internal/

Package adminapi provides the admin gateway HTTP handlers, middleware, and server-rendered frontend for The Vault's RBAC admin interface.

Package alert raises operator-facing notifications from security events.

Package audit provides append-only audit logging for security-relevant events.

Package cache provides a pluggable key-value cache interface with Redis, in-memory, and PostgreSQL backends.

Package cli implements administrative CLI commands for The Vault.

Package config loads and validates all configuration for The Vault from environment variables and secret files.

Package crypto provides cryptographic primitives for the Vault auth service, including AES-256-GCM encryption, Argon2id password hashing, HMAC-SHA256, RS256 JWT signing and validation, TOTP, DPoP proof verification, device fingerprinting, and secure random generation.

Package deferwork runs work that outlives the request that triggered it, on a bounded pool that shutdown drains.

Package dpop carries the sender-constraining binding a validated DPoP proof establishes (RFC 9449) from the middleware that checks the proof to the code that issues the token.

Package email provides email sending capabilities for The Vault via a pluggable Sender interface.

Package firstboot hands a freshly generated credential to the operator without putting it in the process log.

Package frontend embeds the Vue SPA dist directory for serving from the Go binary.

Package handler implements HTTP handlers for the Vault auth service, including authentication, OAuth2 social login, TOTP and WebAuthn 2FA, password management, user profiles, client credentials, and health checks.

Package honeypot provides threat observation capabilities for the Vault's honeypot deployment profile.

Package httputil provides HTTP response helper functions for writing JSON responses.

Package ipintel is vault42's IP-intelligence layer.

Package jwt is a stdlib-only JWT implementation for Vault42: RS256 + ES256 sign/verify, claim parsing, algorithm whitelisting, and canonical segment decoding.

Package keystore provides database-backed signing key management with encryption at rest, automatic multi-pod refresh, and zero-downtime rotation.

Package kms implements vault42's KEK envelope-unwrap oracle: the primitive behind POST /kms/unwrap.

Package metrics provides Prometheus-compatible metrics exposition for The Vault.

Package middleware provides HTTP middleware for the Vault auth service, including JWT authentication, CORS, DPoP proof validation, device fingerprinting, rate limiting, request logging, security headers, and panic recovery.

Package migrate provides a minimal SQL migration runner that applies .sql files in order.

Package model defines the domain types used across all layers of The Vault.

Package oauth2 provides a pluggable OAuth2/OIDC provider abstraction for social login.

Package outbound decides which destinations vault42 may open a connection to.

Package rbac defines the role-based access control model for the admin gateway.

Package redis provides a minimal, stdlib-only Redis client for The Vault.

Package repository defines the persistence interfaces for all domain entities.

Package sanitize provides input validation and sanitization functions for user-supplied data.

Package seed provides declarative database seeding from JSON files.

Package server wires together the HTTP server, TLS configuration, middleware chain, and route registration for The Vault.

Package service implements the business logic layer for the Vault auth service, including user authentication, token issuance and rotation, MFA policy enforcement, and HIBP breach checking.

Package useragent parses User-Agent strings into human-readable device descriptions.