          bool
	LoginVerify             bool
	ResetPasswordVerify     bool
	TurnstileSecret         string
	EnableIpRegisterLimit   bool
	IpRegisterLimit         int64
	IpRegisterLimitDuration int64

	// SiteHost anchors the OAuth redirect allowlist and is the fallback
	// redirect target for the Apple form-post callback.
	SiteHost string
}

Snapshot is the per-request view of every runtime-mutable setting the authentication flows consume.

type Store added in v1.20.3 

type Store interface {
	Auth() repository.AuthRepo
	repository.IdentityTransactor
	Log() repository.LogRepo
	User() repository.UserRepo
	UserAuth() repository.UserAuthRepo
	UserDevice() repository.UserDeviceRepo
}

Store is the persistence capability required by this package. It excludes unrelated repositories and application-wide transactions.

Source Files

View all Source files

Directories

Path Synopsis
Package oauth implements OAuth sign-in: the authorization URL, the callback that signs an existing account in or registers a new one, and Apple's form-post callback.
 Package oauth implements OAuth sign-in: the authorization URL, the callback that signs an existing account in or registers a new one, and Apple's form-post callback.
Package registerpolicy enforces the administrator-configured account policies shared by every authentication and registration path.
 Package registerpolicy enforces the administrator-configured account policies shared by every authentication and registration path.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.