Documentation
¶
Index ¶
- Variables
- type Strategy
- func (s *Strategy) AsBearer() *Strategy
- func (s *Strategy) GenerateAPIToken(userID string, ttl int) (string, error)
- func (s *Strategy) Identify(ctx router.Context) (string, error)
- func (s *Strategy) Issue(ctx router.Context, userID string) error
- func (s *Strategy) Revoke(ctx router.Context) error
- func (s *Strategy) WithCookieName(name string) *Strategy
- func (s *Strategy) WithDomain(domain string) *Strategy
Constants ¶
This section is empty.
Variables ¶
var ErrJWTSecretRequired = fmt.Err("JWTSecret", "is", "required")
ErrJWTSecretRequired is returned by New when secret is empty.
Functions ¶
This section is empty.
Types ¶
type Strategy ¶
type Strategy struct {
// contains filtered or unexported fields
}
Strategy is a stateless SessionStrategy: no DB lookup per request, no server-side revocation. bearer=false (default) carries the JWT in an HttpOnly cookie (browser-friendly, supports the same redirect-after-login flow as cookie.Strategy). bearer=true reads/writes via the "Authorization: Bearer" header instead (API/MCP clients that can't use cookies) — call AsBearer().
func New ¶
func New(secret []byte, ttl int, notify auth.SecurityNotifier, users auth.IdentityStore) (*Strategy, error)
New builds a JWT strategy. Fails fast if secret is empty — a JWT strategy with no secret can mint tokens nobody can validate.
func (*Strategy) AsBearer ¶
AsBearer switches transport to the Authorization header — for stateless API clients (MCP servers, IDEs, LLMs) that cannot use cookies.
func (*Strategy) GenerateAPIToken ¶
GenerateAPIToken mints a signed, long-lived Bearer token for API access (MCP clients, IDEs, LLMs) — independent of how browser sessions are carried. ttl==0 → 50 years (effectively no expiry; not 100: this module compiles for the edge, where int is 32-bit, and 100 years of seconds overflows int32). Call it on whichever Strategy value the app already holds (bearer or not — signing doesn't depend on transport).
func (*Strategy) WithCookieName ¶
WithCookieName overrides the cookie the JWT travels in (bearer mode ignores it).
func (*Strategy) WithDomain ¶ added in v0.0.7
WithDomain sets the cookie's Domain attribute — for a session meant to be shared across subdomains of a parent domain (e.g. ".velty.cl"). Ignored in bearer mode (no cookie is set). Empty string (default) leaves Domain unset: the browser scopes the cookie to the exact host that issued it, unchanged from before this method existed.
Source Files