Documentation
¶
Overview ¶
Package ceremony provides a store interface for short-lived ceremony sessions used by authentication plugins (passkey, social, SSO, MFA).
Ceremony data is ephemeral (seconds to minutes) and keyed by a unique identifier with automatic expiration. This abstraction replaces in-memory sync.Map/map usage in plugins, enabling multi-instance deployments via database-backed implementations.
Index ¶
- Constants
- Variables
- type KVStore
- func (s *KVStore) Delete(ctx context.Context, key string) error
- func (s *KVStore) Get(ctx context.Context, key string) ([]byte, error)
- func (s *KVStore) Increment(ctx context.Context, key string, ttl time.Duration) (int64, error)
- func (s *KVStore) Set(ctx context.Context, key string, data []byte, ttl time.Duration) error
- func (s *KVStore) SetNX(ctx context.Context, key string, data []byte, ttl time.Duration) (bool, error)
- type MemoryStore
- func (s *MemoryStore) Delete(_ context.Context, key string) error
- func (s *MemoryStore) Get(_ context.Context, key string) ([]byte, error)
- func (s *MemoryStore) Increment(_ context.Context, key string, ttl time.Duration) (int64, error)
- func (s *MemoryStore) Len() int
- func (s *MemoryStore) Set(_ context.Context, key string, data []byte, ttl time.Duration) error
- func (s *MemoryStore) SetNX(_ context.Context, key string, data []byte, ttl time.Duration) (bool, error)
- type Store
Constants ¶
const DefaultMaxEntries = 100_000
DefaultMaxEntries bounds the memory store. Ceremony state is short-lived, so the bound is only reached under a flood; when it is, expired entries go first and then arbitrary ones, which costs a caller a retry rather than costing the process its memory.
Variables ¶
var ErrNotFound = errors.New("ceremony: key not found or expired")
ErrNotFound is returned when the requested ceremony key does not exist or has expired.
Functions ¶
This section is empty.
Types ¶
type KVStore ¶
type KVStore struct {
// contains filtered or unexported fields
}
KVStore keeps ceremony state in the shared KV store so a ceremony begun on one replica can finish on another, and a replay marker claimed on one replica is seen by all.
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore is an in-memory ceremony store with TTL-based expiration. It is safe for concurrent use and suitable for single-instance deployments or testing.
func NewMemoryWithLimit ¶
func NewMemoryWithLimit(maxEntries int) *MemoryStore
NewMemoryWithLimit creates a memory store bounded to maxEntries.
func (*MemoryStore) Delete ¶
func (s *MemoryStore) Delete(_ context.Context, key string) error
Delete removes data by key (idempotent).
func (*MemoryStore) Len ¶
func (s *MemoryStore) Len() int
Len reports how many entries the store holds, expired ones included.
type Store ¶
type Store interface {
// Set stores data under key with a TTL. Overwrites if the key exists.
Set(ctx context.Context, key string, data []byte, ttl time.Duration) error
// Get retrieves data by key. Returns ErrNotFound if the key is absent
// or has expired.
Get(ctx context.Context, key string) ([]byte, error)
// Delete removes data by key. It is idempotent — deleting a
// non-existent key returns nil.
Delete(ctx context.Context, key string) error
// SetNX stores data under key only when the key is absent or expired
// and reports whether it did. A replay marker set this way is claimed
// by exactly one caller, whichever replica it runs on.
SetNX(ctx context.Context, key string, data []byte, ttl time.Duration) (bool, error)
// Increment adds one to the counter under key and returns the new
// count. An absent or expired key starts at one with ttl; an existing
// key keeps its expiry, so a window of attempts cannot be extended by
// making more of them.
Increment(ctx context.Context, key string, ttl time.Duration) (int64, error)
}
Store persists short-lived ceremony/state data with automatic expiration.