Documentation
¶
Index ¶
- Constants
- Variables
- func CheckPassword(hash, password string) bool
- func Decrypt(encoded, key string) (string, error)
- func DeriveSubkey(master, purpose string) []byte
- func Encrypt(plaintext, key string) (string, error)
- func GenerateAPIKey(secret string) (plaintext string, hash string, err error)
- func GenerateRandomSecret(n int) (string, error)
- func HashAPIKey(key, secret string) string
- func HashPassword(password string) (string, error)
- func RealIP(r *http.Request, trustedProxies []string) string
- func RequestIsHTTPS(r *http.Request, trustedProxies []string) bool
- type Claims
- type JWTManager
- type LoginLockout
- type RateLimiter
Constants ¶
const ( JWTIssuer = "simpledeploy" JWTAudience = "simpledeploy-dashboard" )
JWTIssuer/Audience bind tokens to this product, defending against secret reuse across services should the same master_secret ever be shared (e.g. operator copies prod config to staging).
Variables ¶
var BcryptCost = 12
BcryptCost is the work factor used by HashPassword. It is a var so tests may lower it; production code must not change it.
Functions ¶
func CheckPassword ¶
func Decrypt ¶
Decrypt decrypts base64-encoded salt+nonce+ciphertext with AES-256-GCM. Tries iterations in modern -> legacy order, then falls back to the fixed-salt legacy format for backwards compatibility.
func DeriveSubkey ¶
DeriveSubkey returns an HKDF-SHA256 derived 32-byte subkey from master using the given purpose label as info. Salt is empty (acceptable for cryptographically-strong master secrets).
Use this whenever a new cryptographic purpose is introduced so that rotating or compromising one subkey does not affect another. Today it is used for JWT signing; existing AES-GCM credential KEK and API key HMAC continue to use master_secret directly to preserve compatibility with stored ciphertexts and key hashes.
func Encrypt ¶
Encrypt encrypts plaintext with AES-256-GCM using a random salt + PBKDF2 key. Returns base64-encoded salt+nonce+ciphertext.
func GenerateAPIKey ¶
GenerateAPIKey generates a 32-byte random key, hex-encoded with "sd_" prefix. Returns plaintext (shown once) and its HMAC-SHA256 hash (stored).
func GenerateRandomSecret ¶
GenerateRandomSecret generates a cryptographically random hex string of n bytes.
func HashAPIKey ¶
HashAPIKey returns the HMAC-SHA256 hex digest of key using secret.
func HashPassword ¶
func RealIP ¶
RealIP extracts the client IP from a request, checking X-Forwarded-For when the direct connection comes from a trusted proxy.
func RequestIsHTTPS ¶ added in v1.4.3
RequestIsHTTPS reports whether the client reached us over HTTPS: either TLS terminated here, or the direct peer is a trusted proxy that set X-Forwarded-Proto: https. Untrusted peers cannot spoof the header.
Types ¶
type JWTManager ¶
type JWTManager struct {
// contains filtered or unexported fields
}
func NewJWTManager ¶
func NewJWTManager(secret string, expiry time.Duration) *JWTManager
NewJWTManager derives a per-purpose subkey from the operator-provided master secret via HKDF. Compromise or rotation of the JWT key now does not require re-encrypting registry credentials or invalidating API keys.
type LoginLockout ¶
type LoginLockout struct {
// contains filtered or unexported fields
}
LoginLockout tracks failed login attempts and enforces progressive lockout. After threshold failures, locks out with progressive duration: 1m, 2m, 4m, 8m, 16m, 30m (cap). Tracks per key (caller passes both username and IP as separate keys).
func NewLoginLockout ¶
func NewLoginLockout(threshold int) *LoginLockout
func (*LoginLockout) Cleanup ¶
func (l *LoginLockout) Cleanup()
Cleanup removes entries where lockout has expired and failures are below threshold.
func (*LoginLockout) IsLocked ¶
func (l *LoginLockout) IsLocked(key string) bool
IsLocked returns true if the key is currently locked out.
func (*LoginLockout) RecordFailure ¶
func (l *LoginLockout) RecordFailure(key string)
RecordFailure increments the failure count and sets lockout duration if threshold reached.
func (*LoginLockout) RecordSuccess ¶
func (l *LoginLockout) RecordSuccess(key string)
RecordSuccess resets the entry for the given key.
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
func NewRateLimiter ¶
func NewRateLimiter(limit int, window time.Duration) *RateLimiter
func (*RateLimiter) Allow ¶
func (rl *RateLimiter) Allow(key string) bool
Allow returns true if the request is allowed, false if rate limited. Each key gets limit tokens per window; refills when window expires.
Source Files