systemauth

package

Go to main page

Versions in this module

v0

v0.22.0

Oct 26, 2026

v0.21.0

Oct 26, 2026

Changes in this version

+ const MaxActiveClientSecrets

+ const TokenTypeBearer

+ const TokenTypeDPoP

+ var ErrAccountLocked = security.ErrAccountLocked

+ var ErrClientSecretNotFound = errors.New("systemauth: client secret not found")

+ var ErrPasswordAuthNotConfigured = errors.New("password authentication not configured")

+ var ErrPublicClient = errors.New("systemauth: public clients have no secret")

+ var ErrUnsupportedAuthMethod = errors.New("unsupported authentication method")

+ func ActiveClientSecretHashes(ctx context.Context, db *ent.Client, appID uuid.UUID) ([]string, error)

+ func AllOrganizations(context.Context, string) ([]uuid.UUID, bool, error)

+ func ParseVerificationKey(pemData []byte) (*rsa.PublicKey, error)

+ type AccessChangeScope func(ctx context.Context, clientID string) (orgIDs []uuid.UUID, all bool, err error)

type Client

+ AllowBearerTokens bool

+ func (c *Client) DPoPBoundAccessTokens() bool

type ClientConfig

+ AllowBearerTokens bool

+ type ClientSecretHasher struct

+ func (ClientSecretHasher) Compare(_ context.Context, hash, data []byte) error

+ func (ClientSecretHasher) Hash(_ context.Context, data []byte) ([]byte, error)

type Config

+ DPoP DPoPConfig

type ConnectionsConfig

+ AllowHTTPEgress bool

+ EgressAllowPrefixes []string

+ func (c *ConnectionsConfig) EgressPrefixes() ([]netip.Prefix, error)

+ type DPoPConfig struct

+ ClockSkew Duration

+ NonceLifetime Duration

+ NonceSecret string

+ ProofMaxAge Duration

+ ReplayCacheRedisURL string

+ RequireNonce bool

+ ResourceBaseURL string

type EmbeddedAuthProviderOption

+ func WithLockout(l *security.Lockout) EmbeddedAuthProviderOption

type EntStorage

+ func (s *EntStorage) RevokeClientSecret(ctx context.Context, clientID string, secretID uuid.UUID) error

+ func (s *EntStorage) RotateClientSecret(ctx context.Context, clientID string) (*RotatedClientSecret, error)

type EntStorageOption

+ func WithEntAuthzSyncer(syncer authz.RelationshipSyncer, mode authz.SyncMode) EntStorageOption

+ func WithEntLogger(logger *slog.Logger) EntStorageOption

type KeyConfig

+ VerificationKeys []VerificationKeyConfig

+ func (k *KeyConfig) LoadVerificationKeys(signingKID string) error

type MemoryStorage

+ func (s *MemoryStorage) PrincipalDirectory() PrincipalDirectory

type OAuthIntrospection

+ Cnf *TokenConfirmation

type OpenIDConfiguration

+ DPoPSigningAlgValuesSupported []string

type Option

+ func WithDPoPReplayCache(cache dpopproof.ReplayCache) Option

type ProvidersOption

+ func WithProviderLockout(l *security.Lockout) ProvidersOption

+ type RotatedClientSecret struct

+ ID uuid.UUID

+ Prefix string

+ Secret string

type Server

+ func (s *Server) TokenEndpointURL() string

type Session

+ DPoPJKT string

+ func (s *Session) GetExtraClaims() map[string]interface{}

+ func (s *Session) TokenType() string

+ type TokenConfirmation struct

+ JKT string

+ type VerificationKeyConfig struct

+ KeyID string

+ PublicKey *rsa.PublicKey

+ PublicKeyFile string

+ PublicKeyPEM string

v0.20.0

Oct 24, 2026

Changes in this version

+ const AccessTokenType

v0.19.0

Oct 22, 2026

Changes in this version

+ const SignupAgePath

+ var DefaultSignupAgePage = SignupAgePage

type Option

+ func WithSignupAgePage(page SignupAgePage) Option

+ type SignupAgePage struct

+ Message string

+ Refused string

+ Title string

type SocialLoginConfig

+ SignupMinimumAge int

v0.18.0

Oct 20, 2026

Changes in this version

+ var ErrInvalidConsoleConfig = errors.New("systemauth: invalid console configuration")

type Config

+ Console *ConsoleConfig

+ type ConsoleConfig struct

+ WebDir string

type Server

+ func (s *Server) EndLoginSession(w http.ResponseWriter, r *http.Request) error

+ func (s *Server) ValidateReturnTo(raw string) (string, error)

v0.17.0

Oct 19, 2026

Changes in this version

+ type BearerGrant struct

+ ClientID string

+ ExpiresAt time.Time

+ PrincipalID uuid.UUID

+ Scopes []string

+ TokenID string

type Server

+ func (s *Server) BearerAccess(r *http.Request, scope string) (*BearerGrant, error)

+ func (s *Server) BearerAuthenticator(scope string) requestprincipal.Authenticator

v0.16.0

Oct 14, 2026

v0.15.0

Oct 13, 2026

Changes in this version

+ const SignupWaitlistPath

+ var DefaultWaitlistAddressLimit = ratelimit.PerMinute(20)

+ var DefaultWaitlistEmailLimit = ratelimit.PerHour(5)

+ var DefaultWaitlistPage = WaitlistPage

+ var ErrBearerInvalid = errors.New("systemauth: invalid bearer token")

+ var ErrBearerMissing = errors.New("systemauth: no bearer token")

+ var ErrBearerScope = errors.New("systemauth: insufficient scope")

+ var ErrInvalidConnectionsConfig = errors.New("systemauth: invalid connections configuration")

+ var ErrSignupNotInvited = errors.New("systemauth: sign-up is by invitation only")

+ func ValidateSignupDeniedURL(raw string) error

+ func WriteBearerError(w http.ResponseWriter, err error, scope string)

type Config

+ Connections *ConnectionsConfig

+ type ConnectionsConfig struct

+ AllowPrivateEgress bool

+ KeysDir string

+ RootKey string

+ Vault string

type Option

+ func WithAppCatalog(c *appcatalog.Catalog) Option

+ func WithSignupDeniedURL(rawURL string) Option

+ func WithSignupGate(gate SignupGate) Option

+ func WithSignupWaitlist(list SignupWaitlist, page WaitlistPage) Option

type Server

+ func (s *Server) BearerPrincipal(r *http.Request, scope string) (uuid.UUID, error)

+ type SignupGate interface

+ AllowSignup func(ctx context.Context, login ExternalLogin) error

+ SignedUp func(ctx context.Context, login ExternalLogin, principalID uuid.UUID) error

+ type SignupWaitlist interface

+ Join func(ctx context.Context, email, consentVersion, consentText string) error

+ type WaitlistPage struct

+ ConsentText string

+ ConsentVersion string

+ Message string

+ RefusedNotice string

+ Thanks string

+ Title string

v0.14.0

Oct 11, 2026

Changes in this version

+ const AccessChangesPath

+ const AccessChangesScope

+ const DefaultMembershipsPageSize

+ const EventAccessChange

+ const EventBackchannelLogout

+ const FederationProvider

+ const IntrospectionScope

+ const LoginTokenPath

+ const LogoutTokenType

+ const ManagedClaim

+ const MaxMembershipsPageSize

+ const MaxOrgsInToken

+ const MembershipsPath

+ const OrgsClaim

+ const OrgsTruncatedClaim

+ var DefaultLoginTokenAddressLimit = ratelimit.PerMinute(60)

+ var DefaultLoginTokenClientLimit = ratelimit.PerMinute(600)

+ var ErrEmailRequired = errors.New("systemauth: email is required")

+ var ErrFederationUnauthorized = errors.New("systemauth: federation request not authorized")

+ var ErrInvalidBackchannelURI = errors.New("systemauth: invalid backchannel_logout_uri")

+ var ErrInvalidCursor = errors.New("systemauth: invalid memberships cursor")

+ var ErrPrincipalExists = errors.New("systemauth: principal already exists")

+ func AuthorizeIntrospectionCaller(r *http.Request, clientPublic func(clientID string) (known, public bool), ...) bool

+ func TrustAllRequests(*http.Request) bool

+ func ValidateBackchannelLogoutURI(raw string) error

+ type AccessChangeLister interface

+ List func(ctx context.Context, since time.Time, limit int) ([]accesschange.Change, error)

+ type AccessChangeResponse struct

+ ChangedAt time.Time

+ OrganizationID string

+ PrincipalID string

+ Reason string

+ type AccessChangesResponse struct

+ Changes []AccessChangeResponse

+ NextSince *time.Time

+ type AppRoleResolver interface

+ EffectiveRoles func(ctx context.Context, principalID, organizationID uuid.UUID) (map[string]string, error)

+ type Backchannel struct

+ func (b *Backchannel) AccessChange(c accesschange.Change)

+ func (b *Backchannel) Run(ctx context.Context) error

+ type BackchannelOption func(*Backchannel)

+ func WithBackchannelBackoff(base, maxWait time.Duration) BackchannelOption

+ func WithBackchannelClock(now func() time.Time) BackchannelOption

+ func WithBackchannelHTTPClient(c *http.Client) BackchannelOption

type Client

+ BackchannelLogoutURI string

+ LoginTokenTTL *time.Duration

+ ManagedPrincipalsEnabled bool

+ RotatedSecretHashes []string

+ func (c *Client) GetRotatedHashes() [][]byte

type ClientConfig

+ BackchannelLogoutURI string

+ LoginTokenTTL *Duration

+ ManagedPrincipals bool

type Config

+ Authz authz.ModeConfig

+ ManagedPrincipals *ManagedPrincipalsConfig

type DefaultSessionProviderOption

+ func WithTrustedUserIDHeader(header string, gate RequestGate) DefaultSessionProviderOption

+ type EntOrgsSource struct

+ func NewEntOrgsSource(client *ent.Client, roles AppRoleResolver) *EntOrgsSource

+ func (s *EntOrgsSource) Memberships(ctx context.Context, principalID uuid.UUID, limit int, cursor string) ([]OrgClaim, string, error)

+ func (s *EntOrgsSource) OrgsClaim(ctx context.Context, principalID uuid.UUID, compact bool) (OrgsResult, error)

type EntPrincipalDirectory

+ func (d *EntPrincipalDirectory) EnsurePersonalOrg(ctx context.Context, p *HumanPrincipal, login ExternalLogin) error

+ type EntPrincipalDirectoryOption func(*EntPrincipalDirectory)

+ func WithDirectoryAuthzSyncer(syncer authz.RelationshipSyncer) EntPrincipalDirectoryOption

+ func WithDirectoryLogger(logger *slog.Logger) EntPrincipalDirectoryOption

+ func WithDirectorySyncMode(mode authz.SyncMode) EntPrincipalDirectoryOption

type EntStorage

+ func (s *EntStorage) CreateHuman(ctx context.Context, h *HumanPrincipal) error

+ func (s *EntStorage) DeleteHuman(ctx context.Context, id uuid.UUID) error

+ func (s *EntStorage) GetHuman(ctx context.Context, id uuid.UUID) (*HumanPrincipal, error)

+ func (s *EntStorage) GetHumanByEmail(ctx context.Context, email string) (*HumanPrincipal, error)

+ func (s *EntStorage) GetHumanByExternalIdentity(ctx context.Context, provider, subject string) (*HumanPrincipal, error)

+ func (s *EntStorage) LinkExternalIdentity(ctx context.Context, principalID uuid.UUID, provider, subject string) error

+ func (s *EntStorage) PrincipalActive(ctx context.Context, subject string) (bool, error)

+ func (s *EntStorage) UpdateHuman(ctx context.Context, h *HumanPrincipal) error

type EntStorageOption

+ func WithEntAccessChangeSink(sink accesschange.Sink) EntStorageOption

type ExternalLogin

+ Username string

+ type FederationAuthenticator func(r *http.Request) error

+ func SharedSecretAuthenticator(secret string) FederationAuthenticator

+ type FederationOption func(*FederationEndpoints)

+ func WithFederationAuthenticator(auth FederationAuthenticator) FederationOption

+ type HumanPrincipal struct

+ Active bool

+ AvatarURL string

+ CreatedAt time.Time

+ DisplayName string

+ Email string

+ EmailVerified bool

+ FamilyName string

+ GivenName string

+ ID uuid.UUID

+ Locale string

+ Managed bool

+ Metadata map[string]any

+ UpdatedAt time.Time

+ type ManagedPrincipalsConfig struct

+ Enabled bool

+ LoginTokenMaxTTL Duration

+ LoginTokenTTL Duration

+ SingleUseTokenTTL Duration

+ type MembershipsInput struct

+ Authorization string

+ Cursor string

+ Limit int

+ type MembershipsOutput struct

+ Body MembershipsResponse

+ type MembershipsResponse struct

+ NextCursor string

+ Orgs []OrgClaim

type MemoryStorage

+ func (s *MemoryStorage) CreateHuman(_ context.Context, h *HumanPrincipal) error

+ func (s *MemoryStorage) DeleteHuman(_ context.Context, id uuid.UUID) error

+ func (s *MemoryStorage) GetHuman(_ context.Context, id uuid.UUID) (*HumanPrincipal, error)

+ func (s *MemoryStorage) GetHumanByEmail(_ context.Context, email string) (*HumanPrincipal, error)

+ func (s *MemoryStorage) GetHumanByExternalIdentity(_ context.Context, provider, subject string) (*HumanPrincipal, error)

+ func (s *MemoryStorage) LinkExternalIdentity(_ context.Context, principalID uuid.UUID, provider, subject string) error

+ func (s *MemoryStorage) PrincipalActive(_ context.Context, subject string) (bool, error)

+ func (s *MemoryStorage) UpdateHuman(_ context.Context, h *HumanPrincipal) error

type Option

+ func WithAccessChanges(lister AccessChangeLister) Option

+ func WithCredentialService(svc credential.Service) Option

+ func WithLoginTokenClientIP(clientIP func(r *http.Request) string) Option

+ func WithLoginTokenRateLimit(storage ratelimit.Storage, perAddress, perClient ratelimit.Limit) Option

+ func WithOrgsSource(src OrgsSource) Option

+ func WithSocialAuthzSyncer(syncer authz.RelationshipSyncer, mode authz.SyncMode) Option

+ type OrgClaim struct

+ Apps map[string]string

+ ID string

+ Name string

+ Role string

+ Slug string

+ Type string

+ type OrgsResult struct

+ Orgs []OrgClaim

+ Truncated bool

+ type OrgsSource interface

+ Memberships func(ctx context.Context, principalID uuid.UUID, limit int, cursor string) (page []OrgClaim, next string, err error)

+ OrgsClaim func(ctx context.Context, principalID uuid.UUID, compact bool) (OrgsResult, error)

+ type PersonalOrgEnsurer interface

+ EnsurePersonalOrg func(ctx context.Context, p *HumanPrincipal, login ExternalLogin) error

+ type PrincipalStatus interface

+ PrincipalActive func(ctx context.Context, subject string) (bool, error)

+ type RequestGate func(r *http.Request) bool

+ func TrustedProxyNetworks(cidrs ...string) (RequestGate, error)

type Server

+ func (s *Server) LoginTokenPolicy(ctx context.Context, clientID string) (credential.LoginTokenPolicy, error)

+ func (s *Server) ManagedPrincipalsAllowed(ctx context.Context, clientID string) (bool, error)

+ func (s *Server) NewBackchannel(opts ...BackchannelOption) *Backchannel

+ func (s *Server) OrgsClaim(ctx context.Context, principalID uuid.UUID, compact bool) (OrgsResult, error)

+ func (s *Server) TokenAuthenticator(scope string) FederationAuthenticator

type Storage

+ CreateHuman func(ctx context.Context, h *HumanPrincipal) error

+ DeleteHuman func(ctx context.Context, id uuid.UUID) error

+ GetHuman func(ctx context.Context, id uuid.UUID) (*HumanPrincipal, error)

+ GetHumanByEmail func(ctx context.Context, email string) (*HumanPrincipal, error)

+ GetHumanByExternalIdentity func(ctx context.Context, provider, subject string) (*HumanPrincipal, error)

+ LinkExternalIdentity func(ctx context.Context, principalID uuid.UUID, provider, subject string) error

+ UpdateHuman func(ctx context.Context, h *HumanPrincipal) error

v0.13.0

Oct 7, 2026

Changes in this version

type Config

+ func DecodeConfig(data []byte, format ConfigFormat) (*Config, error)

+ func DecodeConfigFile(path string) (*Config, error)

type Server

+ func (s *Server) OpenIDConfiguration() OpenIDConfiguration

+ func (s *Server) Ready(ctx context.Context) error

v0.12.0

Oct 6, 2026

Changes in this version

+ const ConsentPath

+ const DefaultStoreCleanupInterval

+ const HealthzPath

+ const IDPHintParam

+ const LoginCookieName

+ const LoginPath

+ const LogoutPath

+ const ReadyzPath

+ const UserInfoPath

+ var ErrEmailConflict = errors.New("systemauth: email already belongs to an account that cannot be linked")

+ var ErrEmailNotVerified = errors.New("systemauth: upstream email is not verified")

+ var ErrExternalIdentityExists = errors.New("systemauth: external identity already linked")

+ var ErrInvalidConfig = errors.New("systemauth: invalid configuration")

+ var ErrInvalidSigningKey = errors.New("systemauth: invalid signing key")

+ var ErrInvalidSocialLoginConfig = errors.New("systemauth: invalid social login configuration")

+ var ErrLoginSessionNotFound = errors.New("systemauth: login session not found")

+ var ErrPrincipalInactive = errors.New("systemauth: principal is inactive")

+ var ErrPrincipalNotFound = errors.New("systemauth: principal not found")

+ var ErrRedirectNotAllowed = errors.New("systemauth: redirect target not allowed")

+ func KeyThumbprint(key *rsa.PrivateKey) (string, error)

+ func ParseSigningKey(pemData []byte) (*rsa.PrivateKey, error)

+ func UserInfoClaims(subject string, claims map[string]any, granted []string) map[string]any

type Config

+ SocialLogin *SocialLoginConfig

+ type ConsentStore interface

+ HasConsent func(ctx context.Context, principalID, clientID string, scopes []string) (bool, error)

+ RevokeConsent func(ctx context.Context, principalID, clientID string) error

+ SaveConsent func(ctx context.Context, principalID, clientID string, scopes []string) error

+ type EntConsentStore struct

+ func NewEntConsentStore(client *ent.Client) *EntConsentStore

+ func (s *EntConsentStore) HasConsent(ctx context.Context, principalID, clientID string, scopes []string) (bool, error)

+ func (s *EntConsentStore) RevokeConsent(ctx context.Context, principalID, clientID string) error

+ func (s *EntConsentStore) SaveConsent(ctx context.Context, principalID, clientID string, scopes []string) error

+ type EntLoginSessionStore struct

+ func NewEntLoginSessionStore(client *ent.Client, opts ...EntStoreOption) *EntLoginSessionStore

+ func (s *EntLoginSessionStore) Create(ctx context.Context, token string, session LoginSession) error

+ func (s *EntLoginSessionStore) Delete(ctx context.Context, token string) error

+ func (s *EntLoginSessionStore) DeleteExpired(ctx context.Context) (int, error)

+ func (s *EntLoginSessionStore) Get(ctx context.Context, token string) (LoginSession, error)

+ type EntLoginStateStore struct

+ func NewEntLoginStateStore(client *ent.Client, opts ...EntStoreOption) *EntLoginStateStore

+ func (s *EntLoginStateStore) DeleteExpired(ctx context.Context) (int, error)

+ func (s *EntLoginStateStore) Put(ctx context.Context, state string, data oauthclient.StateData, ...) error

+ func (s *EntLoginStateStore) Take(ctx context.Context, state string) (oauthclient.StateData, error)

+ type EntPrincipalDirectory struct

+ func NewEntPrincipalDirectory(db *ent.Client) *EntPrincipalDirectory

+ func (d *EntPrincipalDirectory) CreateFromExternal(ctx context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) FindByExternalIdentity(ctx context.Context, provider, subject string) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) FindByVerifiedEmail(ctx context.Context, email string) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) GetPrincipal(ctx context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ func (d *EntPrincipalDirectory) LinkExternalIdentity(ctx context.Context, principalID uuid.UUID, login ExternalLogin) error

+ func (d *EntPrincipalDirectory) RecordLogin(ctx context.Context, principalID uuid.UUID, login ExternalLogin, at time.Time) error

type EntStorage

+ func (s *EntStorage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ func (s *EntStorage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

+ func (s *EntStorage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ func (s *EntStorage) RevokeSubjectTokens(ctx context.Context, subject string) error

+ type EntStoreOption func(*entStoreConfig)

+ func WithCleanupInterval(d time.Duration) EntStoreOption

+ type ExternalLogin struct

+ AvatarURL string

+ Email string

+ EmailVerified bool

+ Name string

+ Provider string

+ Subject string

type KeyConfig

+ KeyID string

+ PrivateKeyFile string

+ PrivateKeyPEM string

+ func (k *KeyConfig) HasSigningKey() bool

+ func (k *KeyConfig) LoadSigningKey() error

+ type LoginPrincipal struct

+ Active bool

+ AvatarURL string

+ DisplayName string

+ Email string

+ EmailVerified bool

+ ID uuid.UUID

+ func ResolveExternalLogin(ctx context.Context, dir PrincipalDirectory, login ExternalLogin, ...) (*LoginPrincipal, error)

+ type LoginSession struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ PrincipalID uuid.UUID

+ Provider string

+ type LoginSessionStore interface

+ Create func(ctx context.Context, token string, session LoginSession) error

+ Delete func(ctx context.Context, token string) error

+ Get func(ctx context.Context, token string) (LoginSession, error)

+ type MemoryConsentStore struct

+ func NewMemoryConsentStore() *MemoryConsentStore

+ func (s *MemoryConsentStore) HasConsent(_ context.Context, principalID, clientID string, scopes []string) (bool, error)

+ func (s *MemoryConsentStore) RevokeConsent(_ context.Context, principalID, clientID string) error

+ func (s *MemoryConsentStore) SaveConsent(_ context.Context, principalID, clientID string, scopes []string) error

+ type MemoryLoginSessionStore struct

+ func NewMemoryLoginSessionStore() *MemoryLoginSessionStore

+ func (s *MemoryLoginSessionStore) Create(_ context.Context, token string, session LoginSession) error

+ func (s *MemoryLoginSessionStore) Delete(_ context.Context, token string) error

+ func (s *MemoryLoginSessionStore) Get(_ context.Context, token string) (LoginSession, error)

+ type MemoryPrincipalDirectory struct

+ func NewMemoryPrincipalDirectory() *MemoryPrincipalDirectory

+ func (d *MemoryPrincipalDirectory) AddPrincipal(p LoginPrincipal) error

+ func (d *MemoryPrincipalDirectory) CreateFromExternal(_ context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) FindByExternalIdentity(_ context.Context, provider, subject string) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) FindByVerifiedEmail(_ context.Context, email string) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) GetPrincipal(_ context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ func (d *MemoryPrincipalDirectory) LastLogin(id uuid.UUID) (time.Time, bool)

+ func (d *MemoryPrincipalDirectory) LinkExternalIdentity(_ context.Context, principalID uuid.UUID, login ExternalLogin) error

+ func (d *MemoryPrincipalDirectory) RecordLogin(_ context.Context, principalID uuid.UUID, _ ExternalLogin, at time.Time) error

type MemoryStorage

+ func (s *MemoryStorage) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ func (s *MemoryStorage) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) error

+ func (s *MemoryStorage) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ func (s *MemoryStorage) RevokeSubjectTokens(ctx context.Context, subject string) error

type Option

+ func WithConsentStore(store ConsentStore) Option

+ func WithLoginSessionStore(store LoginSessionStore) Option

+ func WithLoginStateStore(store oauthclient.StateStore) Option

+ func WithPrincipalDirectory(dir PrincipalDirectory) Option

+ func WithReadinessCheck(name string, check func(context.Context) error) Option

+ func WithSocialConnector(c *oauthclient.Connector) Option

+ type PrincipalDirectory interface

+ CreateFromExternal func(ctx context.Context, login ExternalLogin) (*LoginPrincipal, error)

+ FindByExternalIdentity func(ctx context.Context, provider, subject string) (*LoginPrincipal, error)

+ FindByVerifiedEmail func(ctx context.Context, email string) (*LoginPrincipal, error)

+ GetPrincipal func(ctx context.Context, id uuid.UUID) (*LoginPrincipal, error)

+ LinkExternalIdentity func(ctx context.Context, principalID uuid.UUID, login ExternalLogin) error

+ RecordLogin func(ctx context.Context, principalID uuid.UUID, login ExternalLogin, at time.Time) error

type Server

+ func (s *Server) CurrentLoginSession(r *http.Request) (*LoginSession, error)

+ func (s *Server) KeyID() string

+ type Session struct

+ AccessClaims *jwt.JWTClaims

+ AccessHeader *jwt.Headers

+ FamilyIssuedAt time.Time

+ func (s *Session) Clone() fosite.Session

+ func (s *Session) GetJWTClaims() jwt.JWTClaimsContainer

+ func (s *Session) GetJWTHeader() *jwt.Headers

+ type SocialLoginConfig struct

+ AllowedRedirectOrigins []string

+ DefaultRedirect string

+ GitHub *SocialProviderConfig

+ Google *SocialProviderConfig

+ InsecureCookies bool

+ SessionLifetime Duration

+ SkipConsent bool

+ type SocialProviderConfig struct

+ ClientID string

+ ClientSecret string

+ RedirectURL string

+ Scopes []string

type Storage

+ CreateOpenIDConnectSession func(ctx context.Context, authorizeCode string, requester fosite.Requester) error

+ DeleteOpenIDConnectSession func(ctx context.Context, authorizeCode string) error

+ GetOpenIDConnectSession func(ctx context.Context, authorizeCode string, requester fosite.Requester) (fosite.Requester, error)

+ type SubjectTokenRevoker interface

+ RevokeSubjectTokens func(ctx context.Context, subject string) error

type TokenConfig

+ RefreshTokenAbsoluteLifetime Duration

+ type UserInfoInput struct

+ Authorization string

+ type UserInfoOutput struct

+ Body map[string]any

v0.11.0

Oct 3, 2026

Changes in this version

+ var ErrAuthCodeExpired = errors.New("systemauth: authorization code expired")

+ var ErrAuthCodeNotFound = errors.New("systemauth: authorization code not found")

+ var ErrAuthCodeUsed = errors.New("systemauth: authorization code already used")

+ var ErrClientExists = errors.New("systemauth: client already exists")

+ var ErrClientNotFound = errors.New("systemauth: client not found")

+ var ErrFederationConnectionFailed = errors.New("systemauth: failed to connect to SystemAuth")

+ var ErrFederationNotConfigured = errors.New("systemauth: federation not configured")

+ var ErrInvalidClientType = errors.New("systemauth: invalid client type")

+ var ErrInvalidCredentials = errors.New("invalid credentials")

+ var ErrInvalidGlobalToken = errors.New("systemauth: invalid global identity token")

+ var ErrInvalidToken = errors.New("systemauth: invalid token")

+ var ErrKeyGenerationFailed = errors.New("systemauth: failed to generate signing key")

+ var ErrMissingIssuer = errors.New("systemauth: issuer is required")

+ var ErrPKCEVerificationFailed = errors.New("systemauth: PKCE verification failed")

+ var ErrSessionExpired = errors.New("session expired")

+ var ErrSessionNotFound = errors.New("session not found")

+ var ErrSessionRevoked = errors.New("session revoked")

+ var ErrStorageInitFailed = errors.New("systemauth: failed to initialize storage")

+ var ErrTokenExpired = errors.New("systemauth: token expired")

+ var ErrTokenNotFound = errors.New("systemauth: token not found")

+ var ErrTokenRevoked = errors.New("systemauth: token revoked")

+ var ErrUserExists = errors.New("systemauth: user already exists")

+ var ErrUserNotFound = errors.New("systemauth: user not found")

+ func AccessRequestFromContext(ctx context.Context) fosite.AccessRequester

+ func ContextWithOwnerID(ctx context.Context, ownerID uuid.UUID) context.Context

+ func LoggerFromContext(ctx context.Context) *slog.Logger

+ func SaveConfig(cfg *Config, path string) error

+ func WithAccessRequest(ctx context.Context, ar fosite.AccessRequester) context.Context

+ type AuthCodeData struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ ExpiresAt int64

+ GrantedScopes []string

+ Nonce string

+ RedirectURI string

+ Scopes []string

+ Session *StoredSession

+ Signature string

+ State string

+ Subject string

+ Used bool

+ type AuthMethod string

+ const AuthMethodOIDC

+ const AuthMethodPassword

+ const AuthMethodTOTP

+ const AuthMethodWebAuthn

+ type AuthSession struct

+ Active bool

+ AuthenticatedAt time.Time

+ AuthenticationMethods []AuthMethod

+ DeviceInfo *DeviceInfo

+ ExpiresAt time.Time

+ ID string

+ Identity *Identity

+ IdentityID uuid.UUID

+ Token string

+ type AuthenticateRequest struct

+ DeviceInfo *DeviceInfo

+ Identifier string

+ Method AuthMethod

+ OIDCProvider string

+ OIDCToken string

+ Password string

+ type AuthenticationProvider interface

+ Authenticate func(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

+ ListSessions func(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)

+ RefreshSession func(ctx context.Context, sessionToken string) (*AuthSession, error)

+ RevokeSession func(ctx context.Context, sessionToken string) error

+ RevokeSessions func(ctx context.Context, identityID uuid.UUID) error

+ ValidateSession func(ctx context.Context, sessionToken string) (*AuthSession, error)

+ type AuthorizationSession struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ ConsentGranted bool

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ GrantedScopes []string

+ Nonce string

+ RedirectURI string

+ RequestID string

+ Scopes []string

+ State string

+ UserID string

+ func NewAuthorizationSession(ar fosite.AuthorizeRequester) *AuthorizationSession

+ func (s *AuthorizationSession) IsExpired() bool

+ type AuthorizeInput struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ Nonce string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ type AuthorizeOutput struct

+ Location string

+ type Client struct

+ AccessTokenLifetime *time.Duration

+ Audience []string

+ CreatedAt time.Time

+ Description string

+ GrantTypes []string

+ ID string

+ Metadata map[string]any

+ Name string

+ RedirectURIs []string

+ RefreshTokenLifetime *time.Duration

+ ResponseTypes []string

+ Scopes []string

+ Secret string

+ SecretHash string

+ Type ClientType

+ UpdatedAt time.Time

+ func NewClientFromConfig(cfg ClientConfig) (*Client, error)

+ func (c *Client) GetAudience() fosite.Arguments

+ func (c *Client) GetGrantTypes() fosite.Arguments

+ func (c *Client) GetHashedSecret() []byte

+ func (c *Client) GetID() string

+ func (c *Client) GetRedirectURIs() []string

+ func (c *Client) GetResponseTypes() fosite.Arguments

+ func (c *Client) GetScopes() fosite.Arguments

+ func (c *Client) IsPublic() bool

+ func (c *Client) ValidateSecret(secret string) bool

+ type ClientConfig struct

+ AccessTokenLifetime *Duration

+ Audience []string

+ Description string

+ GrantTypes []string

+ ID string

+ Name string

+ RedirectURIs []string

+ RefreshTokenLifetime *Duration

+ ResponseTypes []string

+ Scopes []string

+ Secret string

+ Type string

+ type ClientManager interface

+ CreateClient func(ctx context.Context, client *Client) error

+ DeleteClient func(ctx context.Context, id string) error

+ GetClientByID func(ctx context.Context, id string) (*Client, error)

+ ListClients func(ctx context.Context) ([]*Client, error)

+ UpdateClient func(ctx context.Context, client *Client) error

+ type ClientType string

+ const ClientTypeConfidential

+ const ClientTypePublic

+ type Config struct

+ Clients []ClientConfig

+ Database *DatabaseConfig

+ Features FeatureConfig

+ Federation *FederationConfig

+ Issuer string

+ Keys KeyConfig

+ Tokens TokenConfig

+ func DefaultConfig(issuer string) *Config

+ func LoadConfig(path string) (*Config, error)

+ func ParseConfig(data []byte, format ConfigFormat) (*Config, error)

+ func (c *Config) ApplyDefaults()

+ func (c *Config) Validate() error

+ type ConfigFormat string

+ const FormatJSON

+ const FormatYAML

+ type ConsentSession struct

+ AccessToken map[string]any

+ IDToken map[string]any

+ type CredentialType string

+ const CredentialTypeOIDC

+ const CredentialTypePassword

+ const CredentialTypeTOTP

+ const CredentialTypeWebAuthn

+ type DatabaseConfig struct

+ DSN string

+ Driver string

+ type DefaultIdentitySyncHandler struct

+ func NewDefaultIdentitySyncHandler(storage Storage) *DefaultIdentitySyncHandler

+ func (h *DefaultIdentitySyncHandler) SyncIdentity(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)

+ type DefaultSessionProvider struct

+ func NewDefaultSessionProvider(opts ...DefaultSessionProviderOption) *DefaultSessionProvider

+ func (p *DefaultSessionProvider) GetAuthenticatedUser(r *http.Request) string

+ func (p *DefaultSessionProvider) GetUserClaims(_ context.Context, userID string, _ []string) map[string]interface{}

+ func (p *DefaultSessionProvider) HasConsent(_ context.Context, _, _ string, _ []string) bool

+ func (p *DefaultSessionProvider) RedirectToConsent(returnURL string) string

+ func (p *DefaultSessionProvider) RedirectToLogin(returnURL string) string

+ func (p *DefaultSessionProvider) SaveConsent(_ context.Context, _, _ string, _ []string) error

+ type DefaultSessionProviderOption func(*DefaultSessionProvider)

+ func WithConsentURL(url string) DefaultSessionProviderOption

+ func WithLoginURL(url string) DefaultSessionProviderOption

+ func WithSkipConsent(skip bool) DefaultSessionProviderOption

+ func WithUserIDHeader(header string) DefaultSessionProviderOption

+ type DeviceInfo struct

+ DeviceID string

+ IPAddress string

+ UserAgent string

+ type Duration time.Duration

+ func (Duration) JSONSchema() *jsonschema.Schema

+ func (d *Duration) UnmarshalJSON(b []byte) error

+ func (d *Duration) UnmarshalYAML(unmarshal func(interface{}) error) error

+ func (d Duration) Duration() time.Duration

+ func (d Duration) MarshalJSON() ([]byte, error)

+ func (d Duration) MarshalYAML() (interface{}, error)

+ type EmbeddedAuthProvider struct

+ func NewEmbeddedAuthProvider(identityProvider IdentityProvider, opts ...EmbeddedAuthProviderOption) *EmbeddedAuthProvider

+ func (p *EmbeddedAuthProvider) Authenticate(ctx context.Context, req *AuthenticateRequest) (*AuthSession, error)

+ func (p *EmbeddedAuthProvider) ListSessions(ctx context.Context, identityID uuid.UUID) ([]*AuthSession, error)

+ func (p *EmbeddedAuthProvider) RefreshSession(ctx context.Context, sessionToken string) (*AuthSession, error)

+ func (p *EmbeddedAuthProvider) RevokeSession(ctx context.Context, sessionToken string) error

+ func (p *EmbeddedAuthProvider) RevokeSessions(ctx context.Context, identityID uuid.UUID) error

+ func (p *EmbeddedAuthProvider) ValidateSession(ctx context.Context, sessionToken string) (*AuthSession, error)

+ type EmbeddedAuthProviderOption func(*EmbeddedAuthProvider)

+ func WithPasswordVerifier(...) EmbeddedAuthProviderOption

+ func WithSessionDuration(d time.Duration) EmbeddedAuthProviderOption

+ type EmbeddedIdentityProvider struct

+ func NewEmbeddedIdentityProvider(storage Storage) *EmbeddedIdentityProvider

+ func (p *EmbeddedIdentityProvider) CreateIdentity(ctx context.Context, identity *Identity) error

+ func (p *EmbeddedIdentityProvider) DeleteIdentity(ctx context.Context, id uuid.UUID) error

+ func (p *EmbeddedIdentityProvider) GetIdentity(ctx context.Context, id uuid.UUID) (*Identity, error)

+ func (p *EmbeddedIdentityProvider) GetIdentityByEmail(ctx context.Context, email string) (*Identity, error)

+ func (p *EmbeddedIdentityProvider) ListIdentities(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)

+ func (p *EmbeddedIdentityProvider) UpdateIdentity(ctx context.Context, identity *Identity) error

+ type EmbeddedOAuthClientStore struct

+ func NewEmbeddedOAuthClientStore(storage Storage) *EmbeddedOAuthClientStore

+ func (s *EmbeddedOAuthClientStore) CreateClient(ctx context.Context, client *OAuthClient) error

+ func (s *EmbeddedOAuthClientStore) DeleteClient(ctx context.Context, clientID string) error

+ func (s *EmbeddedOAuthClientStore) GetClient(ctx context.Context, clientID string) (*OAuthClient, error)

+ func (s *EmbeddedOAuthClientStore) ListClients(ctx context.Context) ([]*OAuthClient, error)

+ func (s *EmbeddedOAuthClientStore) UpdateClient(ctx context.Context, client *OAuthClient) error

+ type EmbeddedOAuthProvider struct

+ func NewEmbeddedOAuthProvider(server *Server) *EmbeddedOAuthProvider

+ func (p *EmbeddedOAuthProvider) AcceptConsent(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

+ func (p *EmbeddedOAuthProvider) AcceptLogin(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

+ func (p *EmbeddedOAuthProvider) Authorize(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

+ func (p *EmbeddedOAuthProvider) GetConsentRequest(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

+ func (p *EmbeddedOAuthProvider) GetLoginRequest(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

+ func (p *EmbeddedOAuthProvider) Introspect(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

+ func (p *EmbeddedOAuthProvider) RejectConsent(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

+ func (p *EmbeddedOAuthProvider) RejectLogin(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)

+ func (p *EmbeddedOAuthProvider) Revoke(ctx context.Context, token string, tokenTypeHint string) error

+ func (p *EmbeddedOAuthProvider) Token(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

+ func (p *EmbeddedOAuthProvider) UserInfo(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

+ type EntStorage struct

+ func NewEntStorage(db *ent.Client, opts ...EntStorageOption) *EntStorage

+ func (s *EntStorage) ClientAssertionJWTValid(ctx context.Context, jti string) error

+ func (s *EntStorage) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *EntStorage) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error

+ func (s *EntStorage) CreateClient(ctx context.Context, client *Client) error

+ func (s *EntStorage) CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error

+ func (s *EntStorage) CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, ...) error

+ func (s *EntStorage) CreateUser(ctx context.Context, user *User) error

+ func (s *EntStorage) DeleteAccessTokenSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteClient(ctx context.Context, id string) error

+ func (s *EntStorage) DeletePKCERequestSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

+ func (s *EntStorage) DeleteUser(ctx context.Context, id uuid.UUID) error

+ func (s *EntStorage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetClient(ctx context.Context, clientID string) (fosite.Client, error)

+ func (s *EntStorage) GetClientByID(ctx context.Context, id string) (*Client, error)

+ func (s *EntStorage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *EntStorage) GetUserByEmail(ctx context.Context, email string) (*User, error)

+ func (s *EntStorage) GetUserByFederationID(ctx context.Context, federationID uuid.UUID) (*User, error)

+ func (s *EntStorage) GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)

+ func (s *EntStorage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

+ func (s *EntStorage) ListClients(ctx context.Context) ([]*Client, error)

+ func (s *EntStorage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (s *EntStorage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ func (s *EntStorage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

+ func (s *EntStorage) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

+ func (s *EntStorage) UpdateClient(ctx context.Context, client *Client) error

+ func (s *EntStorage) UpdateUser(ctx context.Context, user *User) error

+ func (s *EntStorage) ValidateSecretArgon2id(ctx context.Context, clientID, secret string) error

+ type EntStorageOption func(*EntStorage)

+ func WithDefaultOwner(ownerID uuid.UUID) EntStorageOption

+ type FeatureConfig struct

+ AllowDynamicRegistration bool

+ EnableDeviceFlow bool

+ EnableJWTAccessTokens bool

+ RequirePKCE bool

+ type FederationClient struct

+ func NewFederationClient(config *FederationConfig) (*FederationClient, error)

+ func (c *FederationClient) Config() *FederationConfig

+ func (c *FederationClient) Discovery() *SystemAuthDiscovery

+ func (c *FederationClient) ExchangeCode(ctx context.Context, code, redirectURI string) (*SSOTokenResponse, error)

+ func (c *FederationClient) GetGlobalIdentity(ctx context.Context, globalID uuid.UUID) (*GlobalIdentity, error)

+ func (c *FederationClient) GetIdentityMapping(ctx context.Context, globalID uuid.UUID) (*IdentityMapping, error)

+ func (c *FederationClient) GetSSOAuthorizationURL(ctx context.Context, state, redirectURI string) (string, error)

+ func (c *FederationClient) Initialize(ctx context.Context) error

+ func (c *FederationClient) NotifyAppAccess(ctx context.Context, sessionID uuid.UUID) error

+ func (c *FederationClient) RegisterWithSystemAuth(ctx context.Context, federationID uuid.UUID, displayName, baseURL string, ...) error

+ func (c *FederationClient) ValidateSSOSession(ctx context.Context, sessionID uuid.UUID) (*SSOSession, error)

+ type FederationConfig struct

+ AppID string

+ ClientID string

+ ClientSecret string

+ Enabled bool

+ SystemAuthURL string

+ type FederationEndpoints struct

+ func NewFederationEndpoints(server *Server, syncHandler IdentitySyncHandler) *FederationEndpoints

+ func (f *FederationEndpoints) RegisterRoutes()

+ type FederationHealthResponse struct

+ AppID string

+ Capabilities []string

+ Details map[string]string

+ Status string

+ Version string

+ type GlobalIdentity struct

+ Attributes map[string]interface{}

+ CreatedAt time.Time

+ DisplayName string

+ Email string

+ FederationID uuid.UUID

+ ID uuid.UUID

+ Status string

+ UpdatedAt time.Time

+ type Identity struct

+ CreatedAt time.Time

+ Credentials []IdentityCredential

+ ID uuid.UUID

+ Metadata map[string]any

+ State IdentityState

+ Traits IdentityTraits

+ UpdatedAt time.Time

+ type IdentityCredential struct

+ Identifiers []string

+ Type CredentialType

+ type IdentityFilter struct

+ Email string

+ Page int

+ PageSize int

+ State IdentityState

+ type IdentityMapping struct

+ AppID string

+ GlobalIdentityID uuid.UUID

+ ID uuid.UUID

+ LocalPrincipalID uuid.UUID

+ MappedAt time.Time

+ SyncStatus string

+ type IdentityProvider interface

+ CreateIdentity func(ctx context.Context, identity *Identity) error

+ DeleteIdentity func(ctx context.Context, id uuid.UUID) error

+ GetIdentity func(ctx context.Context, id uuid.UUID) (*Identity, error)

+ GetIdentityByEmail func(ctx context.Context, email string) (*Identity, error)

+ ListIdentities func(ctx context.Context, filter *IdentityFilter) ([]*Identity, error)

+ UpdateIdentity func(ctx context.Context, identity *Identity) error

+ type IdentityState string

+ const IdentityStateActive

+ const IdentityStateInactive

+ type IdentitySyncHandler interface

+ SyncIdentity func(ctx context.Context, req *IdentitySyncRequest) (*IdentitySyncResponse, error)

+ type IdentitySyncRequest struct

+ Action string

+ Identity *GlobalIdentity

+ type IdentitySyncResponse struct

+ Error string

+ LocalPrincipalID uuid.UUID

+ Status string

+ type IdentityTraits struct

+ Email string

+ EmailVerified bool

+ FamilyName string

+ GivenName string

+ Locale string

+ Name string

+ Picture string

+ type IntrospectInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type IntrospectOutput struct

+ Body IntrospectResponse

+ type IntrospectResponse struct

+ Active bool

+ Aud string

+ ClientID string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type JWKSInput struct

+ type JWKSOutput struct

+ Body jose.JSONWebKeySet

+ type KeyConfig struct

+ Algorithm string

+ PrivateKey *rsa.PrivateKey

+ RotationDays int

+ type MemoryStorage struct

+ func NewMemoryStorage() *MemoryStorage

+ func (s *MemoryStorage) CleanupExpired(ctx context.Context) error

+ func (s *MemoryStorage) ClientAssertionJWTValid(ctx context.Context, jti string) error

+ func (s *MemoryStorage) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *MemoryStorage) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error

+ func (s *MemoryStorage) CreateClient(ctx context.Context, client *Client) error

+ func (s *MemoryStorage) CreatePKCERequestSession(ctx context.Context, signature string, requester fosite.Requester) error

+ func (s *MemoryStorage) CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, ...) error

+ func (s *MemoryStorage) CreateUser(ctx context.Context, user *User) error

+ func (s *MemoryStorage) DeleteAccessTokenSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteClient(ctx context.Context, id string) error

+ func (s *MemoryStorage) DeletePKCERequestSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

+ func (s *MemoryStorage) DeleteUser(ctx context.Context, id uuid.UUID) error

+ func (s *MemoryStorage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetClient(ctx context.Context, id string) (fosite.Client, error)

+ func (s *MemoryStorage) GetClientByID(ctx context.Context, id string) (*Client, error)

+ func (s *MemoryStorage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *MemoryStorage) GetUserByEmail(ctx context.Context, email string) (*User, error)

+ func (s *MemoryStorage) GetUserByFederationID(ctx context.Context, federationID uuid.UUID) (*User, error)

+ func (s *MemoryStorage) GetUserByID(ctx context.Context, id uuid.UUID) (*User, error)

+ func (s *MemoryStorage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

+ func (s *MemoryStorage) ListClients(ctx context.Context) ([]*Client, error)

+ func (s *MemoryStorage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (s *MemoryStorage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ func (s *MemoryStorage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

+ func (s *MemoryStorage) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

+ func (s *MemoryStorage) UpdateClient(ctx context.Context, client *Client) error

+ func (s *MemoryStorage) UpdateUser(ctx context.Context, user *User) error

+ type OAuthAuthorizeRequest struct

+ ACRValues string

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ MaxAge int

+ Nonce string

+ Prompt string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ UILocales string

+ type OAuthAuthorizeResponse struct

+ Code string

+ Error string

+ ErrorDescription string

+ RedirectTo string

+ type OAuthClient struct

+ Audience []string

+ ClientID string

+ ClientName string

+ ClientSecret string

+ CreatedAt time.Time

+ GrantTypes []string

+ Metadata map[string]any

+ Public bool

+ RedirectURIs []string

+ ResponseTypes []string

+ Scope string

+ TokenEndpointAuthMethod string

+ UpdatedAt time.Time

+ type OAuthClientStore interface

+ CreateClient func(ctx context.Context, client *OAuthClient) error

+ DeleteClient func(ctx context.Context, clientID string) error

+ GetClient func(ctx context.Context, clientID string) (*OAuthClient, error)

+ ListClients func(ctx context.Context) ([]*OAuthClient, error)

+ UpdateClient func(ctx context.Context, client *OAuthClient) error

+ type OAuthConsentAccept struct

+ GrantScopes []string

+ Remember bool

+ RememberFor int

+ Session *ConsentSession

+ type OAuthConsentReject struct

+ Error string

+ ErrorDescription string

+ type OAuthConsentRequest struct

+ Challenge string

+ ClientID string

+ RequestedScopes []string

+ Skip bool

+ Subject string

+ type OAuthConsentResponse struct

+ RedirectTo string

+ type OAuthError struct

+ Error string

+ ErrorDescription string

+ ErrorURI string

+ type OAuthIntrospection struct

+ Active bool

+ Aud []string

+ ClientID string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type OAuthLoginAccept struct

+ ACR string

+ Context map[string]any

+ Remember bool

+ RememberFor int

+ Subject string

+ type OAuthLoginReject struct

+ Error string

+ ErrorDescription string

+ type OAuthLoginRequest struct

+ Challenge string

+ ClientID string

+ RequestedScopes []string

+ Skip bool

+ Subject string

+ type OAuthLoginResponse struct

+ RedirectTo string

+ type OAuthProvider interface

+ AcceptConsent func(ctx context.Context, challenge string, accept *OAuthConsentAccept) (*OAuthConsentResponse, error)

+ AcceptLogin func(ctx context.Context, challenge string, accept *OAuthLoginAccept) (*OAuthLoginResponse, error)

+ Authorize func(ctx context.Context, req *OAuthAuthorizeRequest) (*OAuthAuthorizeResponse, error)

+ GetConsentRequest func(ctx context.Context, challenge string) (*OAuthConsentRequest, error)

+ GetLoginRequest func(ctx context.Context, challenge string) (*OAuthLoginRequest, error)

+ Introspect func(ctx context.Context, token string, tokenTypeHint string) (*OAuthIntrospection, error)

+ RejectConsent func(ctx context.Context, challenge string, reject *OAuthConsentReject) (*OAuthConsentResponse, error)

+ RejectLogin func(ctx context.Context, challenge string, reject *OAuthLoginReject) (*OAuthLoginResponse, error)

+ Revoke func(ctx context.Context, token string, tokenTypeHint string) error

+ Token func(ctx context.Context, req *OAuthTokenRequest) (*OAuthTokenResponse, error)

+ UserInfo func(ctx context.Context, accessToken string) (*OAuthUserInfo, error)

+ type OAuthTokenRequest struct

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ type OAuthTokenResponse struct

+ AccessToken string

+ ExpiresIn int64

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type OAuthUserInfo struct

+ Email string

+ EmailVerified bool

+ FamilyName string

+ GivenName string

+ Locale string

+ Name string

+ Picture string

+ Sub string

+ Zoneinfo string

+ type OpenIDConfigInput struct

+ type OpenIDConfigOutput struct

+ Body OpenIDConfiguration

+ type OpenIDConfiguration struct

+ AuthorizationEndpoint string

+ ClaimsSupported []string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ IDTokenSigningAlgValuesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JwksURI string

+ RegistrationEndpoint string

+ ResponseModesSupported []string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ ScopesSupported []string

+ SubjectTypesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ UserinfoEndpoint string

+ type Option func(*Server)

+ func WithLogger(logger *slog.Logger) Option

+ func WithObservability(obs *observability.Observability) Option

+ func WithSessionProvider(provider SessionProvider) Option

+ func WithStorage(storage Storage) Option

+ type Providers struct

+ Authentication AuthenticationProvider

+ Identity IdentityProvider

+ OAuth OAuthProvider

+ OAuthClients OAuthClientStore

+ func NewProviders(server *Server, opts ...ProvidersOption) *Providers

+ func NewProvidersFromStorage(storage Storage, opts ...ProvidersOption) *Providers

+ type ProvidersOption func(*providersConfig)

+ func WithProviderPasswordVerifier(...) ProvidersOption

+ func WithProviderSessionDuration(d time.Duration) ProvidersOption

+ type RevokeInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type RevokeOutput struct

+ type SSOSession struct

+ AppsAccessed []string

+ AuthTime time.Time

+ ExpiresAt time.Time

+ GlobalIdentityID uuid.UUID

+ ID uuid.UUID

+ type SSOTokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type Server struct

+ func NewEmbedded(cfg Config, opts ...Option) (*Server, error)

+ func (s *Server) GetClient(id string) (*Client, error)

+ func (s *Server) Huma() huma.API

+ func (s *Server) Logger() *slog.Logger

+ func (s *Server) Middleware() func(http.Handler) http.Handler

+ func (s *Server) OAuth2Provider() fosite.OAuth2Provider

+ func (s *Server) OIDCSession(subject string, claims map[string]interface{}) *openid.DefaultSession

+ func (s *Server) Observability() *observability.Observability

+ func (s *Server) PublicKey() *rsa.PublicKey

+ func (s *Server) RegisterClient(client *Client) error

+ func (s *Server) RequireScopes(scopes ...string) func(http.Handler) http.Handler

+ func (s *Server) Router() chi.Router

+ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (s *Server) Session(subject string) *openid.DefaultSession

+ func (s *Server) SessionProvider() SessionProvider

+ func (s *Server) Storage() Storage

+ type SessionProvider interface

+ GetAuthenticatedUser func(r *http.Request) string

+ GetUserClaims func(ctx context.Context, userID string, scopes []string) map[string]interface{}

+ HasConsent func(ctx context.Context, userID, clientID string, scopes []string) bool

+ RedirectToConsent func(returnURL string) string

+ RedirectToLogin func(returnURL string) string

+ SaveConsent func(ctx context.Context, userID, clientID string, scopes []string) error

+ type Storage interface

+ ClientAssertionJWTValid func(ctx context.Context, jti string) error

+ CreateAccessTokenSession func(ctx context.Context, signature string, request fosite.Requester) error

+ CreateAuthorizeCodeSession func(ctx context.Context, code string, request fosite.Requester) error

+ CreateClient func(ctx context.Context, client *Client) error

+ CreatePKCERequestSession func(ctx context.Context, signature string, requester fosite.Requester) error

+ CreateRefreshTokenSession func(ctx context.Context, signature string, accessSignature string, ...) error

+ CreateUser func(ctx context.Context, user *User) error

+ DeleteAccessTokenSession func(ctx context.Context, signature string) error

+ DeleteClient func(ctx context.Context, id string) error

+ DeletePKCERequestSession func(ctx context.Context, signature string) error

+ DeleteRefreshTokenSession func(ctx context.Context, signature string) error

+ DeleteUser func(ctx context.Context, id uuid.UUID) error

+ GetAccessTokenSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetAuthorizeCodeSession func(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ GetClientByID func(ctx context.Context, id string) (*Client, error)

+ GetPKCERequestSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetRefreshTokenSession func(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ GetUserByEmail func(ctx context.Context, email string) (*User, error)

+ GetUserByFederationID func(ctx context.Context, federationID uuid.UUID) (*User, error)

+ GetUserByID func(ctx context.Context, id uuid.UUID) (*User, error)

+ InvalidateAuthorizeCodeSession func(ctx context.Context, code string) error

+ ListClients func(ctx context.Context) ([]*Client, error)

+ RevokeAccessToken func(ctx context.Context, requestID string) error

+ RevokeRefreshToken func(ctx context.Context, requestID string) error

+ RotateRefreshToken func(ctx context.Context, requestID string, refreshTokenSignature string) error

+ SetClientAssertionJWT func(ctx context.Context, jti string, exp time.Time) error

+ UpdateClient func(ctx context.Context, client *Client) error

+ UpdateUser func(ctx context.Context, user *User) error

+ type StoredRequest struct

+ ClientID string

+ Form map[string][]string

+ GrantedScopes []string

+ ID string

+ RequestedAt time.Time

+ Scopes []string

+ Session *StoredSession

+ type StoredSession struct

+ Claims map[string]any

+ Email string

+ ExpiresAt map[string]int64

+ RequestedAt int64

+ Subject string

+ Username string

+ type SystemAuthDiscovery struct

+ AuthorizationEndpoint string

+ IntrospectionEndpoint string

+ Issuer string

+ JwksURI string

+ RevocationEndpoint string

+ ScopesSupported []string

+ TokenEndpoint string

+ UserinfoEndpoint string

+ type TokenConfig struct

+ AccessTokenLifetime Duration

+ AuthCodeLifetime Duration

+ IDTokenLifetime Duration

+ RefreshTokenLifetime Duration

+ type TokenData struct

+ AccessExpiresAt int64

+ AccessTokenSignature string

+ ClientID string

+ RefreshExpiresAt int64

+ RefreshTokenSignature string

+ RequestID string

+ Revoked bool

+ Scopes []string

+ Session *StoredSession

+ Subject string

+ type TokenInput struct

+ Authorization string

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ type TokenOutput struct

+ Body TokenResponse

+ type TokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ type User struct

+ Active bool

+ CreatedAt time.Time

+ Email string

+ EmailVerified bool

+ FamilyName string

+ Federated bool

+ FederationID *uuid.UUID

+ GivenName string

+ ID uuid.UUID

+ Locale string

+ Metadata map[string]any

+ Name string

+ Picture string

+ UpdatedAt time.Time

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL