authn

Documentation

Index

• Constants
• Variables
• func APIKeyHash(key string) string
• func ErrorResponse(w http.ResponseWriter, err error)
• func NewAuthn(cfg config.Auth, m metrics.Metrics, ust users.Store) (*authn, error)
• func UsernameFrom(ctx context.Context) *string
• type Authn
• type CreateAPIKeyRequest
• type PasswordValidationErr
  • func (p PasswordValidationErr) Unwrap() error
• type Token
  • func VerifyRequest(ja *jwtauth.JWTAuth, r *http.Request) (Token, error)

Constants

const (
	RefreshRealm = "me.dynatron.stillbox.refresh"
	AccessRealm  = "me.dynatron.stillbox.access"
	APIKeyRealm  = "me.dynatron.stillbox.apiKey"
)

const (
	CookieName             = "stillboxJwt"
	MinimumPasswordEntropy = 50.0
)

const TokenFromHeaderKey tokenFromHeaderKey = "tokenFromHeader"

Variables

var (
	ErrLoginFailed  = errors.New("Login failed")
	ErrInternal     = errors.New("Internal server error")
	ErrUnauthorized = errors.New("Unauthorized")
	ErrBadRequest   = errors.New("Bad request")
)

var (
	ErrBadRealm = errors.New("bad realm")
)

var (
	ErrInvalidScopes = errors.New("invalid scope(s)")
)

var ErrPasswordValidation = errors.New("password validation error")

Functions

func APIKeyHash

func APIKeyHash(key string) string

func ErrorResponse

func ErrorResponse(w http.ResponseWriter, err error)

ErrorResponse writes the error and appropriate HTTP response code.

func NewAuthn

func NewAuthn(cfg config.Auth, m metrics.Metrics, ust users.Store) (*authn, error)

func UsernameFrom

func UsernameFrom(ctx context.Context) *string

UsernameFrom gets the username (just the subject from token) from ctx.

Types

type Authn

type Authn interface {
	HUP(*config.Config)

	// VerifyMiddleware will verify any JWT provided with the request.
	VerifyMiddleware() func(http.Handler) http.Handler

	// AuthorizedSubjectMiddleware requires a JWT be set.
	AuthorizedSubjectMiddleware() func(http.Handler) http.Handler

	// PublicSubjectMiddleware allows a Public subject to be set.
	PublicSubjectMiddleware() func(http.Handler) http.Handler

	// NewAccessToken generates a new access token.
	NewAccessToken(username string) string

	// MultipartAPIKeyMiddleware requires a multipart/form-data API key be set.
	MultipartAPIKeyMiddleware(formKey string) func(http.Handler) http.Handler

	// NewAPIKeyToken generates a JWT for use as an API key with the provided expiry and scopes.
	NewAPIKeyToken(username string, expires *time.Time, keyID uuid.UUID, scopes []string) (string, error)

	// LocalAdminMiddleware is used for local Unix domain socket connections..
	LocalAdminMiddleware() func(http.Handler) http.Handler

	// PrivateRoutes installs auth-specific private routes to the Router.
	PrivateRoutes(r chi.Router)

	// PublicRoutes installs auth-specific public routes to the Router.
	PublicRoutes(r chi.Router)

	// AllowInsecureCookie returns whether the request is for a host where we can allow insecure.
	AllowInsecureCookie(*http.Request) bool

	// ChangePassword changes a password. Privileged users can specify another username, and do not need to furnish an oldPassword; otherwise the user is grabbed from the context Subject.
	ChangePassword(ctx context.Context, username, oldPassword *string, newPassword string) error

	// CreateAPIKey creates and stores an API key according to rq.
	CreateAPIKey(ctx context.Context, rq CreateAPIKeyRequest) (*users.APIKey, error)
}

Authn performs API key and user JWT authentication.

type CreateAPIKeyRequest

type CreateAPIKeyRequest struct {
	Owner     *string          `json:"owner"`
	Name      *string          `json:"name"`
	ExpiresAt *jsontypes.Time  `json:"expiresAt"`
	Disabled  bool             `json:"disabled"`
	Kind      users.APIKeyKind `json:"kind"`
	Scopes    []string         `json:"scopes"`
}

type PasswordValidationErr

type PasswordValidationErr struct {
	// contains filtered or unexported fields
}

func (PasswordValidationErr) Unwrap

func (p PasswordValidationErr) Unwrap() error

type Token

type Token interface {
	jwt.Token
	FromHeader() bool
}

func VerifyRequest

func VerifyRequest(ja *jwtauth.JWTAuth, r *http.Request) (Token, error)