systemauth

package

Go to main page

Versions in this module

v0

v0.13.0

Oct 7, 2026

Changes in this version

type Config

+ func DecodeConfig(data []byte, format ConfigFormat) (*Config, error)

+ func DecodeConfigFile(path string) (*Config, error)

type Server

+ func (s *Server) OpenIDConfiguration() OpenIDConfiguration

+ func (s *Server) Ready(ctx context.Context) error

v0.12.0

Oct 6, 2026

Changes in this version

+ const ConsentPath

+ const DefaultStoreCleanupInterval

+ const HealthzPath

+ const IDPHintParam

+ const LoginCookieName

+ const LoginPath

+ const LogoutPath

+ const ReadyzPath

+ const UserInfoPath

+ var ErrEmailConflict = errors.New("systemauth: email already belongs to an account that cannot be linked")

+ var ErrEmailNotVerified = errors.New("systemauth: upstream email is not verified")

+ var ErrExternalIdentityExists = errors.New("systemauth: external identity already linked")

+ var ErrInvalidConfig = errors.New("systemauth: invalid configuration")

+ var ErrInvalidSigningKey = errors.New("systemauth: invalid signing key")

+ var ErrInvalidSocialLoginConfig = errors.New("systemauth: invalid social login configuration")

+ var ErrLoginSessionNotFound = errors.New("systemauth: login session not found")

+ var ErrPrincipalInactive = errors.New("systemauth: principal is inactive")

+ var ErrPrincipalNotFound = errors.New("systemauth: principal not found")

+ var ErrRedirectNotAllowed = errors.New("systemauth: redirect target not allowed")

+ func KeyThumbprint(key *rsa.PrivateKey) (string, error)

+ func ParseSigningKey(pemData []byte) (*rsa.PrivateKey, error)

+ func UserInfoClaims(subject string, claims map[string]any, granted []string) map[string]any

type Config

+ SocialLogin *SocialLoginConfig

+ type ConsentStore interface

+ HasConsent func(ctx context.Context, principalID, clientID string, scopes []string) (bool, error)

+ RevokeConsent func(ctx context.Context, principalID, clientID string) error

+ SaveConsent func(ctx context.Context, principalID, clientID string, scopes []string) error

+ type EntConsentStore struct

+ func NewEntConsentStore(client *ent.Client) *EntConsentStore

+ func (s *EntConsentStore) HasConsent(ctx context.Context, principalID, clientID string, scopes []string) (bool, error)

+ func (s *EntConsentStore) RevokeConsent(ctx context.Context, principalID, clientID string) error

+ func (s *EntConsentStore) SaveConsent(ctx context.Context, principalID, clientID string, scopes []string) error

+ type EntLoginSessionStore struct

+ func NewEntLoginSessionStore(client *ent.Client, opts ...EntStoreOption) *EntLoginSessionStore

+ func (s *EntLoginSessionStore) Create(ctx context.Context, token string, session LoginSession) error

+ func (s *EntLoginSessionStore) Delete(ctx context.Context, token string) error

+ func (s *EntLoginSessionStore) DeleteExpired(ctx context.Context) (int, error)

+ func (s *EntLoginSessionStore) Get(ctx context.Context, token string) (LoginSession, error)

+ type EntLoginStateStore struct

+ func NewEntLoginStateStore(client *ent.Client, opts ...EntStoreOption) *EntLoginStateStore

+ func (s *EntLoginStateStore) DeleteExpired(ctx context.Context) (int, error)

+ func (s *EntLoginStateStore) Put(ctx context.Context, state string, data oauthclient.StateData, ...) error

+ func (s *EntLoginStateStore) Take(ctx context.Context, state string) (oauthclient.StateData, error)

+ type EntPrincipalDirectory struct

+ func NewEntPrincipalDirectory(db *ent.Client) *EntPrincipalDirectory

+ func (d *EntPrincipalDirectory) CreateFromExternal(ctx context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) FindByExternalIdentity(ctx context.Context, provider, subject string) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) FindByVerifiedEmail(ctx context.Context, email string) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) GetPrincipal(ctx context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) LinkExternalIdentity(ctx context.Context, principalID uuid.UUID, login ExternalLogin) error

+ func (d *EntPrincipalDirectory) RecordLogin(ctx context.Context, principalID uuid.UUID, login ExternalLogin, at time.Time) error

type EntStorage

+ func (s *EntStorage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ func (s *EntStorage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

+ func (s *EntStorage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ func (s *EntStorage) RevokeSubjectTokens(ctx context.Context, subject string) error

+ type EntStoreOption func(*entStoreConfig)

+ func WithCleanupInterval(d time.Duration) EntStoreOption

+ type ExternalLogin struct

+ AvatarURL string

+ Email string

+ EmailVerified bool

+ Name string

+ Provider string

+ Subject string

type KeyConfig

+ KeyID string

+ PrivateKeyFile string

+ PrivateKeyPEM string

+ func (k *KeyConfig) HasSigningKey() bool

+ func (k *KeyConfig) LoadSigningKey() error

+ type LoginPrincipal struct

+ Active bool

+ AvatarURL string

+ DisplayName string

+ Email string

+ EmailVerified bool

+ ID uuid.UUID

+ func ResolveExternalLogin(ctx context.Context, dir PrincipalDirectory, login ExternalLogin, ...) (*LoginPrincipal, error)

+ type LoginSession struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ PrincipalID uuid.UUID

+ Provider string

+ type LoginSessionStore interface

+ Create func(ctx context.Context, token string, session LoginSession) error

+ Delete func(ctx context.Context, token string) error

+ Get func(ctx context.Context, token string) (LoginSession, error)

+ type MemoryConsentStore struct

+ func NewMemoryConsentStore() *MemoryConsentStore

+ func (s *MemoryConsentStore) HasConsent(_ context.Context, principalID, clientID string, scopes []string) (bool, error)

+ func (s *MemoryConsentStore) RevokeConsent(_ context.Context, principalID, clientID string) error

+ func (s *MemoryConsentStore) SaveConsent(_ context.Context, principalID, clientID string, scopes []string) error

+ type MemoryLoginSessionStore struct

+ func NewMemoryLoginSessionStore() *MemoryLoginSessionStore

+ func (s *MemoryLoginSessionStore) Create(_ context.Context, token string, session LoginSession) error

+ func (s *MemoryLoginSessionStore) Delete(_ context.Context, token string) error

+ func (s *MemoryLoginSessionStore) Get(_ context.Context, token string) (LoginSession, error)

+ type MemoryPrincipalDirectory struct

+ func NewMemoryPrincipalDirectory() *MemoryPrincipalDirectory

+ func (d *MemoryPrincipalDirectory) AddPrincipal(p LoginPrincipal) error

+ func (d *MemoryPrincipalDirectory) CreateFromExternal(_ context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) FindByExternalIdentity(_ context.Context, provider, subject string) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) FindByVerifiedEmail(_ context.Context, email string) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) GetPrincipal(_ context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) LastLogin(id uuid.UUID) (time.Time, bool)

+ func (d *MemoryPrincipalDirectory) LinkExternalIdentity(_ context.Context, principalID uuid.UUID, login ExternalLogin) error

+ func (d *MemoryPrincipalDirectory) RecordLogin(_ context.Context, principalID uuid.UUID, _ ExternalLogin, at time.Time) error

type MemoryStorage

+ func (s *MemoryStorage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ func (s *MemoryStorage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

+ func (s *MemoryStorage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ func (s *MemoryStorage) RevokeSubjectTokens(ctx context.Context, subject string) error

type Option

+ func WithConsentStore(store ConsentStore) Option

+ func WithLoginSessionStore(store LoginSessionStore) Option

+ func WithLoginStateStore(store oauthclient.StateStore) Option

+ func WithPrincipalDirectory(dir PrincipalDirectory) Option

+ func WithReadinessCheck(name string, check func(context.Context) error) Option

+ func WithSocialConnector(c *oauthclient.Connector) Option

+ type PrincipalDirectory interface

+ CreateFromExternal func(ctx context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ FindByExternalIdentity func(ctx context.Context, provider, subject string) (*LoginPrincipal, error)

+ FindByVerifiedEmail func(ctx context.Context, email string) (*LoginPrincipal, error)

+ GetPrincipal func(ctx context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ LinkExternalIdentity func(ctx context.Context, principalID uuid.UUID, login ExternalLogin) error

+ RecordLogin func(ctx context.Context, principalID uuid.UUID, login ExternalLogin, at time.Time) error

type Server

+ func (s *Server) CurrentLoginSession(r *http.Request) (*LoginSession, error)

+ func (s *Server) KeyID() string

+ type Session struct

+ AccessClaims *jwt.JWTClaims

+ AccessHeader *jwt.Headers

+ FamilyIssuedAt time.Time

+ func (s *Session) Clone() fosite.Session

+ func (s *Session) GetJWTClaims() jwt.JWTClaimsContainer

+ func (s *Session) GetJWTHeader() *jwt.Headers

+ type SocialLoginConfig struct

+ AllowedRedirectOrigins []string

+ DefaultRedirect string

+ GitHub *SocialProviderConfig

+ Google *SocialProviderConfig

+ InsecureCookies bool

+ SessionLifetime Duration

+ SkipConsent bool

+ type SocialProviderConfig struct

+ ClientID string

+ ClientSecret string

+ RedirectURL string

+ Scopes []string

type Storage

+ CreateOpenIDConnectSession func(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ DeleteOpenIDConnectSession func(ctx context.Context, authorizeCode string) error

+ GetOpenIDConnectSession func(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ type SubjectTokenRevoker interface

+ RevokeSubjectTokens func(ctx context.Context, subject string) error

type TokenConfig

+ RefreshTokenAbsoluteLifetime Duration

+ type UserInfoInput struct

+ Authorization string

+ type UserInfoOutput struct

+ Body map[string]any

v0.11.0

Oct 3, 2026

Changes in this version

+ var ErrAuthCodeExpired = errors.New("systemauth: authorization code expired")

+ var ErrAuthCodeNotFound = errors.New("systemauth: authorization code not found")

+ var ErrAuthCodeUsed = errors.New("systemauth: authorization code already used")

+ var ErrClientExists = errors.New("systemauth: client already exists")

+ var ErrClientNotFound = errors.New("systemauth: client not found")

+ var ErrFederationConnectionFailed = errors.New("systemauth: failed to connect to SystemAuth")

+ var ErrFederationNotConfigured = errors.New("systemauth: federation not configured")

+ var ErrInvalidClientType = errors.New("systemauth: invalid client type")

+ var ErrInvalidCredentials = errors.New("invalid credentials")

+ var ErrInvalidGlobalToken = errors.New("systemauth: invalid global identity token")

+ var ErrInvalidToken = errors.New("systemauth: invalid token")

+ var ErrKeyGenerationFailed = errors.New("systemauth: failed to generate signing key")

+ var ErrMissingIssuer = errors.New("systemauth: issuer is required")

+ var ErrPKCEVerificationFailed = errors.New("systemauth: PKCE verification failed")

+ var ErrSessionExpired = errors.New("session expired")

+ var ErrSessionNotFound = errors.New("session not found")

+ var ErrSessionRevoked = errors.New("session revoked")

+ var ErrStorageInitFailed = errors.New("systemauth: failed to initialize storage")

+ var ErrTokenExpired = errors.New("systemauth: token expired")

+ var ErrTokenNotFound = errors.New("systemauth: token not found")

+ var ErrTokenRevoked = errors.New("systemauth: token revoked")

+ var ErrUserExists = errors.New("systemauth: user already exists")

+ var ErrUserNotFound = errors.New("systemauth: user not found")

+ func AccessRequestFromContext(ctx context.Context) fosite.AccessRequester

+ func ContextWithOwnerID(ctx context.Context, ownerID uuid.UUID) context.Context

+ func LoggerFromContext(ctx context.Context) *slog.Logger

+ func SaveConfig(cfg *Config, path string) error

+ func WithAccessRequest(ctx context.Context, ar fosite.AccessRequester) context.Context

+ type AuthCodeData struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ ExpiresAt int64

+ GrantedScopes []string

+ Nonce string

+ RedirectURI string

+ Scopes []string

+ Session *StoredSession

+ Signature string

+ State string

+ Subject string

+ Used bool

+ type AuthMethod string

+ const AuthMethodOIDC

+ const AuthMethodPassword

+ const AuthMethodTOTP

+ const AuthMethodWebAuthn

+ type AuthSession struct

+ Active bool

+ AuthenticatedAt time.Time

+ AuthenticationMethods []AuthMethod

+ DeviceInfo *DeviceInfo

+ ExpiresAt time.Time

+ ID string

+ Identity *Identity

+ IdentityID uuid.UUID

+ Token string

+ type AuthenticateRequest struct

+ DeviceInfo *DeviceInfo

+ Identifier string

+ Method AuthMethod

+ OIDCProvider string

+ OIDCToken string

+ Password string

+ type AuthenticationProvider interface

+ Authenticate func(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

+ ListSessions func(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)

+ RefreshSession func(ctx context.Context, sessionToken string) (*AuthSession, error)

+ RevokeSession func(ctx context.Context, sessionToken string) error

+ RevokeSessions func(ctx context.Context, identityID uuid.UUID) error

+ ValidateSession func(ctx context.Context, sessionToken string) (*AuthSession, error)

+ type AuthorizationSession struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ ConsentGranted bool

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ GrantedScopes []string

+ Nonce string

+ RedirectURI string

+ RequestID string

+ Scopes []string

+ State string

+ UserID string

+ func NewAuthorizationSession(ar fosite.AuthorizeRequester) *AuthorizationSession

+ func (s *AuthorizationSession) IsExpired() bool

+ type AuthorizeInput struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ Nonce string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ type AuthorizeOutput struct

+ Location string

+ type Client struct

+ AccessTokenLifetime *time.Duration

+ Audience []string

+ CreatedAt time.Time

+ Description string

+ GrantTypes []string

+ ID string

+ Metadata map[string]any

+ Name string

+ RedirectURIs []string

+ RefreshTokenLifetime *time.Duration

+ ResponseTypes []string

+ Scopes []string

+ Secret string

+ SecretHash string

+ Type ClientType

+ UpdatedAt time.Time

+ func NewClientFromConfig(cfg ClientConfig) (*Client, error)

+ func (c *Client) GetAudience() fosite.Arguments

+ func (c *Client) GetGrantTypes() fosite.Arguments

+ func (c *Client) GetHashedSecret() []byte

+ func (c *Client) GetID() string

+ func (c *Client) GetRedirectURIs() []string

+ func (c *Client) GetResponseTypes() fosite.Arguments

+ func (c *Client) GetScopes() fosite.Arguments

+ func (c *Client) IsPublic() bool

+ func (c *Client) ValidateSecret(secret string) bool

+ type ClientConfig struct

+ AccessTokenLifetime *Duration

+ Audience []string

+ Description string

+ GrantTypes []string

+ ID string

+ Name string

+ RedirectURIs []string

+ RefreshTokenLifetime *Duration

+ ResponseTypes []string

+ Scopes []string

+ Secret string

+ Type string

+ type ClientManager interface

+ CreateClient func(ctx context.Context, client *Client) error

+ DeleteClient func(ctx context.Context, id string) error

+ GetClientByID func(ctx context.Context, id string) (*Client, error)

+ ListClients func(ctx context.Context) ([]*Client, error)

+ UpdateClient func(ctx context.Context, client *Client) error

+ type ClientType string

+ const ClientTypeConfidential

+ const ClientTypePublic

+ type Config struct

+ Clients []ClientConfig

+ Database *DatabaseConfig

+ Features FeatureConfig

+ Federation *FederationConfig

+ Issuer string

+ Keys KeyConfig

+ Tokens TokenConfig

+ func DefaultConfig(issuer string) *Config

+ func LoadConfig(path string) (*Config, error)

+ func ParseConfig(data []byte, format ConfigFormat) (*Config, error)

+ func (c *Config) ApplyDefaults()

+ func (c *Config) Validate() error

+ type ConfigFormat string

+ const FormatJSON

+ const FormatYAML

+ type ConsentSession struct

+ AccessToken map[string]any

+ IDToken map[string]any

+ type CredentialType string

+ const CredentialTypeOIDC

+ const CredentialTypePassword

+ const CredentialTypeTOTP

+ const CredentialTypeWebAuthn

+ type DatabaseConfig struct

+ DSN string

+ Driver string

+ type DefaultIdentitySyncHandler struct

+ func NewDefaultIdentitySyncHandler(storage Storage) *DefaultIdentitySyncHandler

+ func (h *DefaultIdentitySyncHandler) SyncIdentity(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)

+ type DefaultSessionProvider struct

+ func NewDefaultSessionProvider(opts ...DefaultSessionProviderOption) *DefaultSessionProvider

+ func (p *DefaultSessionProvider) GetAuthenticatedUser(r *http.Request) string

+ func (p *DefaultSessionProvider) GetUserClaims(_ context.Context, userID string, _ []string) map[string]interface{}

+ func (p *DefaultSessionProvider) HasConsent(_ context.Context, _, _ string, _ []string) bool

+ func (p *DefaultSessionProvider) RedirectToConsent(returnURL string) string

+ func (p *DefaultSessionProvider) RedirectToLogin(returnURL string) string

+ func (p *DefaultSessionProvider) SaveConsent(_ context.Context, _, _ string, _ []string) error

+ type DefaultSessionProviderOption func(*DefaultSessionProvider)

+ func WithConsentURL(url string) DefaultSessionProviderOption

+ func WithLoginURL(url string) DefaultSessionProviderOption

+ func WithSkipConsent(skip bool) DefaultSessionProviderOption

+ func WithUserIDHeader(header string) DefaultSessionProviderOption

+ type DeviceInfo struct

+ DeviceID string

+ IPAddress string

+ UserAgent string

+ type Duration time.Duration

+ func (Duration) JSONSchema() *jsonschema.Schema

+ func (d *Duration) UnmarshalJSON(b []byte) error

+ func (d *Duration) UnmarshalYAML(unmarshal func(interface{}) error) error

+ func (d Duration) Duration() time.Duration

+ func (d Duration) MarshalJSON() ([]byte, error)

+ func (d Duration) MarshalYAML() (interface{}, error)

+ type EmbeddedAuthProvider struct

+ func NewEmbeddedAuthProvider(identityProvider IdentityProvider, opts ...EmbeddedAuthProviderOption) *EmbeddedAuthProvider

+ func (p *EmbeddedAuthProvider) Authenticate(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

+ func (p *EmbeddedAuthProvider) ListSessions(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)

+ func (p *EmbeddedAuthProvider) RefreshSession(ctx context.Context, sessionToken string) (*AuthSession, error)

+ func (p *EmbeddedAuthProvider) RevokeSession(ctx context.Context, sessionToken string) error

+ func (p *EmbeddedAuthProvider) RevokeSessions(ctx context.Context, identityID uuid.UUID) error

+ func (p *EmbeddedAuthProvider) ValidateSession(ctx context.Context, sessionToken string) (*AuthSession, error)

+ type EmbeddedAuthProviderOption func(*EmbeddedAuthProvider)

+ func WithPasswordVerifier(...) EmbeddedAuthProviderOption

+ func WithSessionDuration(d time.Duration) EmbeddedAuthProviderOption

+ type EmbeddedIdentityProvider struct

+ func NewEmbeddedIdentityProvider(storage Storage) *EmbeddedIdentityProvider

+ func (p *EmbeddedIdentityProvider) CreateIdentity(ctx context.Context, identity *Identity) error

+ func (p *EmbeddedIdentityProvider) DeleteIdentity(ctx context.Context, id uuid.UUID) error

+ func (p *EmbeddedIdentityProvider) GetIdentity(ctx context.Context, id uuid.UUID) (*Identity, error)

+ func (p *EmbeddedIdentityProvider) GetIdentityByEmail(ctx context.Context, email string) (*Identity, error)

+ func (p *EmbeddedIdentityProvider) ListIdentities(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)

+ func (p *EmbeddedIdentityProvider) UpdateIdentity(ctx context.Context, identity *Identity) error

+ type EmbeddedOAuthClientStore struct

+ func NewEmbeddedOAuthClientStore(storage Storage) *EmbeddedOAuthClientStore

+ func (s *EmbeddedOAuthClientStore) CreateClient(ctx context.Context, client *OAuthClient) error

+ func (s *EmbeddedOAuthClientStore) DeleteClient(ctx context.Context, clientID string) error

+ func (s *EmbeddedOAuthClientStore) GetClient(ctx context.Context, clientID string) (*OAuthClient, error)

+ func (s *EmbeddedOAuthClientStore) ListClients(ctx context.Context) ([]*OAuthClient, error)

+ func (s *EmbeddedOAuthClientStore) UpdateClient(ctx context.Context, client *OAuthClient) error

+ type EmbeddedOAuthProvider struct

+ func NewEmbeddedOAuthProvider(server *Server) *EmbeddedOAuthProvider

+ func (p *EmbeddedOAuthProvider) AcceptConsent(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

+ func (p *EmbeddedOAuthProvider) AcceptLogin(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

+ func (p *EmbeddedOAuthProvider) Authorize(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

+ func (p *EmbeddedOAuthProvider) GetConsentRequest(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

+ func (p *EmbeddedOAuthProvider) GetLoginRequest(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

+ func (p *EmbeddedOAuthProvider) Introspect(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

+ func (p *EmbeddedOAuthProvider) RejectConsent(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

+ func (p *EmbeddedOAuthProvider) RejectLogin(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)

+ func (p *EmbeddedOAuthProvider) Revoke(ctx context.Context, token string, tokenTypeHint string) error

+ func (p *EmbeddedOAuthProvider) Token(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

+ func (p *EmbeddedOAuthProvider) UserInfo(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

+ type EntStorage struct

+ func NewEntStorage(db *ent.Client, opts ...EntStorageOption) *EntStorage

+ func (s *EntStorage) ClientAssertionJWTValid(ctx context.Context, jti string) error

+ func (s *EntStorage) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *EntStorage) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error

+ func (s *EntStorage) CreateClient(ctx context.Context, client *Client) error

+ func (s *EntStorage) CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error

+ func (s *EntStorage) CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, ...) error

+ func (s *EntStorage) CreateUser(ctx context.Context, user *User) error

+ func (s *EntStorage) DeleteAccessTokenSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteClient(ctx context.Context, id string) error

+ func (s *EntStorage) DeletePKCERequestSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteUser(ctx context.Context, id uuid.UUID) error

+ func (s *EntStorage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetClient(ctx context.Context, clientID string) (fosite.Client, error)

+ func (s *EntStorage) GetClientByID(ctx context.Context, id string) (*Client, error)

+ func (s *EntStorage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetUserByEmail(ctx context.Context, email string) (*User, error)

+ func (s *EntStorage) GetUserByFederationID(ctx context.Context, federationID uuid.UUID) (*User, error)

+ func (s *EntStorage) GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)

+ func (s *EntStorage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

+ func (s *EntStorage) ListClients(ctx context.Context) ([]*Client, error)

+ func (s *EntStorage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (s *EntStorage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ func (s *EntStorage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

+ func (s *EntStorage) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

+ func (s *EntStorage) UpdateClient(ctx context.Context, client *Client) error

+ func (s *EntStorage) UpdateUser(ctx context.Context, user *User) error

+ func (s *EntStorage) ValidateSecretArgon2id(ctx context.Context, clientID, secret string) error

+ type EntStorageOption func(*EntStorage)

+ func WithDefaultOwner(ownerID uuid.UUID) EntStorageOption

+ type FeatureConfig struct

+ AllowDynamicRegistration bool

+ EnableDeviceFlow bool

+ EnableJWTAccessTokens bool

+ RequirePKCE bool

+ type FederationClient struct

+ func NewFederationClient(config *FederationConfig) (*FederationClient, error)

+ func (c *FederationClient) Config() *FederationConfig

+ func (c *FederationClient) Discovery() *SystemAuthDiscovery

+ func (c *FederationClient) ExchangeCode(ctx context.Context, code, redirectURI string) (*SSOTokenResponse, error)

+ func (c *FederationClient) GetGlobalIdentity(ctx context.Context, globalID uuid.UUID) (*GlobalIdentity, error)

+ func (c *FederationClient) GetIdentityMapping(ctx context.Context, globalID uuid.UUID) (*IdentityMapping, error)

+ func (c *FederationClient) GetSSOAuthorizationURL(ctx context.Context, state, redirectURI string) (string, error)

+ func (c *FederationClient) Initialize(ctx context.Context) error

+ func (c *FederationClient) NotifyAppAccess(ctx context.Context, sessionID uuid.UUID) error

+ func (c *FederationClient) RegisterWithSystemAuth(ctx context.Context, federationID uuid.UUID, displayName, baseURL string, ...) error

+ func (c *FederationClient) ValidateSSOSession(ctx context.Context, sessionID uuid.UUID) (*SSOSession, error)

+ type FederationConfig struct

+ AppID string

+ ClientID string

+ ClientSecret string

+ Enabled bool

+ SystemAuthURL string

+ type FederationEndpoints struct

+ func NewFederationEndpoints(server *Server, syncHandler IdentitySyncHandler) *FederationEndpoints

+ func (f *FederationEndpoints) RegisterRoutes()

+ type FederationHealthResponse struct

+ AppID string

+ Capabilities []string

+ Details map[string]string

+ Status string

+ Version string

+ type GlobalIdentity struct

+ Attributes map[string]interface{}

+ CreatedAt time.Time

+ DisplayName string

+ Email string

+ FederationID uuid.UUID

+ ID uuid.UUID

+ Status string

+ UpdatedAt time.Time

+ type Identity struct

+ CreatedAt time.Time

+ Credentials []IdentityCredential

+ ID uuid.UUID

+ Metadata map[string]any

+ State IdentityState

+ Traits IdentityTraits

+ UpdatedAt time.Time

+ type IdentityCredential struct

+ Identifiers []string

+ Type CredentialType

+ type IdentityFilter struct

+ Email string

+ Page int

+ PageSize int

+ State IdentityState

+ type IdentityMapping struct

+ AppID string

+ GlobalIdentityID uuid.UUID

+ ID uuid.UUID

+ LocalPrincipalID uuid.UUID

+ MappedAt time.Time

+ SyncStatus string

+ type IdentityProvider interface

+ CreateIdentity func(ctx context.Context, identity *Identity) error

+ DeleteIdentity func(ctx context.Context, id uuid.UUID) error

+ GetIdentity func(ctx context.Context, id uuid.UUID) (*Identity, error)

+ GetIdentityByEmail func(ctx context.Context, email string) (*Identity, error)

+ ListIdentities func(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)

+ UpdateIdentity func(ctx context.Context, identity *Identity) error

+ type IdentityState string

+ const IdentityStateActive

+ const IdentityStateInactive

+ type IdentitySyncHandler interface

+ SyncIdentity func(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)

+ type IdentitySyncRequest struct

+ Action string

+ Identity *GlobalIdentity

+ type IdentitySyncResponse struct

+ Error string

+ LocalPrincipalID uuid.UUID

+ Status string

+ type IdentityTraits struct

+ Email string

+ EmailVerified bool

+ FamilyName string

+ GivenName string

+ Locale string

+ Name string

+ Picture string

+ type IntrospectInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type IntrospectOutput struct

+ Body IntrospectResponse

+ type IntrospectResponse struct

+ Active bool

+ Aud string

+ ClientID string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type JWKSInput struct

+ type JWKSOutput struct

+ Body jose.JSONWebKeySet

+ type KeyConfig struct

+ Algorithm string

+ PrivateKey *rsa.PrivateKey

+ RotationDays int

+ type MemoryStorage struct

+ func NewMemoryStorage() *MemoryStorage

+ func (s *MemoryStorage) CleanupExpired(ctx context.Context) error

+ func (s *MemoryStorage) ClientAssertionJWTValid(ctx context.Context, jti string) error

+ func (s *MemoryStorage) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *MemoryStorage) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error

+ func (s *MemoryStorage) CreateClient(ctx context.Context, client *Client) error

+ func (s *MemoryStorage) CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error

+ func (s *MemoryStorage) CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, ...) error

+ func (s *MemoryStorage) CreateUser(ctx context.Context, user *User) error

+ func (s *MemoryStorage) DeleteAccessTokenSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteClient(ctx context.Context, id string) error

+ func (s *MemoryStorage) DeletePKCERequestSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteUser(ctx context.Context, id uuid.UUID) error

+ func (s *MemoryStorage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetClient(ctx context.Context, id string) (fosite.Client, error)

+ func (s *MemoryStorage) GetClientByID(ctx context.Context, id string) (*Client, error)

+ func (s *MemoryStorage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetUserByEmail(ctx context.Context, email string) (*User, error)

+ func (s *MemoryStorage) GetUserByFederationID(ctx context.Context, federationID uuid.UUID) (*User, error)

+ func (s *MemoryStorage) GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)

+ func (s *MemoryStorage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

+ func (s *MemoryStorage) ListClients(ctx context.Context) ([]*Client, error)

+ func (s *MemoryStorage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (s *MemoryStorage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ func (s *MemoryStorage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

+ func (s *MemoryStorage) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

+ func (s *MemoryStorage) UpdateClient(ctx context.Context, client *Client) error

+ func (s *MemoryStorage) UpdateUser(ctx context.Context, user *User) error

+ type OAuthAuthorizeRequest struct

+ ACRValues string

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ MaxAge int

+ Nonce string

+ Prompt string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ UILocales string

+ type OAuthAuthorizeResponse struct

+ Code string

+ Error string

+ ErrorDescription string

+ RedirectTo string

+ type OAuthClient struct

+ Audience []string

+ ClientID string

+ ClientName string

+ ClientSecret string

+ CreatedAt time.Time

+ GrantTypes []string

+ Metadata map[string]any

+ Public bool

+ RedirectURIs []string

+ ResponseTypes []string

+ Scope string

+ TokenEndpointAuthMethod string

+ UpdatedAt time.Time

+ type OAuthClientStore interface

+ CreateClient func(ctx context.Context, client *OAuthClient) error

+ DeleteClient func(ctx context.Context, clientID string) error

+ GetClient func(ctx context.Context, clientID string) (*OAuthClient, error)

+ ListClients func(ctx context.Context) ([]*OAuthClient, error)

+ UpdateClient func(ctx context.Context, client *OAuthClient) error

+ type OAuthConsentAccept struct

+ GrantScopes []string

+ Remember bool

+ RememberFor int

+ Session *ConsentSession

+ type OAuthConsentReject struct

+ Error string

+ ErrorDescription string

+ type OAuthConsentRequest struct

+ Challenge string

+ ClientID string

+ RequestedScopes []string

+ Skip bool

+ Subject string

+ type OAuthConsentResponse struct

+ RedirectTo string

+ type OAuthError struct

+ Error string

+ ErrorDescription string

+ ErrorURI string

+ type OAuthIntrospection struct

+ Active bool

+ Aud []string

+ ClientID string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type OAuthLoginAccept struct

+ ACR string

+ Context map[string]any

+ Remember bool

+ RememberFor int

+ Subject string

+ type OAuthLoginReject struct

+ Error string

+ ErrorDescription string

+ type OAuthLoginRequest struct

+ Challenge string

+ ClientID string

+ RequestedScopes []string

+ Skip bool

+ Subject string

+ type OAuthLoginResponse struct

+ RedirectTo string

+ type OAuthProvider interface

+ AcceptConsent func(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

+ AcceptLogin func(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

+ Authorize func(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

+ GetConsentRequest func(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

+ GetLoginRequest func(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

+ Introspect func(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

+ RejectConsent func(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

+ RejectLogin func(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)

+ Revoke func(ctx context.Context, token string, tokenTypeHint string) error

+ Token func(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

+ UserInfo func(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

+ type OAuthTokenRequest struct

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ type OAuthTokenResponse struct

+ AccessToken string

+ ExpiresIn int64

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type OAuthUserInfo struct

+ Email string

+ EmailVerified bool

+ FamilyName string

+ GivenName string

+ Locale string

+ Name string

+ Picture string

+ Sub string

+ Zoneinfo string

+ type OpenIDConfigInput struct

+ type OpenIDConfigOutput struct

+ Body OpenIDConfiguration

+ type OpenIDConfiguration struct

+ AuthorizationEndpoint string

+ ClaimsSupported []string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ IDTokenSigningAlgValuesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JwksURI string

+ RegistrationEndpoint string

+ ResponseModesSupported []string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ ScopesSupported []string

+ SubjectTypesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ UserinfoEndpoint string

+ type Option func(*Server)

+ func WithLogger(logger *slog.Logger) Option

+ func WithObservability(obs *observability.Observability) Option

+ func WithSessionProvider(provider SessionProvider) Option

+ func WithStorage(storage Storage) Option

+ type Providers struct

+ Authentication AuthenticationProvider

+ Identity IdentityProvider

+ OAuth OAuthProvider

+ OAuthClients OAuthClientStore

+ func NewProviders(server *Server, opts ...ProvidersOption) *Providers

+ func NewProvidersFromStorage(storage Storage, opts ...ProvidersOption) *Providers

+ type ProvidersOption func(*providersConfig)

+ func WithProviderPasswordVerifier(...) ProvidersOption

+ func WithProviderSessionDuration(d time.Duration) ProvidersOption

+ type RevokeInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type RevokeOutput struct

+ type SSOSession struct

+ AppsAccessed []string

+ AuthTime time.Time

+ ExpiresAt time.Time

+ GlobalIdentityID uuid.UUID

+ ID uuid.UUID

+ type SSOTokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type Server struct

+ func NewEmbedded(cfg Config, opts ...Option) (*Server, error)

+ func (s *Server) GetClient(id string) (*Client, error)

+ func (s *Server) Huma() huma.API

+ func (s *Server) Logger() *slog.Logger

+ func (s *Server) Middleware() func(http.Handler) http.Handler

+ func (s *Server) OAuth2Provider() fosite.OAuth2Provider

+ func (s *Server) OIDCSession(subject string, claims map[string]interface{}) *openid.DefaultSession

+ func (s *Server) Observability() *observability.Observability

+ func (s *Server) PublicKey() *rsa.PublicKey

+ func (s *Server) RegisterClient(client *Client) error

+ func (s *Server) RequireScopes(scopes ...string) func(http.Handler) http.Handler

+ func (s *Server) Router() chi.Router

+ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (s *Server) Session(subject string) *openid.DefaultSession

+ func (s *Server) SessionProvider() SessionProvider

+ func (s *Server) Storage() Storage

+ type SessionProvider interface

+ GetAuthenticatedUser func(r *http.Request) string

+ GetUserClaims func(ctx context.Context, userID string, scopes []string) map[string]interface{}

+ HasConsent func(ctx context.Context, userID, clientID string, scopes []string) bool

+ RedirectToConsent func(returnURL string) string

+ RedirectToLogin func(returnURL string) string

+ SaveConsent func(ctx context.Context, userID, clientID string, scopes []string) error

+ type Storage interface

+ ClientAssertionJWTValid func(ctx context.Context, jti string) error

+ CreateAccessTokenSession func(ctx context.Context, signature string, request fosite.Requester) error

+ CreateAuthorizeCodeSession func(ctx context.Context, code string, request fosite.Requester) error

+ CreateClient func(ctx context.Context, client *Client) error

+ CreatePKCERequestSession func(ctx context.Context, signature string, requester fosite.Requester) error

+ CreateRefreshTokenSession func(ctx context.Context, signature string, accessSignature string, ...) error

+ CreateUser func(ctx context.Context, user *User) error

+ DeleteAccessTokenSession func(ctx context.Context, signature string) error

+ DeleteClient func(ctx context.Context, id string) error

+ DeletePKCERequestSession func(ctx context.Context, signature string) error

+ DeleteRefreshTokenSession func(ctx context.Context, signature string) error

+ DeleteUser func(ctx context.Context, id uuid.UUID) error

+ GetAccessTokenSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetAuthorizeCodeSession func(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ GetClientByID func(ctx context.Context, id string) (*Client, error)

+ GetPKCERequestSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetRefreshTokenSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetUserByEmail func(ctx context.Context, email string) (*User, error)

+ GetUserByFederationID func(ctx context.Context, federationID uuid.UUID) (*User, error)

+ GetUserByID func(ctx context.Context, id uuid.UUID) (*User, error)

+ InvalidateAuthorizeCodeSession func(ctx context.Context, code string) error

+ ListClients func(ctx context.Context) ([]*Client, error)

+ RevokeAccessToken func(ctx context.Context, requestID string) error

+ RevokeRefreshToken func(ctx context.Context, requestID string) error

+ RotateRefreshToken func(ctx context.Context, requestID string, refreshTokenSignature string) error

+ SetClientAssertionJWT func(ctx context.Context, jti string, exp time.Time) error

+ UpdateClient func(ctx context.Context, client *Client) error

+ UpdateUser func(ctx context.Context, user *User) error

+ type StoredRequest struct

+ ClientID string

+ Form map[string][]string

+ GrantedScopes []string

+ ID string

+ RequestedAt time.Time

+ Scopes []string

+ Session *StoredSession

+ type StoredSession struct

+ Claims map[string]any

+ Email string

+ ExpiresAt map[string]int64

+ RequestedAt int64

+ Subject string

+ Username string

+ type SystemAuthDiscovery struct

+ AuthorizationEndpoint string

+ IntrospectionEndpoint string

+ Issuer string

+ JwksURI string

+ RevocationEndpoint string

+ ScopesSupported []string

+ TokenEndpoint string

+ UserinfoEndpoint string

+ type TokenConfig struct

+ AccessTokenLifetime Duration

+ AuthCodeLifetime Duration

+ IDTokenLifetime Duration

+ RefreshTokenLifetime Duration

+ type TokenData struct

+ AccessExpiresAt int64

+ AccessTokenSignature string

+ ClientID string

+ RefreshExpiresAt int64

+ RefreshTokenSignature string

+ RequestID string

+ Revoked bool

+ Scopes []string

+ Session *StoredSession

+ Subject string

+ type TokenInput struct

+ Authorization string

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ type TokenOutput struct

+ Body TokenResponse

+ type TokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type User struct

+ Active bool

+ CreatedAt time.Time

+ Email string

+ EmailVerified bool

+ FamilyName string

+ Federated bool

+ FederationID *uuid.UUID

+ GivenName string

+ ID uuid.UUID

+ Locale string

+ Metadata map[string]any

+ Name string

+ Picture string

+ UpdatedAt time.Time

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL