humanauth

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 13, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultLocalBootstrapRequestTTL = 10 * time.Minute
)

Variables

View Source 
var (
	ErrLocalBootstrapDisabled    = errors.New("local bootstrap authorization is disabled")
	ErrLocalBootstrapInvalid     = errors.New("invalid local bootstrap authorization request")
	ErrLocalBootstrapExpired     = errors.New("local bootstrap authorization request expired")
	ErrLocalBootstrapAlreadyUsed = errors.New("local bootstrap authorization request was already used")
)
View Source 
var (
	ErrOrganizationMembershipNotFound = errors.New("organization membership not found")
	ErrOrganizationInvitationNotFound = errors.New("organization invitation not found")
	ErrOrganizationInvitationExpired  = errors.New("organization invitation expired")
	ErrOrganizationInvitationPending  = errors.New("organization invitation is already pending")
	ErrOrganizationMemberExists       = errors.New("organization member already exists")
	ErrLastOrganizationOwner          = errors.New("cannot change the last active organization owner")
	ErrOrganizationInvitationMismatch = errors.New("organization invitation email does not match the current user")
	ErrOrganizationAcceptanceRequired = errors.New("organization membership cannot become active before invitation acceptance")
)
View Source 
var (
	ErrAuthDisabled        = errors.New("human auth is disabled")
	ErrInvalidFlowState    = errors.New("invalid oidc login flow state")
	ErrInvalidSession      = errors.New("invalid browser session")
	ErrSessionExpired      = errors.New("browser session expired")
	ErrSessionNotFound     = errors.New("browser session not found")
	ErrUserDisabled        = errors.New("user is disabled")
	ErrUserNotFound        = errors.New("user not found")
	ErrPermissionDenied    = errors.New("permission denied")
	ErrUnauthorized        = errors.New("human session required")
	ErrRoleBindingNotFound = errors.New("role binding not found")
)

Functions

func NormalizeReturnTo 

func NormalizeReturnTo(raw string) string

Types

type AccessControlStateResolver added in v0.3.0 

type AccessControlStateResolver interface {
	RuntimeState(ctx context.Context) (iam.RuntimeAccessControlState, error)
}

type Authorizer 

type Authorizer struct {
	// contains filtered or unexported fields
}

func NewAuthorizer 

func NewAuthorizer(repository *repo.Repository) *Authorizer

func (*Authorizer) Evaluate 

func (a *Authorizer) Evaluate(
	ctx context.Context,
	user domain.User,
	identity domain.UserIdentity,
	groups []domain.UserGroupMembership,
	scope domain.ScopeRef,
) ([]domain.RoleKey, []domain.PermissionKey, error)

func (*Authorizer) HasPermission 

func (a *Authorizer) HasPermission(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
	scope domain.ScopeRef,
	permission domain.PermissionKey,
) (bool, []domain.RoleKey, []domain.PermissionKey, error)

func (*Authorizer) ResolveOrganizationScope 

func (a *Authorizer) ResolveOrganizationScope(ctx context.Context, resource string, id uuid.UUID) (domain.ScopeRef, error)

func (*Authorizer) ResolveProjectScope 

func (a *Authorizer) ResolveProjectScope(ctx context.Context, resource string, id uuid.UUID) (domain.ScopeRef, error)

type CallbackResult 

type CallbackResult struct {
	SessionToken string
	CSRFToken    string
	ReturnTo     string
	Principal    domain.AuthenticatedPrincipal
}

type CreateRoleBindingInput added in v0.3.0 

type CreateRoleBindingInput struct {
	SubjectKind string
	SubjectKey  string
	RoleKey     string
	GrantedBy   string
	ExpiresAt   *time.Time
}

type InviteOrganizationMemberInput added in v0.3.0 

type InviteOrganizationMemberInput struct {
	Email string
	Role  string
}

type InviteOrganizationMemberResult added in v0.3.0 

type InviteOrganizationMemberResult struct {
	Entry       domain.OrganizationMembershipEntry
	Invitation  domain.OrganizationInvitation
	AcceptToken string
}

type LocalBootstrapIssueInput added in v0.3.0 

type LocalBootstrapIssueInput struct {
	RequestedBy string
	Purpose     string
	TTL         time.Duration
}

type LocalBootstrapIssueResult added in v0.3.0 

type LocalBootstrapIssueResult struct {
	RequestID string    `json:"request_id"`
	Code      string    `json:"code"`
	Nonce     string    `json:"nonce"`
	Purpose   string    `json:"purpose"`
	ExpiresAt time.Time `json:"expires_at"`
}

type LocalSessionAuthentication added in v0.3.0 

type LocalSessionAuthentication struct {
	Session     domain.BrowserSession
	CSRFToken   string
	Roles       []domain.RoleKey
	Permissions []domain.PermissionKey
}

type LoginStart 

type LoginStart struct {
	RedirectURL     string
	FlowCookieValue string
}

type OIDCProviderDiagnostics added in v0.3.0 

type OIDCProviderDiagnostics struct {
	IssuerURL             string
	AuthorizationEndpoint string
	TokenEndpoint         string
}

func InspectOIDCProvider added in v0.3.0 

func InspectOIDCProvider(
	ctx context.Context,
	cfg config.AuthConfig,
	httpClient *http.Client,
	redirectURL string,
) (OIDCProviderDiagnostics, error)

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func NewService 

func NewService(repository *repo.Repository, httpClient *http.Client, stateResolver AccessControlStateResolver) *Service

func (*Service) AcceptOrganizationInvitation added in v0.3.0 

func (s *Service) AcceptOrganizationInvitation(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
	acceptToken string,
) (domain.OrganizationMembershipEntry, error)

func (*Service) AuthenticateLocalSession added in v0.3.0 

func (s *Service) AuthenticateLocalSession(
	ctx context.Context,
	sessionToken string,
	userAgent string,
	ip string,
	touch bool,
) (LocalSessionAuthentication, error)

func (*Service) AuthenticateSession 

func (s *Service) AuthenticateSession(
	ctx context.Context,
	sessionToken string,
	userAgent string,
	ip string,
	touch bool,
) (domain.AuthenticatedPrincipal, error)

func (*Service) CancelOrganizationInvitation added in v0.3.0 

func (s *Service) CancelOrganizationInvitation(
	ctx context.Context,
	organizationID uuid.UUID,
	invitationID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
) (domain.OrganizationMembershipEntry, error)

func (*Service) CountApprovalPolicies 

func (s *Service) CountApprovalPolicies(ctx context.Context) (int, error)

func (*Service) CreateInstanceRoleBinding added in v0.3.0 

func (s *Service) CreateInstanceRoleBinding(ctx context.Context, input CreateRoleBindingInput) (domain.InstanceRoleBinding, error)

func (*Service) CreateLocalBootstrapRequest added in v0.3.0 

func (s *Service) CreateLocalBootstrapRequest(
	ctx context.Context,
	input LocalBootstrapIssueInput,
) (LocalBootstrapIssueResult, error)

func (*Service) CreateOrganizationRoleBinding added in v0.3.0 

func (s *Service) CreateOrganizationRoleBinding(
	ctx context.Context,
	organizationID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
	input CreateRoleBindingInput,
) (domain.OrganizationRoleBinding, error)

func (*Service) CreateProjectRoleBinding added in v0.3.0 

func (s *Service) CreateProjectRoleBinding(
	ctx context.Context,
	projectID uuid.UUID,
	input CreateRoleBindingInput,
) (domain.ProjectRoleBinding, error)

func (*Service) DeleteInstanceRoleBinding added in v0.3.0 

func (s *Service) DeleteInstanceRoleBinding(ctx context.Context, id uuid.UUID) error

func (*Service) DeleteOrganizationRoleBinding added in v0.3.0 

func (s *Service) DeleteOrganizationRoleBinding(
	ctx context.Context,
	organizationID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
	id uuid.UUID,
) error

func (*Service) DeleteProjectRoleBinding added in v0.3.0 

func (s *Service) DeleteProjectRoleBinding(ctx context.Context, projectID uuid.UUID, id uuid.UUID) error

func (*Service) ForceRevokeSession added in v0.3.0 

func (s *Service) ForceRevokeSession(
	ctx context.Context,
	actor domain.AuthenticatedPrincipal,
	sessionID uuid.UUID,
) (domain.BrowserSession, bool, error)

func (*Service) ForceRevokeUserSessions added in v0.3.0 

func (s *Service) ForceRevokeUserSessions(
	ctx context.Context,
	actor domain.AuthenticatedPrincipal,
	userID uuid.UUID,
) ([]domain.BrowserSession, error)

func (*Service) GetUserDirectoryDetail added in v0.3.0 

func (s *Service) GetUserDirectoryDetail(
	ctx context.Context,
	userID uuid.UUID,
) (domain.UserDirectoryDetail, error)

func (*Service) HandleCallback 

func (s *Service) HandleCallback(
	ctx context.Context,
	code string,
	state string,
	flowCookieValue string,
	userAgent string,
	ip string,
	redirectURL string,
) (result CallbackResult, err error)

func (*Service) InviteOrganizationMember added in v0.3.0 

func (s *Service) InviteOrganizationMember(
	ctx context.Context,
	organizationID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
	input InviteOrganizationMemberInput,
) (InviteOrganizationMemberResult, error)

func (*Service) ListOrganizationMembershipEntries added in v0.3.0 

func (s *Service) ListOrganizationMembershipEntries(
	ctx context.Context,
	organizationID uuid.UUID,
) ([]domain.OrganizationMembershipEntry, error)

func (*Service) ListRoleBindings 

func (s *Service) ListRoleBindings(
	ctx context.Context,
	scope domain.ScopeKind,
	scopeID string,
) ([]domain.RoleBinding, error)

func (*Service) ListSessionGovernance added in v0.3.0 

func (s *Service) ListSessionGovernance(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
) (SessionGovernanceSnapshot, error)

func (*Service) ListUserDirectory added in v0.3.0 

func (s *Service) ListUserDirectory(
	ctx context.Context,
	filter domain.UserDirectoryFilter,
) ([]domain.UserDirectoryEntry, error)

func (*Service) Logout 

func (s *Service) Logout(ctx context.Context, sessionToken string) error

func (*Service) LogoutLocalSession added in v0.3.0 

func (s *Service) LogoutLocalSession(ctx context.Context, sessionToken string) error

func (*Service) RedeemLocalBootstrapRequest added in v0.3.0 

func (s *Service) RedeemLocalBootstrapRequest(
	ctx context.Context,
	requestID string,
	code string,
	nonce string,
	userAgent string,
	ip string,
) (result CallbackResult, err error)

func (*Service) ResendOrganizationInvitation added in v0.3.0 

func (s *Service) ResendOrganizationInvitation(
	ctx context.Context,
	organizationID uuid.UUID,
	invitationID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
) (InviteOrganizationMemberResult, error)

func (*Service) RevokeOtherSessions added in v0.3.0 

func (s *Service) RevokeOtherSessions(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
) ([]domain.BrowserSession, error)

func (*Service) RevokeSession added in v0.3.0 

func (s *Service) RevokeSession(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
	sessionID uuid.UUID,
) (domain.BrowserSession, bool, error)

func (*Service) StartLogin 

func (s *Service) StartLogin(ctx context.Context, returnTo string, redirectURL string) (LoginStart, error)

func (*Service) TransferOrganizationOwnership added in v0.3.0 

func (s *Service) TransferOrganizationOwnership(
	ctx context.Context,
	organizationID uuid.UUID,
	targetMembershipID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
	input TransferOrganizationOwnershipInput,
) ([]domain.OrganizationMembershipEntry, error)

func (*Service) TransitionUserStatus added in v0.3.0 

func (s *Service) TransitionUserStatus(
	ctx context.Context,
	input domain.UserStatusTransitionInput,
) (domain.UserStatusTransitionResult, error)

func (*Service) UpdateInstanceRoleBinding added in v0.3.0 

func (s *Service) UpdateInstanceRoleBinding(
	ctx context.Context,
	id uuid.UUID,
	input UpdateRoleBindingInput,
) (domain.InstanceRoleBinding, error)

func (*Service) UpdateOrganizationMembership added in v0.3.0 

func (s *Service) UpdateOrganizationMembership(
	ctx context.Context,
	organizationID uuid.UUID,
	membershipID uuid.UUID,
	actor domain.AuthenticatedPrincipal,
	input UpdateOrganizationMembershipInput,
) (domain.OrganizationMembershipEntry, error)

func (*Service) UpdateOrganizationRoleBinding added in v0.3.0 

func (s *Service) UpdateOrganizationRoleBinding(
	ctx context.Context,
	organizationID uuid.UUID,
	id uuid.UUID,
	input UpdateRoleBindingInput,
) (domain.OrganizationRoleBinding, error)

func (*Service) UpdateProjectRoleBinding added in v0.3.0 

func (s *Service) UpdateProjectRoleBinding(
	ctx context.Context,
	projectID uuid.UUID,
	id uuid.UUID,
	input UpdateRoleBindingInput,
) (domain.ProjectRoleBinding, error)

type SessionGovernanceSnapshot added in v0.3.0 

type SessionGovernanceSnapshot struct {
	Sessions    []domain.BrowserSession
	AuditEvents []domain.AuthAuditEvent
	StepUp      StepUpCapability
}

type StepUpCapability added in v0.3.0 

type StepUpCapability struct {
	Status           string
	Summary          string
	SupportedMethods []string
}

func ReservedStepUpCapability added in v0.3.0 

func ReservedStepUpCapability() StepUpCapability

type TransferOrganizationOwnershipInput added in v0.3.0 

type TransferOrganizationOwnershipInput struct {
	PreviousOwnerRole string
}

type UpdateOrganizationMembershipInput added in v0.3.0 

type UpdateOrganizationMembershipInput struct {
	Role   *string
	Status *string
}

type UpdateRoleBindingInput added in v0.3.0 

type UpdateRoleBindingInput struct {
	SubjectKind string
	SubjectKey  string
	RoleKey     string
	GrantedBy   string
	ExpiresAt   *time.Time
}

type VisibilityResolver added in v0.3.0 

type VisibilityResolver struct {
	// contains filtered or unexported fields
}

func NewVisibilityResolver added in v0.3.0 

func NewVisibilityResolver(repository *repo.Repository) *VisibilityResolver

func (*VisibilityResolver) EffectiveVisibility added in v0.3.0 

func (r *VisibilityResolver) EffectiveVisibility(
	ctx context.Context,
	principal domain.AuthenticatedPrincipal,
) (domain.EffectiveVisibility, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.