Documentation
¶
Index ¶
- Constants
- func AppendFactor(sess *domain.Session, factor domain.AuthFactor)
- func ClassMembers(t domain.AuthCheckType) []domain.AuthCheckType
- func DecodeAuthChecks(checkType domain.AuthCheckType, id string, ...) ([]domain.AuthCheck, error)
- func ExchangeTTL(ttl time.Duration) time.Duration
- func HasRealSessionToken(previousTokenID string) bool
- func HashHandoffToken(plain string) []byte
- func NormalizeSessionFactor(check domain.AuthCheck) domain.AuthCheck
- func PickLastVerifiedByType(attemptChecks, sessionChecks []StoredCheck) map[domain.AuthCheckType]StoredCheck
- func RunExchange(ctx context.Context, store ExchangeStore, projectID, handoffToken string, ...) (*domain.Session, error)
- func UserAgentFromStoredInfo(info map[string]any) *domain.UserAgent
- func ValidateHandoffAttempt(attempt *domain.AuthAttempt) error
- type ExchangeStore
- type StoredCheck
Constants ¶
const UserAgentFingerprintKey = "fingerprint"
UserAgentFingerprintKey is the user_agents.info JSON key for the browser fingerprint (UserAgent.ID).
Variables ¶
This section is empty.
Functions ¶
func AppendFactor ¶
func AppendFactor(sess *domain.Session, factor domain.AuthFactor)
AppendFactor replaces an existing factor of the same class or appends a new one. Factors are normalized on the way in (NormalizeSessionFactor), so a promoted enrollment lands as a passkey factor and never coexists with a login factor for the same class.
func ClassMembers ¶
func ClassMembers(t domain.AuthCheckType) []domain.AuthCheckType
ClassMembers lists the check types competing in t's class (see domain.AuthCheckType.Class), for loser cleanup after a promotion.
func DecodeAuthChecks ¶
func DecodeAuthChecks( checkType domain.AuthCheckType, id string, lastChallengedAt, lastFailedAt, verifiedAt time.Time, failureCount uint16, challenge, factor json.RawMessage, ) ([]domain.AuthCheck, error)
DecodeAuthChecks builds domain auth checks from a stored checks row.
func ExchangeTTL ¶
ExchangeTTL returns ttl when positive, otherwise SessionAnonymousTTL.
func HasRealSessionToken ¶
HasRealSessionToken reports whether previousTokenID names a persisted token that should be revoked after rotation. Empty means the session has no token yet (sessions.token_id is NULL until CreateSessionToken links one).
func HashHandoffToken ¶
HashHandoffToken returns the SHA-256 digest stored on auth_attempts.handoff_token.
func NormalizeSessionFactor ¶
NormalizeSessionFactor maps a promoted enrollment factor to the passkey class. Sessions record HOW the user authenticated; the ceremony-level distinction between registering and asserting a credential stays on the attempt.
func PickLastVerifiedByType ¶
func PickLastVerifiedByType(attemptChecks, sessionChecks []StoredCheck) map[domain.AuthCheckType]StoredCheck
PickLastVerifiedByType merges attempt and session verified checks, keeping the newest LastVerifiedAt per factor class (attempt wins ties that are strictly after).
func RunExchange ¶
func RunExchange(ctx context.Context, store ExchangeStore, projectID, handoffToken string, ttl time.Duration) (*domain.Session, error)
RunExchange performs handoff-token exchange: validate attempt, resolve or create the target session, promote verified checks, rotate the session token, and delete the attempt. Dialects supply SQL via ExchangeStore.
func UserAgentFromStoredInfo ¶
UserAgentFromStoredInfo reconstructs a UserAgent from the user_agents.info map.
func ValidateHandoffAttempt ¶
func ValidateHandoffAttempt(attempt *domain.AuthAttempt) error
ValidateHandoffAttempt rejects missing, expired, or incomplete handoff state.
Types ¶
type ExchangeStore ¶
type ExchangeStore interface {
GetAuthAttemptByHandoffToken(ctx context.Context, projectID string, handoffTokenHash []byte) (*domain.AuthAttempt, error)
GetSessionByID(ctx context.Context, projectID, sessionID string) (*domain.Session, error)
InsertSession(ctx context.Context, session *domain.Session) error
LoadVerifiedChecks(ctx context.Context, projectID, id string, onAttempt bool) ([]StoredCheck, error)
ApplyExchange(ctx context.Context, projectID, sessionID string, last map[domain.AuthCheckType]StoredCheck) error
UserIDFromLastVerifiedChecks(ctx context.Context, projectID string, last map[domain.AuthCheckType]StoredCheck) (*string, error)
UpdateSessionAfterExchange(ctx context.Context, projectID, sessionID string, userID *string, ttl time.Duration) error
DeleteAuthAttempt(ctx context.Context, projectID, attemptID string) error
CreateSessionToken(ctx context.Context, session *domain.Session, previousTokenID string) error
}
ExchangeStore is the dialect IO surface used by RunExchange.
type StoredCheck ¶
type StoredCheck struct {
ID string
Type domain.AuthCheckType
LastVerifiedAt time.Time
OnAttempt bool
}
StoredCheck is a verified check row used while merging attempt and session factors during Exchange.
Source Files