auth

Documentation

Overview

Package auth ports dashboardSession.js concepts into pure Go adapters.

Index

• Variables
• func CompareBcrypt(password, hash string) error
• func HashBcrypt(password string) (string, error)
• func IsConfigured(cfg OIDCConfig) bool
• func ParsePublicOrigin(r httpRequestLike, configuredBaseURL string) string
• type CookieStore
  • func NewCookieStore(secret string) (*CookieStore, error)
  • func (s *CookieStore) Clear(w http.ResponseWriter) error
  • func (s *CookieStore) Get(r *http.Request) (*domainauth.Session, error)
  • func (s *CookieStore) Set(w http.ResponseWriter, sess domainauth.Session) error
  • func (s *CookieStore) WithForceSecure(force bool) *CookieStore
  • func (s *CookieStore) WithTTL(ttl time.Duration) *CookieStore
• type LockStatus
• type LoginLimiter
  • func NewLoginLimiter() *LoginLimiter
  • func (l *LoginLimiter) Allow(ip string) bool
  • func (l *LoginLimiter) CheckLock(ip string) LockStatus
  • func (l *LoginLimiter) RecordFail(ip string) (remainingBeforeLock int)
  • func (l *LoginLimiter) RecordSuccess(ip string)
• type OIDC
  • func NewOIDC(ctx context.Context, cfg OIDCConfig) (*OIDC, error)
  • func (o *OIDC) Exchange(ctx context.Context, code, redirectURI, codeVerifier string) (domainauth.Principal, error)
  • func (o *OIDC) Provider() *oidc.Provider
  • func (o *OIDC) StartURL(ctx context.Context, redirectURI string) (authURL, state, nonce, codeVerifier string, err error)
  • func (o *OIDC) Verify(ctx context.Context, idToken string) (map[string]any, error)
• type OIDCConfig

Variables

var (
	// ErrInvalidSession is returned when a session cookie is missing, malformed,
	// tampered with, or expired.
	ErrInvalidSession = errors.New("invalid session")
	// ErrSecretTooShort is returned when the HMAC secret is shorter than 16 bytes.
	ErrSecretTooShort = errors.New("session secret must be at least 16 bytes")
)

Functions

func CompareBcrypt

func CompareBcrypt(password, hash string) error

CompareBcrypt is the real bcrypt comparator: returns nil iff password matches the stored hash. It is the BcryptFunc the usecase expects (password, hash) -> error, matching bcrypt.CompareHashAndPassword order (hash, password) internally.

func HashBcrypt

func HashBcrypt(password string) (string, error)

HashBcrypt is a convenience helper for generating a bcrypt hash from a plaintext password (cost 10, matching the JS dashboard default). Used by tests and the backup/restore seed; not on the hot login path.

func IsConfigured

func IsConfigured(cfg OIDCConfig) bool

IsConfigured is a helper that reports whether the required OIDC fields are present, matching oidc.js isOidcConfigured.

func ParsePublicOrigin

func ParsePublicOrigin(r httpRequestLike, configuredBaseURL string) string

ParsePublicOrigin mirrors oidc.js getPublicOrigin: prefer configured base URL, then X-Forwarded-Proto/Host, then request origin.

Types

type CookieStore

type CookieStore struct {
	// contains filtered or unexported fields
}

CookieStore implements domainauth.Store with HMAC-signed cookies. It is a straight port of the security properties in dashboardSession.js (signed, opaque, httpOnly, secure when HTTPS, lax sameSite, path=/).

func NewCookieStore

func NewCookieStore(secret string) (*CookieStore, error)

NewCookieStore returns a store that signs cookies with secret. If secret is shorter than 16 bytes an error is returned so the server cannot start with a weak secret. ttl defaults to 24h; use WithTTL to override.

func (*CookieStore) Clear

func (s *CookieStore) Clear(w http.ResponseWriter) error

Clear invalidates the auth_token cookie.

func (*CookieStore) Get

func (s *CookieStore) Get(r *http.Request) (*domainauth.Session, error)

Get reads and verifies the auth_token cookie. It returns ErrInvalidSession when the cookie is missing, malformed, tampered with, or expired.

func (*CookieStore) Set

func (s *CookieStore) Set(w http.ResponseWriter, sess domainauth.Session) error

Set writes an HMAC-signed auth_token cookie for the given session.

func (*CookieStore) WithForceSecure

func (s *CookieStore) WithForceSecure(force bool) *CookieStore

WithForceSecure forces the Secure flag on every cookie, matching AUTH_COOKIE_SECURE=true in dashboardSession.js.

func (*CookieStore) WithTTL

func (s *CookieStore) WithTTL(ttl time.Duration) *CookieStore

WithTTL returns a copy of the store using the provided TTL.

type LockStatus

type LockStatus struct {
	Locked     bool
	RetryAfter time.Duration
}

LockStatus describes whether an IP is currently locked and for how long.

type LoginLimiter

type LoginLimiter struct {
	// contains filtered or unexported fields
}

LoginLimiter provides in-memory progressive lockout for dashboard login. It is safe for concurrent use. A successful login resets the entry for the IP.

func NewLoginLimiter

func NewLoginLimiter() *LoginLimiter

NewLoginLimiter returns a fresh login limiter. Use the same constants as loginLimiter.js: 5 fails before lock, escalating lock durations, 1h idle reset.

func (*LoginLimiter) Allow

func (l *LoginLimiter) Allow(ip string) bool

Allow reports whether the IP is currently permitted to attempt login.

func (*LoginLimiter) CheckLock

func (l *LoginLimiter) CheckLock(ip string) LockStatus

CheckLock returns the lock status for an IP without mutating state.

func (*LoginLimiter) RecordFail

func (l *LoginLimiter) RecordFail(ip string) (remainingBeforeLock int)

RecordFail increments the failure count and returns the remaining attempts before lockout. If the threshold is crossed the IP is locked for a step that escalates with each repeated lock.

func (*LoginLimiter) RecordSuccess

func (l *LoginLimiter) RecordSuccess(ip string)

RecordSuccess clears any lock/failure state for the IP.

type OIDC

type OIDC struct {
	// contains filtered or unexported fields
}

OIDC implements domainauth.OIDCPort using github.com/coreos/go-oidc/v3 and golang.org/x/oauth2. It ports the start/callback/test flows from oidc.js.

func NewOIDC

func NewOIDC(ctx context.Context, cfg OIDCConfig) (*OIDC, error)

NewOIDC discovers the provider and returns an OIDC adapter. The context is used for the discovery HTTP request.

func (*OIDC) Exchange

func (o *OIDC) Exchange(ctx context.Context, code, redirectURI, codeVerifier string) (domainauth.Principal, error)

Exchange trades the authorization code for an ID token and returns the authenticated principal. The domainauth.OIDCPort contract does not pass the nonce, so nonce validation must be performed by the caller if required; the ID token signature, issuer and audience are verified here.

func (*OIDC) Provider

func (o *OIDC) Provider() *oidc.Provider

Provider exposes the underlying OIDC provider for advanced callers (e.g. JWK endpoint inspection).

func (*OIDC) StartURL

func (o *OIDC) StartURL(ctx context.Context, redirectURI string) (authURL, state, nonce, codeVerifier string, err error)

StartURL builds the authorization URL and returns the generated PKCE/state values so the caller can persist them for callback validation. This satisfies the domainauth.OIDCPort contract.

func (*OIDC) Verify

func (o *OIDC) Verify(ctx context.Context, idToken string) (map[string]any, error)

Verify validates a raw ID token string and returns its claims. This mirrors oidc.js verifyOidcIdToken and is useful for test/logout endpoints.

type OIDCConfig

type OIDCConfig struct {
	IssuerURL    string
	ClientID     string
	ClientSecret string
	RedirectURI  string
	Scopes       []string
}

OIDCConfig holds the runtime OIDC settings. The dashboard JS reads these from settings/env; in Go they are passed via constructor so the adapter does not depend on config.Config directly.