Documentation
¶
Overview ¶
Package auth wires the email/password auth handlers (signup, login, logout, password reset, email verification) onto the chi router.
Design points worth knowing:
- Login is constant-time: when the username doesn't exist we still run a Verify against a pre-computed dummy hash so response time doesn't leak existence.
- Password-reset returns the same generic notice whether or not the email maps to a real account (no enumeration via the reset flow).
- Tokens (verification, reset) are 32-byte random, b64url-encoded for the URL, sha256-stored in the DB.
- Rate limits are enforced via internal/auth/throttle (login, signup, password-reset). Login on success resets the counter for that key.
- Honeypot: signup form has a hidden `company` field; non-empty submissions are silently dropped (200 + same notice as success so bots can't tell they were rejected).
- 4 KiB request-body cap on every POST here so weaponized inputs can't push the argon2 hasher into a DoS spiral.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Deps ¶
type Deps struct {
Logger *slog.Logger
Render *render.Renderer
Pool *pgxpool.Pool
SessionStore session.Store
Email email.Sender
Branding email.Branding
Argon2 password.Params
Limiter *throttle.Limiter
// RateLimiter wraps the S35 generalised rate-limit table. Used
// for the per-/24 signup throttle (anti-abuse heuristic). nil
// disables the secondary throttle; the per-IP S05 limiter still
// applies.
RateLimiter *ratelimit.Limiter
RequireEmailVerification bool
// SecretBox encrypts at-rest TOTP secrets. May be nil; when nil, the
// 2FA enrollment endpoints are not registered.
SecretBox *secretbox.Box
// Audit records security-relevant events (2fa state changes, etc.).
Audit *audit.Recorder
// ObjectStore is the avatar / attachment backend. May be nil; when
// nil the avatar upload endpoint is not registered (the user keeps
// their identicon and never sees the upload form).
ObjectStore storage.ObjectStore
}
Deps is everything the auth handlers need. Constructed by the web package and injected at registration time.
Source Files
Click to show internal directories.
Click to hide internal directories.