authutil

Documentation

Overview

Package authutil provides argon2id password hashing and ECDSA JWT token generation/validation. Although it primarily serves the identity bounded context, it lives in pkg/ because the gateway authentication middleware (internal/gateway/middleware) must validate JWT tokens independently, without importing domain code. Placing it in pkg/ breaks the circular dependency: domain/identity -> authutil <- gateway/middleware.

Index

• Constants
• func HashPassword(password string) (string, error)
• func VerifyPassword(password, encoded string) (bool, error)
• type JWTIssuer
  • func NewJWTIssuer(privateKey *ecdsa.PrivateKey, publicKey *ecdsa.PublicKey) *JWTIssuer
  • func (j *JWTIssuer) Sign(claims UserClaims, ttl time.Duration) (string, error)
  • func (j *JWTIssuer) Verify(tokenString string) (*UserClaims, error)
• type UserClaims

Constants

const (
	ArgonTime     = 1         // number of iterations
	ArgonMemoryKB = 64 * 1024 // 64 MB in KB
	ArgonThreads  = 4         // parallelism
	ArgonKeyLen   = 32        // output key length in bytes
	ArgonSaltLen  = 16        // salt length in bytes

)

const (
	JWTIssuerName = "remnacore"
)

Functions

func HashPassword

func HashPassword(password string) (string, error)

HashPassword derives an argon2id hash and returns the encoded string: $argon2id$v=19$m=65536,t=1,p=4$<salt>$<hash>

func VerifyPassword

func VerifyPassword(password, encoded string) (bool, error)

VerifyPassword parses the encoded hash, re-derives the key, and performs a timing-safe comparison.

Types

type JWTIssuer

type JWTIssuer struct {
	// contains filtered or unexported fields
}

JWTIssuer creates and validates ES256 JWTs.

func NewJWTIssuer

func NewJWTIssuer(privateKey *ecdsa.PrivateKey, publicKey *ecdsa.PublicKey) *JWTIssuer

NewJWTIssuer returns a JWTIssuer configured with the given ECDSA key pair. Either key may be nil if only signing or only verification is needed.

func (*JWTIssuer) Sign

func (j *JWTIssuer) Sign(claims UserClaims, ttl time.Duration) (string, error)

Sign produces an ES256 JWT containing the given UserClaims and standard registered claims (iat, exp, jti, iss). The token expires after ttl.

func (*JWTIssuer) Verify

func (j *JWTIssuer) Verify(tokenString string) (*UserClaims, error)

Verify parses and validates the token string, ensuring the signing method is ECDSA and the token has not expired. On success it returns the embedded UserClaims.

type UserClaims

type UserClaims struct {
	UserID string `json:"user_id"`
	Email  string `json:"email"`
}

UserClaims carries the application-level identity embedded in each JWT. Authorization is resolved per-request by AccessService (which reads the user's current RBAC bindings from the database); no authz decision may read role from the token.