Documentation
¶
Index ¶
- type Module
- func (m *Module) Add() []any
- func (m *Module) AssignLANIP(userID, ip, label string) error
- func (m *Module) AssignPermission(roleID, permissionID string) error
- func (m *Module) AssignRole(userID, roleID string) error
- func (m *Module) Authenticate() router.Middleware
- func (m *Module) Bootstrap(s Seed) error
- func (m *Module) Can(userID string, resource model.Resource, action model.Action) bool
- func (m *Module) ConsumeState(state, provider string) error
- func (m *Module) CreatePermission(id, name string, resource model.Resource, action model.Action) error
- func (m *Module) CreateRole(id string, code model.RoleCode, name, description string) error
- func (m *Module) CreateSession(userID, ip, userAgent string) (auth.Session, error)
- func (m *Module) CreateState(provider string) (string, error)
- func (m *Module) CreateUser(email, name, phone string) (auth.User, error)
- func (m *Module) DeletePermission(id string) error
- func (m *Module) DeleteRole(id string) error
- func (m *Module) DeleteSession(id string) error
- func (m *Module) Enable(auths ...auth.Authenticator)
- func (m *Module) GetLANIPs(userID string) ([]auth.LANIP, error)
- func (m *Module) GetOrCreateSubject(id user.SubjectID, email, name, avatar string) (user.Subject, error)
- func (m *Module) GetPermission(id string) (*auth.Permission, error)
- func (m *Module) GetRole(id string) (*auth.Role, error)
- func (m *Module) GetRoleByCode(code model.RoleCode) (*auth.Role, error)
- func (m *Module) GetSession(id string) (auth.Session, error)
- func (m *Module) GetUser(id string) (auth.User, error)
- func (m *Module) GetUserByEmail(email string) (auth.User, error)
- func (m *Module) GetUserIdentities(userID string) ([]auth.Identity, error)
- func (m *Module) GetUserRoles(userID string) ([]auth.Role, error)
- func (m *Module) HasPermission(userID string, resource model.Resource, action model.Action) (bool, error)
- func (m *Module) IdentityByProvider(provider, providerID string) (auth.Identity, error)
- func (m *Module) IdentityFor(userID, provider string) (auth.Identity, error)
- func (m *Module) IsTrustedIP(userID, ip string) bool
- func (m *Module) IssueSession(ctx router.Context, userID string) error
- func (m *Module) Login(email, password string) (auth.User, error)
- func (m *Module) LoginLAN(rut string, ctx router.Context) (auth.User, error)
- func (m *Module) ModelName() string
- func (m *Module) MountAPI(r router.Router)
- func (m *Module) MountOps(reg router.OpRegistry)
- func (m *Module) Notify(e auth.SecurityEvent)
- func (m *Module) PurgeExpiredOAuthStates() error
- func (m *Module) PurgeExpiredSessions() error
- func (m *Module) PurgeSessionsByUser(userID string) error
- func (m *Module) ReactivateUser(id string) error
- func (m *Module) Register(handlers ...RBACObject) error
- func (m *Module) RegisterLAN(userID, rut string) error
- func (m *Module) RevokeLANIP(userID, ip string) error
- func (m *Module) RevokeRole(userID, roleID string) error
- func (m *Module) RotateSession(oldID, ip, userAgent string) (auth.Session, error)
- func (m *Module) SetLog(fn func(...any))
- func (m *Module) SetPassword(userID, password string) error
- func (m *Module) SetStrategy(s auth.SessionStrategy)
- func (m *Module) SuspendUser(id string) error
- func (m *Module) UnlinkIdentity(userID, provider string) error
- func (m *Module) UnregisterLAN(userID string) error
- func (m *Module) UpdateUserAvatar(userID, avatar string) error
- func (m *Module) UpsertIdentity(userID, provider, providerID, email string) error
- func (m *Module) UserByEmail(email string) (auth.User, error)
- func (m *Module) UserByID(id string) (auth.User, error)
- func (m *Module) VerifyPassword(userID, password string) error
- type RBACObject
- type Seed
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the user/auth/rbac handle. All backend operations are methods on this type. Created exclusively via New().
func New ¶
New initializes the schema, warms the session cache, and wires the default session strategy (an opaque cookie over this Module's own session table). Call SetStrategy/Enable afterward to customize.
func (*Module) Add ¶
Add returns all admin-managed CRUDP handlers for registration. Usage: cp.RegisterHandlers(m.Add()...)
func (*Module) AssignLANIP ¶
func (*Module) AssignPermission ¶
func (*Module) AssignRole ¶
func (*Module) Authenticate ¶
func (m *Module) Authenticate() router.Middleware
Authenticate returns a router.Middleware that asks the active SessionStrategy to identify the caller. If valid, sets UserId in the context via ctx.SetUserID(id). If invalid, UserId remains empty (anonymous).
func (*Module) Bootstrap ¶
Bootstrap seeds the first user and their initial permissions. NO-OP if the users table is already populated. It does not invent roles or wildcards: it only persists what the Seed declares.
func (*Module) Can ¶
Can checks if the userID has permission for the resource/action, notifying on failure — unchanged from before.
func (*Module) ConsumeState ¶
func (*Module) CreatePermission ¶
func (*Module) CreateRole ¶
func (*Module) CreateSession ¶
func (*Module) CreateUser ¶
func (*Module) DeletePermission ¶
func (*Module) DeleteRole ¶
func (*Module) DeleteSession ¶
func (*Module) Enable ¶
func (m *Module) Enable(auths ...auth.Authenticator)
Enable registers the authentication modes this app supports — 1 or N. authority never constructs a mode itself: the consumer builds each one (injecting whichever ports of m it needs) and hands it here.
func (*Module) GetOrCreateSubject ¶
func (*Module) GetPermission ¶
func (m *Module) GetPermission(id string) (*auth.Permission, error)
func (*Module) GetRoleByCode ¶
func (*Module) GetUserIdentities ¶
func (*Module) HasPermission ¶
func (*Module) IdentityByProvider ¶
func (*Module) IdentityFor ¶
func (*Module) IsTrustedIP ¶
func (*Module) IssueSession ¶
func (*Module) Login ¶
Login verifies email+password directly (no HTTP) — used by email_password/credentials tests and any admin flow that needs to verify a user's password without going through the mounted route.
func (*Module) LoginLAN ¶
LoginLAN verifies a RUT + the caller's IP directly (no HTTP) — used by tests and any admin flow. Mirrors exactly what trusted_ip's Mount handler does, using the same ValidateRUT algorithm — see §7's doc comment on ValidateRUT.
func (*Module) MountAPI ¶
MountAPI mounts the one session-termination endpoint centrally — logout ends a session the same way no matter which mode started it (strategy.Revoke) — then lets every enabled Authenticator mount its own login route. authority never inspects what a mode mounts.
func (*Module) MountOps ¶
func (m *Module) MountOps(reg router.OpRegistry)
func (*Module) Notify ¶
func (m *Module) Notify(e auth.SecurityEvent)
func (*Module) PurgeExpiredOAuthStates ¶
PurgeExpiredOAuthStates is maintenance, not part of any port — call it periodically from a cron-like task in the consuming app.
func (*Module) PurgeExpiredSessions ¶
func (*Module) PurgeSessionsByUser ¶
PurgeSessionsByUser deletes all sessions belonging to userID from cache and DB.
func (*Module) ReactivateUser ¶
ReactivateUser sets Status = "active". Evicts user from cache.
func (*Module) Register ¶
func (m *Module) Register(handlers ...RBACObject) error
func (*Module) RegisterLAN ¶
RegisterLAN links a RUT to userID as their trusted_ip identity.
func (*Module) RevokeLANIP ¶
func (*Module) RevokeRole ¶
func (*Module) RotateSession ¶
RotateSession atomically deletes the old session and creates a new one with the same userID, updated IP/UserAgent, and a fresh TTL. Prevents session fixation attacks when called post-login.
func (*Module) SetLog ¶
SetLog configures optional logging. Call immediately after New(). Default: no-op.
func (*Module) SetPassword ¶
SetPassword hashes and stores password as userID's email_password credential.
func (*Module) SetStrategy ¶
func (m *Module) SetStrategy(s auth.SessionStrategy)
SetStrategy overrides how sessions are carried. Call before mounting. A nil argument is ignored — the default set by New is already production-ready; this exists to opt into session/jwt or a custom strategy, never to unset it.
func (*Module) SuspendUser ¶
SuspendUser sets Status = "suspended". Evicts user from cache.
func (*Module) UnlinkIdentity ¶
func (*Module) UnregisterLAN ¶
UnregisterLAN removes userID's trusted_ip identity and all their allowed IPs.
func (*Module) UpdateUserAvatar ¶
func (*Module) UpsertIdentity ¶
func (*Module) VerifyPassword ¶
VerifyPassword checks password against userID's stored email_password hash.
Source Files