Documentation
¶
Index ¶
- Variables
- func GenerateJWT(secret []byte, userID string, ttl int) (string, error)
- func ValidateJWT(secret []byte, token string) (string, error)
- type Executor
- type GoogleProvider
- type MicrosoftProvider
- func (p *MicrosoftProvider) AuthCodeURL(state string) string
- func (p *MicrosoftProvider) ExchangeCode(ctx context.Context, code string) (*oauth2.Token, error)
- func (p *MicrosoftProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
- func (p *MicrosoftProvider) Name() string
- type Module
- func (m *Module) Add() []any
- func (m *Module) AssignLANIP(userID, ip, label string) error
- func (m *Module) AssignPermission(roleID, permissionID string) error
- func (m *Module) AssignRole(userID, roleID string) error
- func (m *Module) Authenticate() router.Middleware
- func (m *Module) BeginOAuth(providerName string) (string, error)
- func (m *Module) Can(userID, resource, action string) bool
- func (m *Module) CompleteOAuth(providerName string, ctx router.Context, ip, ua string) (user.User, bool, error)
- func (m *Module) CreatePermission(id, name, resource string, action string) error
- func (m *Module) CreateRole(id string, code string, name, description string) error
- func (m *Module) CreateSession(userID, ip, userAgent string) (user.Session, error)
- func (m *Module) DeletePermission(id string) error
- func (m *Module) DeleteRole(id string) error
- func (m *Module) DeleteSession(id string) error
- func (m *Module) GenerateAPIToken(userID string, ttl int) (string, error)
- func (m *Module) GetLANIPs(userID string) ([]user.LANIP, error)
- func (m *Module) GetPermission(id string) (*user.Permission, error)
- func (m *Module) GetRole(id string) (*user.Role, error)
- func (m *Module) GetRoleByCode(code string) (*user.Role, error)
- func (m *Module) GetSession(id string) (user.Session, error)
- func (m *Module) GetUser(id string) (user.User, error)
- func (m *Module) GetUserIdentities(userID string) ([]user.Identity, error)
- func (m *Module) GetUserRoles(userID string) ([]user.Role, error)
- func (m *Module) HasPermission(userID, resource string, action string) (bool, error)
- func (m *Module) Login(email, password string) (user.User, error)
- func (m *Module) LoginLAN(rut string, ctx router.Context) (user.User, error)
- func (m *Module) PurgeExpiredOAuthStates() error
- func (m *Module) PurgeExpiredSessions() error
- func (m *Module) PurgeSessionsByUser(userID string) error
- func (m *Module) ReactivateUser(id string) error
- func (m *Module) Register(handlers ...RBACObject) error
- func (m *Module) RegisterLAN(userID, rut string) error
- func (m *Module) RevokeLANIP(userID, ip string) error
- func (m *Module) RevokeRole(userID, roleID string) error
- func (m *Module) RotateSession(oldID, ip, userAgent string) (user.Session, error)
- func (m *Module) SetLog(fn func(...any))
- func (m *Module) SetPassword(userID, password string) error
- func (m *Module) SuspendUser(id string) error
- func (m *Module) Tools() []mcp.Tool
- func (m *Module) UIModules() []any
- func (m *Module) UnlinkIdentity(userID, provider string) error
- func (m *Module) UnregisterLAN(userID string) error
- func (m *Module) VerifyPassword(userID, password string) error
- type RBACObject
- type Rows
- type Scanner
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidToken = fmt.Err("token", "invalid")
var PasswordHashCost = bcrypt.DefaultCost
Functions ¶
Types ¶
type Executor ¶
type Executor interface {
Exec(query string, args ...any) error
Query(query string, args ...any) (Rows, error)
QueryRow(query string, args ...any) Scanner
Prepare(query string) (*sql.Stmt, error)
Begin() (*sql.Tx, error)
}
Executor interface abstracts database operations.
type GoogleProvider ¶
type GoogleProvider struct {
ClientID string
ClientSecret string
RedirectURL string
// contains filtered or unexported fields
}
func (*GoogleProvider) AuthCodeURL ¶
func (p *GoogleProvider) AuthCodeURL(state string) string
func (*GoogleProvider) ExchangeCode ¶
func (*GoogleProvider) GetUserInfo ¶
func (p *GoogleProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
func (*GoogleProvider) Name ¶
func (p *GoogleProvider) Name() string
type MicrosoftProvider ¶
type MicrosoftProvider struct {
ClientID string
ClientSecret string
RedirectURL string
// contains filtered or unexported fields
}
func (*MicrosoftProvider) AuthCodeURL ¶
func (p *MicrosoftProvider) AuthCodeURL(state string) string
func (*MicrosoftProvider) ExchangeCode ¶
func (*MicrosoftProvider) GetUserInfo ¶
func (p *MicrosoftProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
func (*MicrosoftProvider) Name ¶
func (p *MicrosoftProvider) Name() string
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the user/auth/rbac handle. All backend operations are methods on this type. Created exclusively via New().
func New ¶
New initializes the user/rbac schema, warms the cache, and returns a Module handle. This is the ONLY entry point for this package on the backend.
func (*Module) Add ¶
Add returns all admin-managed CRUDP handlers for registration. The concrete types are private — pass directly to crudp.RegisterHandlers.
Usage: cp.RegisterHandlers(m.Add()...)
func (*Module) AssignLANIP ¶
func (*Module) AssignPermission ¶
func (*Module) AssignRole ¶
func (*Module) Authenticate ¶
func (m *Module) Authenticate() router.Middleware
Authenticate returns a router.Middleware that validates the session (Cookie or Bearer). If valid, it sets the UserID in the context via ctx.SetUserID(id). If invalid, the UserID remains empty ("") indicating an anonymous user.
func (*Module) Can ¶
Can checks if the userID has permission for the resource/action. It also handles security event notification on failure.
func (*Module) CompleteOAuth ¶
func (*Module) CreatePermission ¶
func (*Module) CreateRole ¶
func (*Module) CreateSession ¶
func (*Module) DeletePermission ¶
func (*Module) DeleteRole ¶
func (*Module) DeleteSession ¶
func (*Module) GenerateAPIToken ¶
GenerateAPIToken creates a signed JWT for API access (MCP clients, IDEs, LLMs). Requires Config.JWTSecret — independent of the configured AuthMode. ttl=0 → 100 years (effectively no expiry). The returned token is used as a Bearer token in Authorization headers.
func (*Module) GetPermission ¶
func (m *Module) GetPermission(id string) (*user.Permission, error)
func (*Module) GetUserIdentities ¶
func (*Module) HasPermission ¶
func (*Module) PurgeExpiredOAuthStates ¶
func (*Module) PurgeExpiredSessions ¶
func (*Module) PurgeSessionsByUser ¶
PurgeSessionsByUser deletes all sessions belonging to userID from cache and DB.
func (*Module) ReactivateUser ¶
ReactivateUser sets Status = "active". Evicts user from cache.
func (*Module) Register ¶
func (m *Module) Register(handlers ...RBACObject) error
func (*Module) RegisterLAN ¶
func (*Module) RevokeLANIP ¶
func (*Module) RevokeRole ¶
func (*Module) RotateSession ¶
RotateSession atomically deletes the old session and creates a new one with the same userID, updated IP/UserAgent, and a fresh TTL. Prevents session fixation attacks when called post-login.
func (*Module) SetLog ¶
SetLog configures optional logging. Call immediately after New(). Default: no-op. Follows the tinywasm ecosystem SetLog convention (same as rbac).
Example:
m.SetLog(func(msg ...any) { log.Println(msg...) })
func (*Module) SetPassword ¶
func (*Module) SuspendUser ¶
SuspendUser sets Status = "suspended". Evicts user from cache.
func (*Module) UIModules ¶
UIModules returns all standard authentication UI flow handlers bound to this module. Note: This returns the backend-side modules with SSR capability.
Source Files