Versions in this module Expand all Collapse all v2 v2.0.0 Jul 19, 2026 Changes in this version + const Audit2FADisable + const Audit2FAEnroll + const Audit2FARecoveryRegen + const Audit2FAVerify + const AuditImpersonate + const AuditLogin + const AuditLogout + const AuditPasswordChange + const AuditPasswordReset + const AuditPasswordResetRequest + const AuditPermissionChange + const AuditRefresh + const AuditRevoke + const AuditRoleChange + const ErrCodeCSRF + const ErrCodeConflict + const ErrCodeForbidden + const ErrCodeInvalidChallenge + const ErrCodeInvalidCode + const ErrCodeInvalidCredential + const ErrCodeInvalidGrant + const ErrCodeInvalidRequest + const ErrCodeNotEnabled + const ErrCodePasswordPolicy + const ErrCodeRateLimited + const ErrCodeServerError + const ErrCodeUnauthenticated + const ErrCodeUnsupportedGrant + const PermAll + const ResetKindPlatform + const ResetKindUser + var ErrDeviceTokenInvalid = errors.New("authkit: invalid device token") + var ErrImpersonationDisabled = errors.New("authkit: impersonation is disabled") + var ErrImpersonationForbidden = errors.New("authkit: platform:impersonate capability required") + var ErrUserExists = errors.New("authkit: user already exists") + var ErrUserNotFound = errors.New("authkit: user not found") + func CheckPassword(hashedPassword, password string) bool + func HashPassword(password string) (string, error) + func TenantIDFromCtx(ctx context.Context) (id string, ok bool) + func WithDevice(ctx context.Context, d *Device) context.Context + func WithLogger(l *slog.Logger) func(*LayeredPolicyProvider) + func WithTenant(ctx context.Context, tenantID string) context.Context + type APIKeyValidator interface + ValidateKey func(ctx context.Context, rawKey string) (*User, error) + type AuditEvent struct + Actor string + At time.Time + IP string + Meta map[string]any + Subject string + TenantID string + Type string + type AuditSink interface + Emit func(ctx context.Context, ev AuditEvent) + type Auth struct + func New(cfg Config) (*Auth, error) + func (a *Auth) AuthenticateDevice(ctx context.Context, rawToken string) (*Device, error) + func (a *Auth) Authorize(w http.ResponseWriter, r *http.Request) + func (a *Auth) BeginAuth(w http.ResponseWriter, r *http.Request) + func (a *Auth) CSRF(next http.Handler) http.Handler + func (a *Auth) CSRFToken(w http.ResponseWriter, r *http.Request) + func (a *Auth) Callback(w http.ResponseWriter, r *http.Request) + func (a *Auth) ChangeFirstPassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) ChangePassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) ConfirmTwoFactor(w http.ResponseWriter, r *http.Request) + func (a *Auth) DisableTwoFactor(w http.ResponseWriter, r *http.Request) + func (a *Auth) Enroll2FA(w http.ResponseWriter, r *http.Request) + func (a *Auth) EstablishPlatformSession(ctx context.Context, w http.ResponseWriter, r *http.Request, ...) error + func (a *Auth) EstablishSession(ctx context.Context, w http.ResponseWriter, r *http.Request, u *User) error + func (a *Auth) ForgotPassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) ImpersonationContext(ctx context.Context, admin *PlatformAdmin, tenantID string) (context.Context, error) + func (a *Auth) IsDeviceCapability(perm string) bool + func (a *Auth) IssuePasswordToken(w http.ResponseWriter, r *http.Request) + func (a *Auth) IssuePasswordToken2FA(w http.ResponseWriter, r *http.Request) + func (a *Auth) IssueResetToken(ctx context.Context, email, name, kind string) (string, error) + func (a *Auth) IssueToken(w http.ResponseWriter, r *http.Request) + func (a *Auth) JWKS(w http.ResponseWriter, r *http.Request) + func (a *Auth) Login(w http.ResponseWriter, r *http.Request) + func (a *Auth) Logout(w http.ResponseWriter, r *http.Request) + func (a *Auth) LogoutEverywhere(w http.ResponseWriter, r *http.Request) + func (a *Auth) Me(w http.ResponseWriter, r *http.Request) + func (a *Auth) MintAccessToken(u *User, ttl time.Duration) (string, error) + func (a *Auth) PlatformEnroll2FA(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformForgotPassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformLogin(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformLogout(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformMe(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformResetPassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) PlatformVerify2FA(w http.ResponseWriter, r *http.Request) + func (a *Auth) RefreshAccessToken(w http.ResponseWriter, r *http.Request) + func (a *Auth) RegenerateRecoveryCodes(w http.ResponseWriter, r *http.Request) + func (a *Auth) Register(w http.ResponseWriter, r *http.Request) + func (a *Auth) Require(permission string) func(http.Handler) http.Handler + func (a *Auth) RequireAuth(next http.Handler) http.Handler + func (a *Auth) RequireDevice(perm string) func(http.Handler) http.Handler + func (a *Auth) RequirePlatformAdmin(perm string) func(http.Handler) http.Handler + func (a *Auth) RequireSession(permission string) func(http.Handler) http.Handler + func (a *Auth) RequireSessionAuth(next http.Handler) http.Handler + func (a *Auth) ResetPassword(w http.ResponseWriter, r *http.Request) + func (a *Auth) RevokeUserSessions(ctx context.Context, tenantID, email string) error + func (a *Auth) TwoFactorStatus(w http.ResponseWriter, r *http.Request) + func (a *Auth) Verify2FA(w http.ResponseWriter, r *http.Request) + func (a *Auth) WatchRBAC(ctx context.Context, interval time.Duration) + type AuthCodeStore interface + ClaimAuthCode func(ctx context.Context, jti string, expiresAt time.Time) (ok bool, err error) + type AuthMode string + const AuthModeBoth + const AuthModeOAuth + const AuthModePassword + type BcryptHasher struct + Cost int + func (h BcryptHasher) Hash(password string) (string, error) + func (h BcryptHasher) Verify(hashedPassword, password string) bool + type CSRFConfig struct + Enable bool + TrustedOrigins []string + type Config struct + APIKeyValidator APIKeyValidator + AfterLoginURL string + AfterLogoutURL string + AppName string + AuditSink AuditSink + CSRF CSRFConfig + ClientIP func(*http.Request) string + CookiePrefix string + Devices DeviceConfig + ErrorWriter ErrorWriter + LivePermissionResolution bool + Logger *slog.Logger + Mode AuthMode + OAuth OAuthConfig + PasswordHasher PasswordHasher + PasswordPolicy *PasswordPolicy + PermissionCacheTTL time.Duration + Platform PlatformConfig + RBAC RBACConfig + Reset ResetConfig + SecureCookie bool + SessionSecret string + Sessions SessionConfig + Throttler LoginThrottler + Tokens TokenConfig + TwoFactor TwoFactorConfig + UserStore UserStore + type Device struct + AgentID string + Attrs map[string]string + Name string + TenantID string + func DeviceFromCtx(ctx context.Context) *Device + func (d *Device) Attr(key string) string + func (d *Device) Can(perm string) bool + type DeviceConfig struct + Capabilities []string + Validator DeviceTokenValidator + type DeviceRecord struct + AgentID string + Attrs map[string]string + Name string + TenantID string + type DeviceTokenValidator interface + ValidateDeviceToken func(ctx context.Context, rawToken string) (*DeviceRecord, error) + type ErrorWriter func(w http.ResponseWriter, r *http.Request, status int, code, desc string) + type LayeredPolicyProvider struct + func NewLayeredProvider(filePath string, store UserRoleStore, opts ...func(*LayeredPolicyProvider)) (*LayeredPolicyProvider, error) + func (l *LayeredPolicyProvider) DeleteOverride(ctx context.Context, email string) error + func (l *LayeredPolicyProvider) PermissionsForRole(_ context.Context, role string) []string + func (l *LayeredPolicyProvider) Reload() error + func (l *LayeredPolicyProvider) RoleFor(ctx context.Context, email string) (string, []string) + func (l *LayeredPolicyProvider) SetOverride(ctx context.Context, email, role string, permissions []string) error + func (l *LayeredPolicyProvider) Store() UserRoleStore + type LoginThrottler interface + Allow func(ctx context.Context, key string) (retryAfter time.Duration, ok bool) + RecordFailure func(ctx context.Context, key string) error + Reset func(ctx context.Context, key string) error + type NopAuditSink struct + func (NopAuditSink) Emit(context.Context, AuditEvent) + type OAuthConfig struct + CallbackBaseURL string + GothProviders []goth.Provider + Providers []ProviderConfig + type PasswordHasher interface + Hash func(password string) (string, error) + Verify func(hashedPassword, password string) bool + type PasswordPolicy struct + MaxLength int + MinLength int + type PasswordResetStore interface + ConsumeResetToken func(ctx context.Context, tokenHash, kind string) (email string, ok bool, err error) + CreateResetToken func(ctx context.Context, tokenHash, email, kind string, expiresAt time.Time) error + type PasswordUser struct + Attrs map[string]string + Email string + HashedPassword string + MustChangePassword bool + Name string + TenantID string + type PlatformAdmin struct + Email string + Name string + Role string + func PlatformAdminFromCtx(ctx context.Context) *PlatformAdmin + func (p *PlatformAdmin) Can(perm string) bool + type PlatformAdminRecord struct + Email string + HashedPassword string + Name string + Role string + TOTPConfirmed bool + TOTPSecret string + type PlatformAdminStore interface + ConfirmPlatformTOTP func(ctx context.Context, email string) error + ConsumePlatformRecovery func(ctx context.Context, email, codeHash string) (bool, error) + EnrollPlatformTOTP func(ctx context.Context, email, secret string, recoveryCodeHashes []string) error + GetPlatformAdmin func(ctx context.Context, email string) (*PlatformAdminRecord, error) + UpdatePassword func(ctx context.Context, email, hashedPassword string) error + type PlatformConfig struct + EnableImpersonation bool + Policy PlatformPolicy + Store PlatformAdminStore + type PlatformPolicy interface + PermissionsForPlatformRole func(role string) []string + type PlatformTOTPReplayGuard interface + ClaimPlatformTOTPTimestep func(ctx context.Context, email string, timestep int64) (ok bool, err error) + type Policy struct + DefaultRole string + Roles map[string]RolePolicy + type PolicyProvider interface + PermissionsForRole func(ctx context.Context, role string) []string + RoleFor func(ctx context.Context, email string) (role string, permissions []string) + type PolicyReloader interface + Reload func() error + type ProviderConfig struct + ClientID string + ClientSecret string + Name string + Scopes []string + type RBACConfig struct + FilePath string + Provider PolicyProvider + type RefreshToken struct + ChainID string + ExpiresAt time.Time + ID string + IssuedAt time.Time + ParentID string + RevokedAt *time.Time + TenantID string + UsedAt *time.Time + UserEmail string + type RefreshTokenStore interface + Create func(ctx context.Context, t *RefreshToken) error + Get func(ctx context.Context, rawToken string) (*RefreshToken, error) + RevokeAllForUser func(ctx context.Context, tenantID, email string) error + RevokeChain func(ctx context.Context, chainID string) error + Rotate func(ctx context.Context, rawOld string, next *RefreshToken) error + type ResetConfig struct + Delivery ResetDelivery + Store PasswordResetStore + TTL time.Duration + type ResetDelivery interface + SendPasswordReset func(ctx context.Context, req ResetRequest) error + type ResetRequest struct + Email string + Kind string + Name string + TTL time.Duration + Token string + type ResetToken struct + Email string + ExpiresAt time.Time + Kind string + TokenHash string + UsedAt *time.Time + type RolePolicy struct + Members []string + Permissions []string + type Session struct + Attrs map[string]string + CreatedAt time.Time + Email string + ID string + LastSeenAt time.Time + Name string + Permissions []string + Platform bool + Provider string + Role string + TenantID string + type SessionConfig struct + AbsoluteTimeout time.Duration + IdleTimeout time.Duration + Store SessionStore + type SessionStore interface + Create func(ctx context.Context, s *Session) error + Get func(ctx context.Context, id string) (*Session, error) + Revoke func(ctx context.Context, id string) error + RevokeAllForUser func(ctx context.Context, tenantID, email string) error + Touch func(ctx context.Context, id string, lastSeen time.Time) error + type SigningKey struct + KID string + Private ed25519.PrivateKey + func NewSigningKey(kid string, seed []byte) (SigningKey, error) + type TOTPManager interface + Disable func(ctx context.Context, tenantID, email string) error + ReplaceRecoveryCodes func(ctx context.Context, tenantID, email string, recoveryCodeHashes []string) error + type TOTPReplayGuard interface + ClaimTOTPTimestep func(ctx context.Context, tenantID, email string, timestep int64) (ok bool, err error) + type TOTPStore interface + Confirm func(ctx context.Context, tenantID, email string) error + ConsumeRecovery func(ctx context.Context, tenantID, email, codeHash string) (bool, error) + Enroll func(ctx context.Context, tenantID, email, secret string, ...) error + Secret func(ctx context.Context, tenantID, email string) (secret string, confirmed bool, err error) + type TokenConfig struct + AccessTTL time.Duration + AuthCodes AuthCodeStore + ClientID string + Enable bool + Issuer string + RedirectURIs []string + RefreshStore RefreshTokenStore + RefreshTTL time.Duration + SigningKeys []SigningKey + type TrustedDeviceStore interface + IsTrusted func(ctx context.Context, tenantID, email, token string) (bool, error) + RevokeAllForUser func(ctx context.Context, tenantID, email string) error + Trust func(ctx context.Context, tenantID, email string, ttl time.Duration) (token string, err error) + type TwoFactorConfig struct + RequireForRoles []string + Store TOTPStore + TrustedDeviceTTL time.Duration + TrustedDevices TrustedDeviceStore + type User struct + Attrs map[string]string + AvatarURL string + Email string + Name string + Provider string + Role string + TenantID string + func UserFromCtx(ctx context.Context) *User + func (u *User) Attr(key string) string + func (u *User) Can(permission string) bool + func (u *User) Permissions() []string + func (u *User) SetPermissions(perms []string) + type UserRoleStore interface + DeleteOverride func(ctx context.Context, email string) error + GetOverride func(ctx context.Context, email string) (role string, permissions []string, found bool, err error) + SetOverride func(ctx context.Context, email, role string, permissions []string) error + type UserStore interface + CreateUser func(ctx context.Context, email, name, hashedPassword string) error + GetUserByEmail func(ctx context.Context, email string) (*PasswordUser, error) + UpdatePassword func(ctx context.Context, email, hashedPassword string) error Other modules containing this package github.com/tlmanz/authkit
Go to main page