Documentation
¶
Overview ¶
Package auth implements passwordless, allowlist-closed authentication for team mode: magic-link issuance/verification and server-side cookie sessions. It is a library — no HTTP types cross its boundary; the gateway adapts it to endpoints.
Index ¶
- Constants
- Variables
- type Config
- type Principal
- type Service
- func (s *Service) Authenticate(ctx context.Context, rawSessionToken string) (*Principal, error)
- func (s *Service) Logout(ctx context.Context, rawSessionToken string) error
- func (s *Service) RequestMagicLink(ctx context.Context, email, clientIP string) error
- func (s *Service) VerifyMagicLink(ctx context.Context, rawToken string) (sessionToken string, u *ent.User, err error)
Constants ¶
const ( DefaultTokenTTL = 15 * time.Minute DefaultSessionTTL = 30 * 24 * time.Hour )
Defaults for token and session lifetimes.
Variables ¶
var ErrInvalidSession = errors.New("invalid or expired session")
ErrInvalidSession is returned for an unknown or expired session.
var ErrInvalidToken = errors.New("invalid or expired token")
ErrInvalidToken is returned for any magic-link failure (unknown, expired, or already consumed) — deliberately indistinguishable.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// BaseURL is the externally visible origin; magic links are built as
// BaseURL + "/api/auth/verify?token=...".
BaseURL string
// AppName is shown in the login email.
AppName string
// TokenTTL is the magic-link lifetime (default 15m).
TokenTTL time.Duration
// SessionTTL is the cookie session lifetime (default 30d).
SessionTTL time.Duration
// Logger defaults to slog.Default().
Logger *slog.Logger
}
Config configures the auth service.
type Principal ¶
type Principal struct {
UserID uuid.UUID
Username string
Email string
Superadmin bool
Disabled bool
}
Principal is the authenticated identity resolved from a session.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service performs authentication over the team store.
func NewService ¶
func NewService(st *store.Store, teamSvc *team.Service, mailer mail.Mailer, cfg Config) (*Service, error)
NewService creates the auth service.
func (*Service) Authenticate ¶
Authenticate resolves a session cookie token to a Principal, sliding the expiry when it is stale. Returns ErrInvalidSession for unknown/expired sessions or disabled users.
func (*Service) Logout ¶
Logout revokes the session identified by its raw cookie token. Unknown tokens are a no-op (idempotent logout).
func (*Service) RequestMagicLink ¶
RequestMagicLink issues and emails a login link when the email is allowed.
The response is uniform by contract: this returns nil for both allowed and non-allowed emails (doing nothing in the latter case), so callers cannot enumerate the allowlist. Only malformed input yields an error. Internal failures (token store, mail delivery) are logged, not surfaced — the operator sees them, the requester does not.
func (*Service) VerifyMagicLink ¶
func (s *Service) VerifyMagicLink(ctx context.Context, rawToken string) (sessionToken string, u *ent.User, err error)
VerifyMagicLink consumes a token and returns a new session's raw token (to be set as the cookie) plus the resolved user. Any failure returns ErrInvalidToken. A disabled user is rejected.
Source Files