auth

Documentation

Overview

Package auth contains authentication primitives shared by the HTTP and store layers.

Index

• Constants
• func HashOpaqueToken(raw string) string
• func HashPassword(password string) (string, error)
• func NewOpaqueToken(prefix string) (raw, hash string, err error)
• func VerifyPassword(hash, password string) error
• func WithPrincipal(ctx context.Context, p Principal) context.Context
• type Principal
  • func PrincipalFromContext(ctx context.Context) (Principal, bool)
• type Role
• type SecretAssociatedData
• type SecretBox
  • func NewSecretBox(key []byte) (*SecretBox, error)
  • func (b *SecretBox) Open(ciphertext []byte, associated SecretAssociatedData) ([]byte, error)
  • func (b *SecretBox) Seal(plaintext []byte, associated SecretAssociatedData) ([]byte, error)

Constants

const SecretKeySize = 32

SecretKeySize is the required key length for AES-256-GCM.

Functions

func HashOpaqueToken

func HashOpaqueToken(raw string) string

HashOpaqueToken returns a SHA-256 hash suitable for storing opaque token lookups.

func HashPassword

func HashPassword(password string) (string, error)

HashPassword returns a bcrypt hash for password.

func NewOpaqueToken

func NewOpaqueToken(prefix string) (raw, hash string, err error)

NewOpaqueToken creates a random token with prefix and returns the raw token plus its stable hash.

func VerifyPassword

func VerifyPassword(hash, password string) error

VerifyPassword compares password with a stored bcrypt hash.

func WithPrincipal

func WithPrincipal(ctx context.Context, p Principal) context.Context

WithPrincipal attaches p to ctx.

Types

type Principal

type Principal struct {
	UserID     string
	TenantID   string
	Role       Role
	AuthMethod string
}

Principal is the authenticated account identity attached to a request.

func PrincipalFromContext

func PrincipalFromContext(ctx context.Context) (Principal, bool)

PrincipalFromContext returns the authenticated principal from ctx.

type Role

type Role string

Role identifies an instance-level account role.

const (
	// RoleAdmin can manage instance users.
	RoleAdmin Role = "admin"
	// RoleUser can access their own tenant data.
	RoleUser Role = "user"
)

type SecretAssociatedData

type SecretAssociatedData struct {
	TenantID string
	Scope    string
	Name     string
	Kind     string
}

SecretAssociatedData binds ciphertext to a tenant, subject, and credential kind.

type SecretBox

type SecretBox struct {
	// contains filtered or unexported fields
}

SecretBox seals and opens secrets using authenticated encryption.

func NewSecretBox

func NewSecretBox(key []byte) (*SecretBox, error)

NewSecretBox creates a SecretBox from a 32-byte key.

func (*SecretBox) Open

func (b *SecretBox) Open(ciphertext []byte, associated SecretAssociatedData) ([]byte, error)

Open decrypts ciphertext only when associated data matches.

func (*SecretBox) Seal

func (b *SecretBox) Seal(plaintext []byte, associated SecretAssociatedData) ([]byte, error)

Seal encrypts plaintext and authenticates associated data.