Documentation
¶
Overview ¶
Package usermanager pkg/visor/usermanager/user.go c3-vis-core
Package usermanager pkg/visor/usermanager/user_manager.go c3-vis-core
Index ¶
- Variables
- type Argon2Params
- type BoltUserStore
- type Session
- type SingleUserStore
- type User
- type UserManager
- func (s *UserManager) Authorize(next http.Handler) http.Handler
- func (s *UserManager) ChangeAdminPassword(oldPassword, newPassword string) error
- func (s *UserManager) ChangePassword() http.HandlerFunc
- func (s *UserManager) Close() error
- func (s *UserManager) CreateAccount() http.HandlerFunc
- func (s *UserManager) Login() http.HandlerFunc
- func (s *UserManager) Logout() http.HandlerFunc
- func (s *UserManager) SetAdminPassword(newPassword string) error
- func (s *UserManager) UserExists() http.HandlerFunc
- func (s *UserManager) UserInfo() http.HandlerFunc
- type UserStore
Constants ¶
This section is empty.
Variables ¶
var ( ErrBadPasswordLen = fmt.Errorf("password length should be between %d and %d chars", minPasswordLen, maxPasswordLen) ErrSimplePassword = fmt.Errorf("password must have at least one upper, lower, digit and special character") ErrUserExists = fmt.Errorf("username already exists") ErrNameNotAllowed = fmt.Errorf("name not allowed") ErrNonASCII = fmt.Errorf("non-ASCII character found") )
Errors returned by UserStore.
var ( ErrNotLoggedIn = errors.New("not logged in") ErrNotLoggedOut = errors.New("not logged out") ErrBadLogin = errors.New("incorrect username or password") ErrBadSession = errors.New("session cookie is either non-existent, expired, or ill-formatted") ErrMalformedRequest = errors.New("request format is malformed") ErrBadUsernameFormat = errors.New("format of 'username' is not accepted") ErrUserNotFound = errors.New("user is either deleted or not found") )
Errors associated with user management.
Functions ¶
This section is empty.
Types ¶
type Argon2Params ¶
Argon2Params are the Argon2id costs a password key was derived with.
type BoltUserStore ¶
BoltUserStore implements UserStore, storing users in a bbolt database file.
func NewBoltUserStore ¶
func NewBoltUserStore(path string) (*BoltUserStore, error)
NewBoltUserStore creates a new BoltUserStore.
func (*BoltUserStore) AddUser ¶
func (s *BoltUserStore) AddUser(user User) error
AddUser adds a new user.
func (*BoltUserStore) RemoveUser ¶
func (s *BoltUserStore) RemoveUser(name string) error
RemoveUser removes a user of given username.
func (*BoltUserStore) SetUser ¶
func (s *BoltUserStore) SetUser(user User) error
SetUser changes an existing user.
type Session ¶
type Session struct {
SID uuid.UUID `json:"sid"`
User string `json:"username"`
Expiry time.Time `json:"expiry"`
}
Session represents a user session.
type SingleUserStore ¶
type SingleUserStore struct {
UserStore
// contains filtered or unexported fields
}
SingleUserStore implements UserStore while enforcing only having a single user.
func NewSingleUserStore ¶
func NewSingleUserStore(username string, users UserStore) *SingleUserStore
NewSingleUserStore creates a new SingleUserStore with provided username and UserStore.
func (*SingleUserStore) AddUser ¶
func (s *SingleUserStore) AddUser(user User) error
AddUser adds a new user.
func (*SingleUserStore) RemoveUser ¶
func (s *SingleUserStore) RemoveUser(name string) error
RemoveUser removes a user.
func (*SingleUserStore) SetUser ¶
func (s *SingleUserStore) SetUser(user User) error
SetUser sets an existing user.
type User ¶
type User struct {
Name string
PwSalt []byte
// PwHash is the SHA-256 of the password and salt, kept for users saved
// before PwKey existed. Such a password is rehashed at the next login.
PwHash cipher.SHA256
// PwKey is the Argon2id key of the password and salt under PwParams.
PwKey []byte
PwParams *Argon2Params
}
User represents a user of the hypervisor.
func DecodeUser ¶
DecodeUser decodes the user from bytes.
func (*User) SetPassword ¶
SetPassword checks the provided password, and sets the password if format is valid.
func (*User) UpgradePassword ¶
UpgradePassword rehashes a verified password saved with the old SHA-256 scheme or older costs, reporting whether the user changed and needs saving. The password is not checked against the current format rules, which it may predate.
func (*User) VerifyPassword ¶
VerifyPassword verifies the password input with hash and salt.
type UserManager ¶
type UserManager struct {
// contains filtered or unexported fields
}
UserManager manages the users and sessions.
func NewUserManager ¶
func NewUserManager(mLog *logging.MasterLogger, users UserStore, config visorconfig.CookieConfig) *UserManager
NewUserManager creates a new UserManager.
func (*UserManager) Authorize ¶
func (s *UserManager) Authorize(next http.Handler) http.Handler
Authorize is an http middleware for authorizing requests.
func (*UserManager) ChangeAdminPassword ¶
func (s *UserManager) ChangeAdminPassword(oldPassword, newPassword string) error
ChangeAdminPassword updates the password for the "admin" account without requiring an HTTP session — intended for the local RPC path (skywire cli visor hv passwd) which is already privileged. Verifies the old password before writing the new one, enforces the same checkPasswordFormat rules ChangePassword does, and invalidates every active session for the user so old cookies can't be replayed.
func (*UserManager) ChangePassword ¶
func (s *UserManager) ChangePassword() http.HandlerFunc
ChangePassword returns a HandlerFunc for changing the user's password.
func (*UserManager) Close ¶
func (s *UserManager) Close() error
Close closes the underlying db, used for Windows.
func (*UserManager) CreateAccount ¶
func (s *UserManager) CreateAccount() http.HandlerFunc
CreateAccount returns a HandlerFunc for account creation.
func (*UserManager) Login ¶
func (s *UserManager) Login() http.HandlerFunc
Login returns a HandlerFunc for login operations.
func (*UserManager) Logout ¶
func (s *UserManager) Logout() http.HandlerFunc
Logout returns a HandlerFunc of logout operations.
func (*UserManager) SetAdminPassword ¶
func (s *UserManager) SetAdminPassword(newPassword string) error
SetAdminPassword sets the "admin" account password WITHOUT requiring the old one, creating the admin account if it doesn't exist yet. Intended for the local privileged RPC path (skywire cli visor hv passwd --force): a forgotten-password reset, or a first-time set straight from the CLI without the UI's create-account page. Enforces the same checkPasswordFormat rules and invalidates every active session for the user so old cookies can't be replayed.
func (*UserManager) UserExists ¶
func (s *UserManager) UserExists() http.HandlerFunc
UserExists returns a HandlerFunc that reports whether an account has been created. This endpoint is public (no auth required) so the login page can decide whether to show "Create account" or "Log in".
func (*UserManager) UserInfo ¶
func (s *UserManager) UserInfo() http.HandlerFunc
UserInfo returns a HandlerFunc for obtaining user info.