Documentation
¶
Overview ¶
Package startup implements the identity module's part of the server start: seeding the first administrator of a fresh database, finding the administrators still signing in with a published default password, and the check and data fix-up that run once the schema is current. Only the module facade may reach it.
Index ¶
- type Deps
- type Service
- func (s *Service) CreateInitialAdministrator(ctx context.Context, email, plain string) (bool, error)
- func (s *Service) FindAdministratorsWithPassword(ctx context.Context, plain string) ([]*user.User, error)
- func (s *Service) NormalizePhoneNumbers(ctx context.Context) error
- func (s *Service) ReportLegacyAdministratorPasswords(ctx context.Context) error
- func (s *Service) ValidateEmailIdentities(ctx context.Context) error
- func (s *Service) WarnUnpinnedOAuthRedirects(ctx context.Context) error
- type Store
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Deps ¶
type Deps struct {
Users repository.UserRepo
UserAuths repository.UserAuthRepo
// Auths lists the configured sign-in methods, for the start-up check of
// the methods whose redirects need a site host; optional.
Auths repository.AuthRepo
// SiteHost snapshots the configured site host; optional.
SiteHost func() string
// Store carries the identity transaction that counts the accounts and
// creates the first administrator together.
Store Store
}
Deps declares the subdomain's dependencies; the module facade forwards them from the composition root.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service is the startup subdomain entry point used by the identity facade.
func NewService ¶
NewService builds the subdomain over the module's own repositories.
func (*Service) CreateInitialAdministrator ¶
func (s *Service) CreateInitialAdministrator(ctx context.Context, email, plain string) (bool, error)
CreateInitialAdministrator creates the first administrator, signing in with the verified email address (stored in its canonical form, the one sign-in looks up) and the password plain, when the database holds no account yet, and reports whether it created one. It is idempotent and safe to run on every start: once any account exists, the seeded administrator among them, nothing is created, so a configured email another account holds cannot fail a later start either. The count and the account share one identity transaction, so the account and its email binding are created together or not at all, and two starts cannot both seed. The refer code is set up front, as the bootstrap always did, so the account is written without a follow-up update.
func (*Service) FindAdministratorsWithPassword ¶
func (s *Service) FindAdministratorsWithPassword(ctx context.Context, plain string) ([]*user.User, error)
FindAdministratorsWithPassword returns the administrators, with their auth methods, who sign in with the password plain: the startup warns about those still using the password older releases seeded, which anyone can look up.
func (*Service) NormalizePhoneNumbers ¶
NormalizePhoneNumbers rewrites the phone numbers stored in another form than E.164 (the admin panel used to store "<area>-<number>") to E.164, the form sign-in and password resets look them up in, and logs what it did. It is idempotent: a number whose E.164 form another binding holds, or one that does not parse, is left as it is and reported. A failure is the repository's, as it reported it.
func (*Service) ReportLegacyAdministratorPasswords ¶
ReportLegacyAdministratorPasswords logs an error naming the ids of the administrators whose stored password hash is still a legacy format (md5, sha256, PBKDF2 or an imported bcrypt): those hashes stay accepted until their owner signs in, which rehashes them, so an administrator who never signs in keeps a weak hash. Only ids are logged, never addresses.
func (*Service) ValidateEmailIdentities ¶
ValidateEmailIdentities fails with EmailIdentityAmbiguous when two email bindings differ only in letter case or surrounding spaces: email sign-in and password resets would match both, so the server refuses to start until an operator resolved them. Other failures are the repository's, as it reported them.
func (*Service) WarnUnpinnedOAuthRedirects ¶
WarnUnpinnedOAuthRedirects logs an error when a sign-in method that sends the browser to a client-supplied redirect (Apple's form post, Telegram's widget) is enabled while no site host is configured. Their redirects are then pinned to the request's own Host header only, which a server exposed without a reverse proxy cannot trust; the operator should set the site host. It reports nothing when the site host is configured or no such method is enabled.
type Store ¶
type Store interface {
repository.IdentityTransactor
}
Store is the persistence capability required by this package. It excludes unrelated repositories and application-wide transactions.
Source Files