Documentation
¶
Overview ¶
Package postgres stores encrypted MFA factors through explicit migrations and generated model queries. It borrows an existing pool; constructors do no I/O.
Index ¶
- Constants
- func Migrations() []migrate.Definition
- type Backend
- func (b *Backend) Prune(ctx context.Context, address mfa.Address, limit int) (uint64, error)
- func (b *Backend) ReplaceCiphertext(ctx context.Context, stored mfa.StoredCiphertext, next encryption.Ciphertext) (bool, error)
- func (b *Backend) StaleCiphertexts(ctx context.Context, active encryption.KeyID, after string, limit int) ([]mfa.StoredCiphertext, error)
- func (b *Backend) Within(ctx context.Context, address mfa.Address, identity model.Identity, ...) (value.Optional[mfa.Record], error)
- func (b *Backend) WithinIn(ctx context.Context, tx *database.Tx, address mfa.Address, ...) (value.Optional[mfa.Record], error)
- type Config
Constants ¶
Variables ¶
This section is empty.
Functions ¶
func Migrations ¶
func Migrations() []migrate.Definition
Migrations must be applied explicitly alongside the application's migrations. No constructor mutates schemas. Each row stores encrypted factor material and hashes only; no plaintext TOTP/recovery code is stored.
Types ¶
type Backend ¶
type Backend struct {
// contains filtered or unexported fields
}
func (*Backend) ReplaceCiphertext ¶
func (b *Backend) ReplaceCiphertext(ctx context.Context, stored mfa.StoredCiphertext, next encryption.Ciphertext) (bool, error)
ReplaceCiphertext is one conditional UPDATE: it waits for a concurrent factor transaction holding the row and then rechecks generation and envelope, so a replaced, removed or already rotated factor is never overwritten.
func (*Backend) StaleCiphertexts ¶
func (b *Backend) StaleCiphertexts(ctx context.Context, active encryption.KeyID, after string, limit int) ([]mfa.StoredCiphertext, error)
StaleCiphertexts walks factors in primary-key order and returns those whose envelope does not carry the active key's prefix. It locks nothing.
func (*Backend) WithinIn ¶
func (b *Backend) WithinIn(ctx context.Context, tx *database.Tx, address mfa.Address, identity model.Identity, prepare func(context.Context, *database.Tx) error, change func(context.Context, *database.Tx, value.Optional[mfa.Record], temporal.DateTime) (mfa.Change, error)) (value.Optional[mfa.Record], error)
type Config ¶
Config's schema applies to factor and domain-model callbacks. Instances must use synchronized clocks. All callbacks use this backend's supplied transaction.
func DefaultConfig ¶
func DefaultConfig() Config
Source Files