Documentation
¶
Index ¶
- Variables
- type Module
- func (m *Module) Add() []any
- func (m *Module) AssignLANIP(userID, ip, label string) error
- func (m *Module) AssignPermission(roleID, permissionID string) error
- func (m *Module) AssignRole(userID, roleID string) error
- func (m *Module) Authenticate() router.Middleware
- func (m *Module) BeginOAuth(providerName string) (string, error)
- func (m *Module) Bootstrap(s Seed) error
- func (m *Module) Can(userID string, resource model.Resource, action model.Action) bool
- func (m *Module) CompleteOAuth(providerName string, ctx router.Context, ip, ua string) (user.User, bool, error)
- func (m *Module) Config() user.Config
- func (m *Module) CreatePermission(id, name string, resource model.Resource, action model.Action) error
- func (m *Module) CreateRole(id string, code model.RoleCode, name, description string) error
- func (m *Module) CreateSession(userID, ip, userAgent string) (user.Session, error)
- func (m *Module) DB() *orm.DB
- func (m *Module) DeletePermission(id string) error
- func (m *Module) DeleteRole(id string) error
- func (m *Module) DeleteSession(id string) error
- func (m *Module) ExtractClientIP(ctx router.Context) string
- func (m *Module) GenerateAPIToken(userID string, ttl int) (string, error)
- func (m *Module) GetLANIPs(userID string) ([]user.LANIP, error)
- func (m *Module) GetPermission(id string) (*user.Permission, error)
- func (m *Module) GetRole(id string) (*user.Role, error)
- func (m *Module) GetRoleByCode(code model.RoleCode) (*user.Role, error)
- func (m *Module) GetSession(id string) (user.Session, error)
- func (m *Module) GetUser(id string) (user.User, error)
- func (m *Module) GetUserByEmail(email string) (user.User, error)
- func (m *Module) GetUserIdentities(userID string) ([]user.Identity, error)
- func (m *Module) GetUserRoles(userID string) ([]user.Role, error)
- func (m *Module) HasPermission(userID string, resource model.Resource, action model.Action) (bool, error)
- func (m *Module) IDs() model.IDGenerator
- func (m *Module) IssueToken(userID string, ttl int) (string, error)
- func (m *Module) Login(email, password string) (user.User, error)
- func (m *Module) LoginLAN(rut string, ctx router.Context) (user.User, error)
- func (m *Module) ModelName() string
- func (m *Module) MountAPI(r router.Router)
- func (m *Module) MountOps(reg router.OpRegistry)
- func (m *Module) Notify(e user.SecurityEvent)
- func (m *Module) PurgeExpiredOAuthStates() error
- func (m *Module) PurgeExpiredSessions() error
- func (m *Module) PurgeSessionsByUser(userID string) error
- func (m *Module) ReactivateUser(id string) error
- func (m *Module) Register(handlers ...RBACObject) error
- func (m *Module) RegisterLAN(userID, rut string) error
- func (m *Module) RegisterProvider(p user.OAuthProvider)
- func (m *Module) RevokeLANIP(userID, ip string) error
- func (m *Module) RevokeRole(userID, roleID string) error
- func (m *Module) RotateSession(oldID, ip, userAgent string) (user.Session, error)
- func (m *Module) SetLog(fn func(...any))
- func (m *Module) SetPassword(userID, password string) error
- func (m *Module) SuspendUser(id string) error
- func (m *Module) UnlinkIdentity(userID, provider string) error
- func (m *Module) UnregisterLAN(userID string) error
- func (m *Module) VerifyPassword(userID, password string) error
- type RBACObject
- type Seed
Constants ¶
This section is empty.
Variables ¶
var ErrJWTSecretRequired = fmt.Err("JWTSecret", "is", "required")
ErrJWTSecretRequired is returned by any token operation attempted without a secret.
var PasswordHashCost = local.PasswordHashCost
PasswordHashCost delegates to local package
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the user/auth/rbac handle. All backend operations are methods on this type. Created exclusively via New().
func New ¶
New initializes the user/rbac schema, warms the cache, and returns a Module handle. This is the ONLY entry point for this package on the backend.
func (*Module) Add ¶
Add returns all admin-managed CRUDP handlers for registration. The concrete types are private — pass directly to crudp.RegisterHandlers.
Usage: cp.RegisterHandlers(m.Add()...)
func (*Module) AssignLANIP ¶
func (*Module) AssignPermission ¶
func (*Module) AssignRole ¶
func (*Module) Authenticate ¶
func (m *Module) Authenticate() router.Middleware
Authenticate returns a router.Middleware that validates the session (Cookie or Bearer). If valid, it sets the UserId in the context via ctx.SetUserID(id). If invalid, the UserId remains empty ("") indicating an anonymous user.
func (*Module) Bootstrap ¶
Bootstrap seeds the first user and their initial permissions. NO-OP if the users table is already populated. It does not invent roles or wildcards: it only persists what the Seed declares.
func (*Module) Can ¶
Can checks if the userID has permission for the resource/action. It also handles security event notification on failure.
func (*Module) CompleteOAuth ¶
func (*Module) CreatePermission ¶
func (*Module) CreateRole ¶
func (*Module) CreateSession ¶
func (*Module) DeletePermission ¶
func (*Module) DeleteRole ¶
func (*Module) DeleteSession ¶
func (*Module) ExtractClientIP ¶ added in v0.1.0
func (*Module) GenerateAPIToken ¶
GenerateAPIToken creates a signed JWT for API access (MCP clients, IDEs, LLMs). Requires Config.JWTSecret — independent of the configured AuthMode. ttl=0 → 50 years (effectively no expiry). Not 100: this module compiles for the edge, where int is 32-bit, and 100 years of seconds overflows int32. The returned token is used as a Bearer token in Authorization headers.
func (*Module) GetPermission ¶
func (m *Module) GetPermission(id string) (*user.Permission, error)
func (*Module) GetRoleByCode ¶
func (*Module) GetUserIdentities ¶
func (*Module) HasPermission ¶
func (*Module) IDs ¶ added in v0.1.0
func (m *Module) IDs() model.IDGenerator
func (*Module) IssueToken ¶ added in v0.1.0
func (*Module) ModelName ¶
ModelName is the module's identity (model.ModuleNaming), used as the RBAC resource and as the key by which a host registers it.
func (*Module) MountAPI ¶
MountAPI publishes the authentication flows on the host router. The module owns its routes; consumers just Mount it like any other APIModule.
func (*Module) MountOps ¶ added in v0.1.0
func (m *Module) MountOps(reg router.OpRegistry)
func (*Module) Notify ¶ added in v0.1.0
func (m *Module) Notify(e user.SecurityEvent)
func (*Module) PurgeExpiredOAuthStates ¶
func (*Module) PurgeExpiredSessions ¶
func (*Module) PurgeSessionsByUser ¶
PurgeSessionsByUser deletes all sessions belonging to userID from cache and DB.
func (*Module) ReactivateUser ¶
ReactivateUser sets Status = "active". Evicts user from cache.
func (*Module) Register ¶
func (m *Module) Register(handlers ...RBACObject) error
func (*Module) RegisterLAN ¶
func (*Module) RegisterProvider ¶ added in v0.1.0
func (m *Module) RegisterProvider(p user.OAuthProvider)
func (*Module) RevokeLANIP ¶
func (*Module) RevokeRole ¶
func (*Module) RotateSession ¶
RotateSession atomically deletes the old session and creates a new one with the same userID, updated IP/UserAgent, and a fresh TTL. Prevents session fixation attacks when called post-login.
func (*Module) SetLog ¶
SetLog configures optional logging. Call immediately after New(). Default: no-op. Follows the tinywasm ecosystem SetLog convention (same as rbac).
Example:
m.SetLog(func(msg ...any) { log.Println(msg...) })
func (*Module) SetPassword ¶
func (*Module) SuspendUser ¶
SuspendUser sets Status = "suspended". Evicts user from cache.
Source Files