internal/

Package boundedmap is a map with a capacity: once full, putting a new key evicts the least recently used one.

Package browserbind ties a browser-driven OAuth or SSO ceremony to the browser that started it.

Package doclint holds the repository's self-checks: tests that read the tree rather than the code, such as whether an environment file is tracked or whether the documentation names identifiers that exist.

Package dpoptest mints DPoP proofs for tests.

Package ipmask reduces a client address to its network so a record can keep where a request came from without keeping who.

Package jwkutil converts between JSON Web Keys and Go public keys, and computes RFC 7638 thumbprints.

Package mask shortens personal identifiers for log lines.

Package resourceuri holds the RFC 8707 section 2 syntax rule for a resource indicator, in one place both the OAuth2 provider and the core settings can reach.

Package safeurl decides whether an operator-supplied URL may be called from inside the service.

Package secutil provides shared test helpers for authsome security work.

Package sqliteguard holds a static check over the SQLite store code.

Package sqliteschema provides the SQLite table-rebuild procedure used by migrations that must change a column's declared type.

Package telemetry holds authsome's tracing and metric plumbing: the tracer every authsome span is started on, the helpers that mark a span failed without ever putting error text on it, the bounded values metric labels take, and the instruments recorded through a go-utils metrics sink.