postgres

package

v0.5.3 Latest Latest Go to latest Published: Nov 3, 2026 License: MIT Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/weiloon1234/Foundry-Go

Links

Open Source Insights

Documentation ¶

Overview ¶

Package postgres stores encrypted MFA factors through explicit migrations and generated model queries. It borrows an existing pool; constructors do no I/O.

Index ¶

Constants
func Migrations() []migrate.Definition
type Backend
- func New(db *database.DB, config Config) (*Backend, error)
type Config
- func DefaultConfig() Config
- func (c Config) Validate() error

Constants ¶

View Source

const (
	MigrationOrigin migrate.Origin  = "foundry.mfa"
	CreateFactors   migrate.ID      = "000001_create_factors"
	Introduced      migrate.Version = "v0.1.0"
)

Variables ¶

This section is empty.

Functions ¶

func Migrations ¶

func Migrations() []migrate.Definition

Migrations must be applied explicitly alongside the application's migrations. No constructor mutates schemas. Each row stores encrypted factor material and hashes only; no plaintext TOTP/recovery code is stored.

Types ¶

type Backend ¶

type Backend struct {
	// contains filtered or unexported fields
}

Backend persists MFA factors in PostgreSQL using a borrowed database pool.

func New ¶

func New(db *database.DB, config Config) (*Backend, error)

New validates configuration and creates an adapter borrowing db.

func (*Backend) Prune ¶

func (b *Backend) Prune(ctx context.Context, address mfa.Address, limit int) (uint64, error)

Prune removes at most limit expired pending factors, skipping locked rows and acquiring no model locks.

func (*Backend) ReplaceCiphertext ¶

func (b *Backend) ReplaceCiphertext(ctx context.Context, stored mfa.StoredCiphertext, next encryption.Ciphertext) (bool, error)

ReplaceCiphertext is one conditional UPDATE: it waits for a concurrent factor transaction holding the row and then rechecks generation and envelope, so a replaced, removed or already rotated factor is never overwritten.

func (*Backend) StaleCiphertexts ¶

func (b *Backend) StaleCiphertexts(ctx context.Context, active encryption.KeyID, after string, limit int) ([]mfa.StoredCiphertext, error)

StaleCiphertexts walks factors in primary-key order and returns those whose envelope does not carry the active key's prefix. It locks nothing.

func (*Backend) Within ¶

func (b *Backend) Within(ctx context.Context, address mfa.Address, identity model.Identity, prepare func(context.Context, *database.Tx) error, change func(context.Context, *database.Tx, value.Optional[mfa.Record], temporal.DateTime) (mfa.Change, error)) (value.Optional[mfa.Record], error)

Within locks the application model before the factor, validates and persists one change, and checks its deadline before committing.

func (*Backend) WithinIn ¶

func (b *Backend) WithinIn(ctx context.Context, tx *database.Tx, address mfa.Address, identity model.Identity, prepare func(context.Context, *database.Tx) error, change func(context.Context, *database.Tx, value.Optional[mfa.Record], temporal.DateTime) (mfa.Change, error)) (value.Optional[mfa.Record], error)

WithinIn applies a factor mutation using a savepoint in the caller-owned database transaction without committing it.

type Config ¶

type Config struct {
	Schema string
	Clock  clock.Clock
}

Config's schema applies to factor and domain-model callbacks. Instances must use synchronized clocks. All callbacks use this backend's supplied transaction.

func DefaultConfig ¶

func DefaultConfig() Config

DefaultConfig returns the public schema and system clock.

func (Config) Validate ¶

func (c Config) Validate() error

Validate requires a valid SQL schema and a non-nil clock.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL