api

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: MIT Imports: 79 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DuplicateEmailMsg = "A user with this email address has already been registered"
	DuplicatePhoneMsg = "A user with this phone number has already been registered"
)

Common error messages during signup flow

View Source 
const (
	PKCEPrefix                    = "pkce_"
	MinCodeChallengeLength        = 43
	MaxCodeChallengeLength        = 128
	InvalidPKCEParamsErrorMessage = "PKCE flow requires code_challenge_method and code_challenge"
)
View Source 
const (
	EmailProvider = "email"
	PhoneProvider = "phone"
)

Provider constants

View Source 
const APIVersionHeaderName = "X-Supabase-Api-Version"
View Source 
const DefaultQRSize = 3
View Source 
const InvalidChannelError = "" /* 139-byte string literal not displayed */
View Source 
const InvalidLoginMessage = "Invalid login credentials"
View Source 
const InvalidNonceMessage = "Nonce has expired or is invalid"
View Source 
const MaxPasswordLength = 72

BCrypt hashed passwords have a 72 character limit

View Source 
const (
	QRCodeGenerationErrorMessage = "Error generating QR Code"
)
View Source 
const (
	SAMLSubjectIDAttributeName = "urn:oasis:names:tc:SAML:attribute:subject-id"
)

Variables

View Source 
var (
	APIVersionInitial  = time.Time{}
	APIVersion20240101 = time.Date(2024, time.January, 1, 0, 0, 0, 0, time.UTC)
)
View Source 
var (
	EmailRateLimitExceeded error = errors.New("email rate limit exceeded")
)
View Source 
var (
	UserExistsError error = errors.New("user already exists")
)

Functions

func FormatAPIVersion 

func FormatAPIVersion(apiVersion APIVersion) string

func HandleHealth 

func HandleHealth(w http.ResponseWriter, r *http.Request)

HandleHealth returns basic health status

func HandleLiveness 

func HandleLiveness(w http.ResponseWriter, r *http.Request)

HandleLiveness returns liveness status (is the process running?)

func HandleReadiness 

func HandleReadiness(db interface{ Ping() error }, upstreamURLs map[string]string) http.HandlerFunc

HandleReadiness returns readiness status (can we serve requests?) Checks database connectivity and probes optional upstream URLs (2s timeout each). upstreamURLs is a map of label → URL probed with a HEAD request; a non-2xx response marks that check as degraded but does not make the overall status 503.

func HandleResponseError 

func HandleResponseError(err error, w http.ResponseWriter, r *http.Request)

func IsSAMLMetadataStale 

func IsSAMLMetadataStale(idpMetadata *saml.EntityDescriptor, samlProvider models.SAMLProvider) bool

Types

type API 

type API struct {
	// contains filtered or unexported fields
}

API is the main REST API

func NewAPI 

func NewAPI(globalConfig *conf.GlobalConfiguration, db *storage.Connection, opt ...Option) *API

NewAPI instantiates a new REST API

func NewAPIWithVersion 

func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Connection, version string, opt ...Option) *API

NewAPIWithVersion creates a new REST API using the specified version

func (*API) ChallengeFactor 

func (a *API) ChallengeFactor(w http.ResponseWriter, r *http.Request) error

func (*API) DeleteIdentity 

func (a *API) DeleteIdentity(w http.ResponseWriter, r *http.Request) error

func (*API) DeliverInboundSendEmailHook 

func (a *API) DeliverInboundSendEmailHook(r *http.Request, in *v0hooks.SendEmailInput) error

DeliverInboundSendEmailHook performs templated delivery for a verified send-email hook payload (same templates as the non-hook path). Caller must validate the Standard Webhooks signature first.

func (*API) EnrollFactor 

func (a *API) EnrollFactor(w http.ResponseWriter, r *http.Request) error

func (*API) ExternalProviderCallback 

func (a *API) ExternalProviderCallback(w http.ResponseWriter, r *http.Request) error

ExternalProviderCallback handles the callback endpoint in the external oauth provider flow

func (*API) ExternalProviderRedirect 

func (a *API) ExternalProviderRedirect(w http.ResponseWriter, r *http.Request) error

ExternalProviderRedirect redirects the request to the oauth provider

func (*API) GetConfig 

func (a *API) GetConfig() *conf.GlobalConfiguration

func (*API) GetDB 

func (a *API) GetDB() *storage.Connection

func (*API) GetExternalProviderRedirectURL 

func (a *API) GetExternalProviderRedirectURL(w http.ResponseWriter, r *http.Request, linkingTargetUser *models.User) (string, error)

GetExternalProviderRedirectURL returns the URL to start the oauth flow with the corresponding oauth provider

func (*API) GetTokenService 

func (a *API) GetTokenService() *tokens.Service

func (*API) HealthCheck 

func (a *API) HealthCheck(w http.ResponseWriter, r *http.Request) error

HealthCheck endpoint indicates if the gotrue api service is available

func (*API) IdTokenGrant 

func (a *API) IdTokenGrant(ctx context.Context, w http.ResponseWriter, r *http.Request) error

IdTokenGrant implements the id_token grant type flow

func (*API) Invite 

func (a *API) Invite(w http.ResponseWriter, r *http.Request) error

Invite is the endpoint for inviting a new user

func (*API) LinkIdentity 

func (a *API) LinkIdentity(w http.ResponseWriter, r *http.Request) error

func (*API) Logout 

func (a *API) Logout(w http.ResponseWriter, r *http.Request) error

Logout is the endpoint for logging out a user and thereby revoking any refresh tokens 

func (a *API) MagicLink(w http.ResponseWriter, r *http.Request) error

MagicLink sends a recovery email

func (*API) Mailer 

func (a *API) Mailer() mailer.Mailer

func (*API) Now 

func (a *API) Now() time.Time

func (*API) OAuthProvider 

func (a *API) OAuthProvider(ctx context.Context, name string) (provider.OAuthProvider, conf.OAuthProviderConfiguration, error)

OAuthProvider returns the corresponding oauth provider as an OAuthProvider interface

func (*API) Otp 

func (a *API) Otp(w http.ResponseWriter, r *http.Request) error

Otp returns the MagicLink or SmsOtp handler based on the request body params

func (*API) PKCE 

func (a *API) PKCE(ctx context.Context, w http.ResponseWriter, r *http.Request) error

func (*API) PasskeyRegistrationOptions 

func (a *API) PasskeyRegistrationOptions(w http.ResponseWriter, r *http.Request) error

PasskeyRegistrationOptions handles POST /passkeys/registration/options. Requires authentication. Generates WebAuthn registration options for adding a passkey to an existing account.

func (*API) PasskeyRegistrationVerify 

func (a *API) PasskeyRegistrationVerify(w http.ResponseWriter, r *http.Request) error

PasskeyRegistrationVerify handles POST /passkeys/registration/verify. Requires authentication. Verifies the WebAuthn credential and creates a passkey for the authenticated user.

func (*API) Provider 

func (a *API) Provider(ctx context.Context, name string, scopes string) (provider.Provider, conf.OAuthProviderConfiguration, error)

Provider returns a Provider interface for the given name.

func (*API) Reauthenticate 

func (a *API) Reauthenticate(w http.ResponseWriter, r *http.Request) error

Reauthenticate sends a reauthentication otp to either the user's email or phone

func (*API) Recover 

func (a *API) Recover(w http.ResponseWriter, r *http.Request) error

Recover sends a recovery email

func (*API) RefreshTokenGrant 

func (a *API) RefreshTokenGrant(ctx context.Context, w http.ResponseWriter, r *http.Request) error

RefreshTokenGrant implements the refresh_token grant type flow

func (*API) Resend 

func (a *API) Resend(w http.ResponseWriter, r *http.Request) error

Recover sends a recovery email

func (*API) ResourceOwnerPasswordGrant 

func (a *API) ResourceOwnerPasswordGrant(ctx context.Context, w http.ResponseWriter, r *http.Request) error

ResourceOwnerPasswordGrant implements the password grant type flow

func (*API) SAMLMetadata 

func (a *API) SAMLMetadata(w http.ResponseWriter, r *http.Request) error

SAMLMetadata serves GoTrue's SAML Service Provider metadata file.

func (*API) SamlAcs 

func (a *API) SamlAcs(w http.ResponseWriter, r *http.Request) error

func (*API) ServeHTTP 

func (a *API) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP implements the http.Handler interface by passing the request along to its underlying Handler.

func (*API) Settings 

func (a *API) Settings(w http.ResponseWriter, r *http.Request) error

func (*API) Signup 

func (a *API) Signup(w http.ResponseWriter, r *http.Request) error

Signup is the endpoint for registering a new user

func (*API) SignupAnonymously 

func (a *API) SignupAnonymously(w http.ResponseWriter, r *http.Request) error

func (*API) SingleSignOn 

func (a *API) SingleSignOn(w http.ResponseWriter, r *http.Request) error

SingleSignOn handles the single-sign-on flow for a provided SSO domain or provider.

func (*API) SmsOtp 

func (a *API) SmsOtp(w http.ResponseWriter, r *http.Request) error

SmsOtp sends the user an otp via sms

func (*API) Token 

func (a *API) Token(w http.ResponseWriter, r *http.Request) error

Token is the endpoint for OAuth access token requests

func (*API) UnenrollFactor 

func (a *API) UnenrollFactor(w http.ResponseWriter, r *http.Request) error

func (*API) UserGet 

func (a *API) UserGet(w http.ResponseWriter, r *http.Request) error

UserGet returns a user

func (*API) UserUpdate 

func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error

UserUpdate updates fields on a user

func (*API) Verify 

func (a *API) Verify(w http.ResponseWriter, r *http.Request) error

Verify exchanges a confirmation or recovery token to a refresh token

func (*API) VerifyFactor 

func (a *API) VerifyFactor(w http.ResponseWriter, r *http.Request) error

func (*API) Version 

func (a *API) Version() string

func (*API) Web3Grant 

func (a *API) Web3Grant(ctx context.Context, w http.ResponseWriter, r *http.Request) error

func (*API) WellKnownJwks 

func (a *API) WellKnownJwks(w http.ResponseWriter, r *http.Request) error

func (*API) WellKnownOpenID 

func (a *API) WellKnownOpenID(w http.ResponseWriter, r *http.Request) error

WellKnownOpenID handles both OIDC Discovery and OAuth 2.0 Authorization Server Metadata endpoints This unified handler serves: - GET /.well-known/openid-configuration (OIDC Discovery) - GET /.well-known/oauth-authorization-server (RFC 8414)

Both endpoints return the same comprehensive metadata since OIDC Discovery is a superset of OAuth 2.0 metadata

type APIVersion 

type APIVersion = time.Time

func DetermineClosestAPIVersion 

func DetermineClosestAPIVersion(date string) (APIVersion, error)

type AccessTokenClaims 

type AccessTokenClaims = tokens.AccessTokenClaims

Aliases for backward compatibility

type AccessTokenResponse 

type AccessTokenResponse = tokens.AccessTokenResponse

type AdminCustomOAuthProviderParams 

type AdminCustomOAuthProviderParams struct {
	// Common fields
	ProviderType        string                 `json:"provider_type"` // "oauth2" or "oidc"
	Identifier          string                 `json:"identifier"`
	Name                string                 `json:"name"`
	ClientID            string                 `json:"client_id"`
	ClientSecret        string                 `json:"client_secret"`
	AcceptableClientIDs []string               `json:"acceptable_client_ids,omitempty"`
	Scopes              []string               `json:"scopes"`
	PKCEEnabled         *bool                  `json:"pkce_enabled,omitempty"`
	AttributeMapping    map[string]interface{} `json:"attribute_mapping,omitempty"`
	AuthorizationParams map[string]interface{} `json:"authorization_params,omitempty"`
	Enabled             *bool                  `json:"enabled,omitempty"`
	EmailOptional       *bool                  `json:"email_optional,omitempty"`

	// OIDC-specific fields
	Issuer         string  `json:"issuer,omitempty"`
	DiscoveryURL   *string `json:"discovery_url,omitempty"`
	SkipNonceCheck *bool   `json:"skip_nonce_check,omitempty"`

	// OAuth2-specific fields
	AuthorizationURL string  `json:"authorization_url,omitempty"`
	TokenURL         string  `json:"token_url,omitempty"`
	UserinfoURL      string  `json:"userinfo_url,omitempty"`
	JwksURI          *string `json:"jwks_uri,omitempty"`
}

AdminCustomOAuthProviderParams defines parameters for creating/updating providers

type AdminListUsersResponse 

type AdminListUsersResponse struct {
	Users []*models.User `json:"users"`
	Aud   string         `json:"aud"`
}

type AdminUserParams 

type AdminUserParams struct {
	Id           string                 `json:"id"`
	Aud          string                 `json:"aud"`
	Role         string                 `json:"role"`
	Email        string                 `json:"email"`
	Phone        string                 `json:"phone"`
	Password     *string                `json:"password"`
	PasswordHash string                 `json:"password_hash"`
	EmailConfirm bool                   `json:"email_confirm"`
	PhoneConfirm bool                   `json:"phone_confirm"`
	UserMetaData map[string]interface{} `json:"user_metadata"`
	AppMetaData  map[string]interface{} `json:"app_metadata"`
	BanDuration  string                 `json:"ban_duration"`
}

type AuthMicroserviceClaims 

type AuthMicroserviceClaims struct {
	jwt.RegisteredClaims
	SiteURL       string        `json:"site_url"`
	InstanceID    string        `json:"id"`
	FunctionHooks FunctionHooks `json:"function_hooks"`
}

type ChallengeFactorParams 

type ChallengeFactorParams struct {
	Channel  string          `json:"channel"`
	WebAuthn *WebAuthnParams `json:"webauthn,omitempty"`
}

type ChallengeFactorResponse 

type ChallengeFactorResponse struct {
	ID        uuid.UUID              `json:"id"`
	Type      string                 `json:"type"`
	ExpiresAt int64                  `json:"expires_at,omitempty"`
	WebAuthn  *WebAuthnChallengeData `json:"webauthn,omitempty"`
}

type CreateSSOProviderParams 

type CreateSSOProviderParams struct {
	Type string `json:"type"`

	MetadataURL      string                      `json:"metadata_url"`
	MetadataXML      string                      `json:"metadata_xml"`
	Domains          []string                    `json:"domains"`
	AttributeMapping models.SAMLAttributeMapping `json:"attribute_mapping"`
	NameIDFormat     string                      `json:"name_id_format"`

	ResourceID *string `json:"resource_id,omitempty"`
	Disabled   *bool   `json:"disabled,omitempty"`
}

type EnrollFactorParams 

type EnrollFactorParams struct {
	FriendlyName string `json:"friendly_name"`
	FactorType   string `json:"factor_type"`
	Issuer       string `json:"issuer"`
	Phone        string `json:"phone"`
}

type EnrollFactorResponse 

type EnrollFactorResponse struct {
	ID           uuid.UUID   `json:"id"`
	Type         string      `json:"type"`
	FriendlyName string      `json:"friendly_name"`
	TOTP         *TOTPObject `json:"totp,omitempty"`
	Phone        string      `json:"phone,omitempty"`
}

type ErrorCause 

type ErrorCause interface {
	Cause() error
}

ErrorCause is an error interface that contains the method Cause() for returning root cause errors

type FunctionHooks 

type FunctionHooks map[string][]string

func (*FunctionHooks) UnmarshalJSON 

func (f *FunctionHooks) UnmarshalJSON(b []byte) error

type GenerateLinkParams 

type GenerateLinkParams struct {
	Type       string                 `json:"type"`
	Email      string                 `json:"email"`
	NewEmail   string                 `json:"new_email"`
	Password   string                 `json:"password"`
	Data       map[string]interface{} `json:"data"`
	RedirectTo string                 `json:"redirect_to"`
}

type GenerateLinkResponse 

type GenerateLinkResponse struct {
	models.User
	ActionLink       string `json:"action_link"`
	EmailOtp         string `json:"email_otp"`
	HashedToken      string `json:"hashed_token"`
	VerificationType string `json:"verification_type"`
	RedirectTo       string `json:"redirect_to"`
}

type HTTPError 

type HTTPError = apierrors.HTTPError

Type aliases while we slowly refactor api errors.

type HTTPErrorResponse20240101 

type HTTPErrorResponse20240101 struct {
	Code    apierrors.ErrorCode `json:"code"`
	Message string              `json:"message"`
}

type HealthCheckResponse 

type HealthCheckResponse struct {
	Version     string `json:"version"`
	Name        string `json:"name"`
	Description string `json:"description"`
}

type HealthResponse 

type HealthResponse struct {
	Status        string            `json:"status"`
	Service       string            `json:"service"`
	Version       string            `json:"version,omitempty"`
	UptimeSeconds int64             `json:"uptime_seconds,omitempty"`
	Checks        map[string]string `json:"checks,omitempty"`
	Error         string            `json:"error,omitempty"`
}

HealthResponse represents a health check response

type IdTokenGrantParams 

type IdTokenGrantParams struct {
	IdToken      string `json:"id_token"`
	AccessToken  string `json:"access_token"`
	Nonce        string `json:"nonce"`
	Provider     string `json:"provider"`
	ClientID     string `json:"client_id"`
	Issuer       string `json:"issuer"`
	LinkIdentity bool   `json:"link_identity"`
}

IdTokenGrantParams are the parameters the IdTokenGrant method accepts

type InviteParams 

type InviteParams struct {
	Email string                 `json:"email"`
	Data  map[string]interface{} `json:"data"`
}

InviteParams are the parameters the Signup endpoint accepts

type JwksResponse 

type JwksResponse struct {
	Keys []jwk.Key `json:"keys"`
}

type LimiterOptions 

type LimiterOptions struct {
	Email ratelimit.Limiter
	Phone ratelimit.Limiter

	Signups             *limiter.Limiter
	AnonymousSignIns    *limiter.Limiter
	Recover             *limiter.Limiter
	Resend              *limiter.Limiter
	MagicLink           *limiter.Limiter
	Otp                 *limiter.Limiter
	Token               *limiter.Limiter
	Verify              *limiter.Limiter
	User                *limiter.Limiter
	FactorVerify        *limiter.Limiter
	FactorChallenge     *limiter.Limiter
	SSO                 *limiter.Limiter
	SAMLAssertion       *limiter.Limiter
	Web3                *limiter.Limiter
	OAuthClientRegister *limiter.Limiter
}

func NewLimiterOptions 

func NewLimiterOptions(gc *conf.GlobalConfiguration) *LimiterOptions

type LogoutBehavior 

type LogoutBehavior string
const (
	LogoutGlobal LogoutBehavior = "global"
	LogoutLocal  LogoutBehavior = "local"
	LogoutOthers LogoutBehavior = "others"
)

type MagicLinkParams 

type MagicLinkParams struct {
	Email               string                 `json:"email"`
	Data                map[string]interface{} `json:"data"`
	CodeChallengeMethod string                 `json:"code_challenge_method"`
	CodeChallenge       string                 `json:"code_challenge"`
}

MagicLinkParams holds the parameters for a magic link request

func (*MagicLinkParams) Validate 

func (p *MagicLinkParams) Validate(a *API) error

type OAuthError 

type OAuthError = apierrors.OAuthError

Type aliases while we slowly refactor api errors.

type OAuthProviderData 

type OAuthProviderData struct {
	// contains filtered or unexported fields
}

OAuthProviderData contains the userData and token returned by the oauth provider

type OpenIDConfigurationResponse 

type OpenIDConfigurationResponse struct {
	// Core Discovery Fields (Required by both OIDC and OAuth 2.0)
	Issuer                string `json:"issuer"`
	AuthorizationEndpoint string `json:"authorization_endpoint"`
	TokenEndpoint         string `json:"token_endpoint"`
	JWKSURL               string `json:"jwks_uri"`
	UserInfoEndpoint      string `json:"userinfo_endpoint,omitempty"` // OIDC-specific
	RegistrationEndpoint  string `json:"registration_endpoint,omitempty"`

	// Supported Parameters
	ScopesSupported                   []string `json:"scopes_supported,omitempty"`
	ResponseTypesSupported            []string `json:"response_types_supported"`
	ResponseModesSupported            []string `json:"response_modes_supported,omitempty"`
	GrantTypesSupported               []string `json:"grant_types_supported"`
	SubjectTypesSupported             []string `json:"subject_types_supported"`               // OIDC-specific
	IDTokenSigningAlgValuesSupported  []string `json:"id_token_signing_alg_values_supported"` // OIDC-specific
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"`
	ClaimsSupported                   []string `json:"claims_supported,omitempty"`       // OIDC-specific
	CodeChallengeMethodsSupported     []string `json:"code_challenge_methods_supported"` // OAuth 2.1/PKCE
}

OpenIDConfigurationResponse represents both OIDC Discovery and OAuth 2.0 Authorization Server Metadata This unified response serves both: - /.well-known/openid-configuration (OIDC Discovery per OpenID Connect Discovery 1.0) - /.well-known/oauth-authorization-server (OAuth Authorization Server Metadata per RFC 8414)

Since OIDC Discovery extends RFC 8414, a single response structure satisfies both specifications.

type Option 

type Option interface {
	// contains filtered or unexported methods
}

func WithMailer 

func WithMailer(m mailer.Mailer) Option

func WithTokenService 

func WithTokenService(service *tokens.Service) Option

type OtpParams 

type OtpParams struct {
	Email               string                 `json:"email"`
	Phone               string                 `json:"phone"`
	CreateUser          bool                   `json:"create_user"`
	Data                map[string]interface{} `json:"data"`
	Channel             string                 `json:"channel"`
	CodeChallengeMethod string                 `json:"code_challenge_method"`
	CodeChallenge       string                 `json:"code_challenge"`
}

OtpParams contains the request body params for the otp endpoint

func (*OtpParams) Validate 

func (p *OtpParams) Validate() error

type PKCEGrantParams 

type PKCEGrantParams struct {
	AuthCode     string `json:"auth_code"`
	CodeVerifier string `json:"code_verifier"`
}

PKCEGrantParams are the parameters the PKCEGrant method accepts

type PasskeyMetadataResponse 

type PasskeyMetadataResponse struct {
	ID             string                            `json:"id"`
	FriendlyName   string                            `json:"friendly_name,omitempty"`
	CreatedAt      time.Time                         `json:"created_at"`
	BackupEligible bool                              `json:"backup_eligible"`
	BackedUp       bool                              `json:"backed_up"`
	Transports     []protocol.AuthenticatorTransport `json:"transports"`
}

PasskeyMetadataResponse is the response body for successful passkey creation.

type PasskeyRegistrationOptionsParams 

type PasskeyRegistrationOptionsParams struct{}

PasskeyRegistrationOptionsParams is the request body for POST /passkeys/registration/options.

type PasskeyRegistrationOptionsResponse 

type PasskeyRegistrationOptionsResponse struct {
	ChallengeID string                       `json:"challenge_id"`
	Options     *protocol.CredentialCreation `json:"options"`
	ExpiresAt   int64                        `json:"expires_at"`
}

PasskeyRegistrationOptionsResponse is the response body for POST /passkeys/registration/options.

type PasskeyRegistrationVerifyParams 

type PasskeyRegistrationVerifyParams struct {
	ChallengeID        string          `json:"challenge_id"`
	CredentialResponse json.RawMessage `json:"credential_response"`
}

PasskeyRegistrationVerifyParams is the request body for POST /passkeys/registration/verify.

type PasswordGrantParams 

type PasswordGrantParams struct {
	Email    string `json:"email"`
	Phone    string `json:"phone"`
	Password string `json:"password"`
}

PasswordGrantParams are the parameters the ResourceOwnerPasswordGrant method accepts

type ProviderSettings 

type ProviderSettings struct {
	AnonymousUsers bool `json:"anonymous_users"`
	Apple          bool `json:"apple"`
	Azure          bool `json:"azure"`
	Bitbucket      bool `json:"bitbucket"`
	Discord        bool `json:"discord"`
	Facebook       bool `json:"facebook"`
	Snapchat       bool `json:"snapchat"`
	Figma          bool `json:"figma"`
	Fly            bool `json:"fly"`
	GitHub         bool `json:"github"`
	GitLab         bool `json:"gitlab"`
	Google         bool `json:"google"`
	Keycloak       bool `json:"keycloak"`
	Kakao          bool `json:"kakao"`
	Linkedin       bool `json:"linkedin"`
	LinkedinOIDC   bool `json:"linkedin_oidc"`
	Notion         bool `json:"notion"`
	Spotify        bool `json:"spotify"`
	Slack          bool `json:"slack"`
	SlackOIDC      bool `json:"slack_oidc"`
	WorkOS         bool `json:"workos"`
	Twitch         bool `json:"twitch"`
	Twitter        bool `json:"twitter"`
	Email          bool `json:"email"`
	Phone          bool `json:"phone"`
	Zoom           bool `json:"zoom"`
}

type RecoverParams 

type RecoverParams struct {
	Email               string `json:"email"`
	CodeChallenge       string `json:"code_challenge"`
	CodeChallengeMethod string `json:"code_challenge_method"`
}

RecoverParams holds the parameters for a password recovery request

func (*RecoverParams) Validate 

func (p *RecoverParams) Validate(a *API) error

type RefreshTokenGrantParams 

type RefreshTokenGrantParams struct {
	RefreshToken string `json:"refresh_token"`
}

RefreshTokenGrantParams are the parameters the RefreshTokenGrant method accepts

func (*RefreshTokenGrantParams) Validate 

func (p *RefreshTokenGrantParams) Validate() error

type RequestParams 

type RequestParams interface {
	AdminUserParams |
		AdminCustomOAuthProviderParams |
		CreateSSOProviderParams |
		EnrollFactorParams |
		GenerateLinkParams |
		IdTokenGrantParams |
		InviteParams |
		OtpParams |
		PKCEGrantParams |
		PasswordGrantParams |
		RecoverParams |
		RefreshTokenGrantParams |
		ResendConfirmationParams |
		SignupParams |
		SingleSignOnParams |
		SmsParams |
		Web3GrantParams |
		UserUpdateParams |
		VerifyFactorParams |
		VerifyParams |
		adminUserUpdateFactorParams |
		adminUserDeleteParams |
		security.GotrueRequest |
		ChallengeFactorParams |

		struct {
			Email string `json:"email"`
			Phone string `json:"phone"`
		} |
		struct {
			Email string `json:"email"`
		}
}

type ResendConfirmationParams 

type ResendConfirmationParams struct {
	Type  string `json:"type"`
	Email string `json:"email"`
	Phone string `json:"phone"`
}

ResendConfirmationParams holds the parameters for a resend request

func (*ResendConfirmationParams) Validate 

func (p *ResendConfirmationParams) Validate(a *API) error

type SAMLAssertion 

type SAMLAssertion struct {
	*saml.Assertion
}

func (*SAMLAssertion) Attribute 

func (a *SAMLAssertion) Attribute(name string) []saml.AttributeValue

Attribute returns the first matching attribute value in the attribute statements where name equals the official SAML attribute Name or FriendlyName. Returns nil if such an attribute can't be found.

func (*SAMLAssertion) Email 

func (a *SAMLAssertion) Email() string

Email returns the best guess for an email address.

func (*SAMLAssertion) NotAfter 

func (a *SAMLAssertion) NotAfter() time.Time

NotAfter extracts the time at which or after this assertion should not be considered.

func (*SAMLAssertion) NotBefore 

func (a *SAMLAssertion) NotBefore() time.Time

NotBefore extracts the time before which this assertion should not be considered.

func (*SAMLAssertion) Process 

func (a *SAMLAssertion) Process(mapping models.SAMLAttributeMapping) map[string]interface{}

Process processes this assertion according to the SAMLAttributeMapping. Never returns nil.

func (*SAMLAssertion) SubjectID 

func (a *SAMLAssertion) SubjectID() (string, bool)

SubjectID returns the user identifier in present in the Subject section of the SAML assertion. Note that this way of identifying the Subject is generally superseded by the SAMLSubjectIDAttributeName assertion attribute; tho must be present in all assertions. It can have a few formats, of which the most important are: saml.EmailAddressNameIDFormat (meaning the user ID is an email address), saml.PersistentNameIDFormat (the user ID is an opaque string that does not change with each assertion, e.g. UUID), saml.TransientNameIDFormat (the user ID changes with each assertion -- can't be used to identify a user). The boolean returned identifies if the user ID is persistent. If it's an email address, it's lowercased just in case.

func (*SAMLAssertion) UserID 

func (a *SAMLAssertion) UserID() string

UserID returns the best choice for a persistent user identifier on the Identity Provider side. Don't assume the format of the string returned, as it's Identity Provider specific.

type Settings 

type Settings struct {
	ExternalProviders ProviderSettings `json:"external"`
	DisableSignup     bool             `json:"disable_signup"`
	MailerAutoconfirm bool             `json:"mailer_autoconfirm"`
	PhoneAutoconfirm  bool             `json:"phone_autoconfirm"`
	SmsProvider       string           `json:"sms_provider"`
	SAMLEnabled       bool             `json:"saml_enabled"`
	PasskeysEnabled   bool             `json:"passkeys_enabled"`
}

type SignupParams 

type SignupParams struct {
	Email               string                 `json:"email"`
	Phone               string                 `json:"phone"`
	Password            string                 `json:"password"`
	Data                map[string]interface{} `json:"data"`
	Provider            string                 `json:"-"`
	Aud                 string                 `json:"-"`
	Channel             string                 `json:"channel"`
	CodeChallengeMethod string                 `json:"code_challenge_method"`
	CodeChallenge       string                 `json:"code_challenge"`
}

SignupParams are the parameters the Signup endpoint accepts

func (*SignupParams) ConfigureDefaults 

func (p *SignupParams) ConfigureDefaults()

func (*SignupParams) ToUserModel 

func (params *SignupParams) ToUserModel(isSSOUser bool) (user *models.User, err error)

type SingleSignOnParams 

type SingleSignOnParams struct {
	ProviderID          uuid.UUID `json:"provider_id"`
	Domain              string    `json:"domain"`
	RedirectTo          string    `json:"redirect_to"`
	SkipHTTPRedirect    *bool     `json:"skip_http_redirect"`
	CodeChallenge       string    `json:"code_challenge"`
	CodeChallengeMethod string    `json:"code_challenge_method"`
}

type SingleSignOnResponse 

type SingleSignOnResponse struct {
	URL string `json:"url"`
}

type SmsOtpResponse 

type SmsOtpResponse struct {
	MessageID string `json:"message_id,omitempty"`
}

type SmsParams 

type SmsParams struct {
	Phone               string                 `json:"phone"`
	Channel             string                 `json:"channel"`
	Data                map[string]interface{} `json:"data"`
	CodeChallengeMethod string                 `json:"code_challenge_method"`
	CodeChallenge       string                 `json:"code_challenge"`
}

SmsParams contains the request body params for sms otp

func (*SmsParams) Validate 

func (p *SmsParams) Validate(config *conf.GlobalConfiguration) error

type TOTPObject 

type TOTPObject struct {
	QRCode string `json:"qr_code,omitempty"`
	Secret string `json:"secret,omitempty"`
	URI    string `json:"uri,omitempty"`
}

type UnenrollFactorResponse 

type UnenrollFactorResponse struct {
	ID uuid.UUID `json:"id"`
}

type UserUpdateParams 

type UserUpdateParams struct {
	Email               string                 `json:"email"`
	Password            *string                `json:"password"`
	CurrentPassword     *string                `json:"current_password,omitempty"`
	Nonce               string                 `json:"nonce"`
	Data                map[string]interface{} `json:"data"`
	AppData             map[string]interface{} `json:"app_metadata,omitempty"`
	Phone               string                 `json:"phone"`
	Channel             string                 `json:"channel"`
	CodeChallenge       string                 `json:"code_challenge"`
	CodeChallengeMethod string                 `json:"code_challenge_method"`
}

UserUpdateParams parameters for updating a user

type VerifyFactorParams 

type VerifyFactorParams struct {
	ChallengeID uuid.UUID       `json:"challenge_id"`
	Code        string          `json:"code"`
	WebAuthn    *WebAuthnParams `json:"webauthn,omitempty"`
}

type VerifyParams 

type VerifyParams struct {
	Type       string `json:"type"`
	Token      string `json:"token"`
	TokenHash  string `json:"token_hash"`
	Email      string `json:"email"`
	Phone      string `json:"phone"`
	RedirectTo string `json:"redirect_to"`
}

VerifyParams are the parameters the Verify endpoint accepts

func (*VerifyParams) Validate 

func (p *VerifyParams) Validate(r *http.Request, a *API) error

type WeakPasswordError 

type WeakPasswordError struct {
	Message string   `json:"message,omitempty"`
	Reasons []string `json:"reasons,omitempty"`
}

WeakPasswordError encodes an error that a password does not meet strength requirements. It is handled specially in errors.go as it gets transformed to a HTTPError with a special weak_password field that encodes the Reasons slice.

func (*WeakPasswordError) Error 

func (e *WeakPasswordError) Error() string

type Web3GrantParams 

type Web3GrantParams struct {
	Message   string `json:"message,omitempty"`
	Signature string `json:"signature,omitempty"`
	Chain     string `json:"chain,omitempty"`
}

type WebAuthnChallengeData 

type WebAuthnChallengeData struct {
	Type              string      `json:"type"` // "create" or "request"
	CredentialOptions interface{} `json:"credential_options"`
}

type WebAuthnParams 

type WebAuthnParams struct {
	RPID               string          `json:"rpId,omitempty"`
	RPOrigins          []string        `json:"rpOrigins,omitempty"`
	Type               string          `json:"type"` // "create" or "request"
	CredentialResponse json.RawMessage `json:"credential_response"`
}

func (*WebAuthnParams) ToConfig 

func (w *WebAuthnParams) ToConfig() (*webauthn.WebAuthn, error)

Notes

Bugs

  • This introduced a bug which mismatched the token and hash fields, such that: 

    EmailData.TokenHashNew = Hash(CurEmail, EmailData.Token)
EmailData.TokenHash = Hash(NewEmail, EmailData.TokenNew)

    Specifically with email changes we should look to fix this behavior in a BC way to maintain that: 

    Token Always contains the Token for user.email
TokenHash Always contains the Hash for user.email

Token Always contains the Token for user.email_new
TokenHash Always contains the Hash for user.email_new

  • This matches the current behavior but is not intuitive and should be changed in a future release. See the comment above for more details.

Source Files

View all Source files

Directories

Path Synopsis
Package apitask provides a background execution context for background work that limits the execution time to the current request.
 Package apitask provides a background execution context for background work that limits the execution time to the current request.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.