Documentation
¶
Overview ¶
Package onetimeaccess issues single-use sign-in tokens delivered by email: admins mint them per user; unauthenticated users may request one for their own address when the app policy allows. Storage: auth_tokens (purpose = one_time_access, hash at rest) via the shared token store.
Index ¶
Constants ¶
const ( // TokenTTL bounds one-time access tokens. TokenTTL = 15 * time.Minute // ResendThrottle bounds re-request frequency. ResendThrottle = time.Minute )
Token lifetime and resend throttle.
Variables ¶
var ( // ErrNotFound covers unknown tokens/users without leaking which. ErrNotFound = errors.New("onetimeaccess: token is invalid or expired") // ErrThrottled rejects re-requests inside the resend window. ErrThrottled = errors.New("onetimeaccess: request throttled") )
Errors surfaced to handlers.
Functions ¶
This section is empty.
Types ¶
type Feature ¶
type Feature struct {
// contains filtered or unexported fields
}
Feature is the wireable unit.
func (Feature) APIRoutes ¶
func (f Feature) APIRoutes(r chi.Router, _ identity.RouteGroups)
APIRoutes mounts the retained one-time access endpoints relative to the /api group: only the email-link token exchange. The email request and the admin surface serve ConnectRPC below /rpc.
func (Feature) RPCService ¶ added in v0.0.12
RPCService returns the Connect registration for the one-time access surface.
func (Feature) WithAccessAuthenticator ¶ added in v0.0.12
func (f Feature) WithAccessAuthenticator(access kernel.AccessAuthenticator) Feature
WithAccessAuthenticator wires the bearer resolver the admin procedures guard with.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service orchestrates one-time access tokens.
func NewService ¶
func NewService(store token.Store, users user.Store, sessions *session.Service, recorder identity.Recorder, opts ...ServiceOption) *Service
NewService builds the feature.
func (*Service) RPCService ¶ added in v0.0.12
RPCService returns the Connect registration for the one-time access surface. RequestEmail is anonymous (enumeration-safe 204); the admin procedures resolve the bearer and demand an admin. The token exchange itself stays the REST email-link endpoint.
type ServiceOption ¶
type ServiceOption func(*Service)
ServiceOption configures the feature.
func WithMail ¶
func WithMail(sender identity.MailSender, appURL string) ServiceOption
WithMail wires the queued email sender and the base URL used to build the sign-in link.
Source Files