auth

Documentation

Overview

Package auth provides basic authentication and authorization primitives for use elsewhere in the application. TODO: Maybe move this into auth/jwt

Index

• Variables
• func InitRBAC() *gorbac.RBAC
• func NewPassword() string
• func ValidRole(r string) bool
• type JWTSecret
  • func (s *JWTSecret) SetSecret(secret []byte)
  • func (s *JWTSecret) Sign(role string) (string, error)
  • func (s *JWTSecret) ValidSecret() error
  • func (s *JWTSecret) ValidateToken(tokenString string) (jwt.MapClaims, error)

Variables

var (
	// Permission for reading app users
	PermUserRead = gorbac.NewStdPermission("user_read")
	// Permissions for editing app users
	PermUserWrite = gorbac.NewStdPermission("user_write")

	PermChallengeAdmin = gorbac.NewStdPermission("challenge")

	PermCertAdmin = gorbac.NewStdPermission("cert")

	// Role that has User Read permission
	RoleUserReader = "user_reader"
	// Role that has User Write and Read permissions
	RoleUserAdmin = "user_admin"

	// Role that will have all permissions.
	RoleSuperAdmin = "super_admin"
)

Create separate read and write permissions

var ErrInvalidToken = errors.New("invalid JWT")

ErrInvalidToken is returned if the passed in JWT is unable to be parsed by the library.

var ErrSecretTooShort = errors.New("secret length must be at least 32 bytes")

ErrSecretTooShort is an signaling the provided secret must be longer.

var ExpiryDuration = 24 * time.Hour

ExpiryDuration determines that all tokens expire 24 hours after minting.

var MinBytes = 32

MinBytes is the minimum amount of bytes for secret allowed.

Functions

func InitRBAC

func InitRBAC() *gorbac.RBAC

InitRBAC returns a new instance of gorbac.RBAC for Role-Based Access Controls.

func NewPassword

func NewPassword() string

NewPassword generates cryptographically secure random bytes, base64 encodes it, and returns it.

func ValidRole

func ValidRole(r string) bool

ValidRole takes a string and compares it to a list of valid rules. Returns true if there is a match. TODO: Make map for faster lookup.

Types

type JWTSecret

type JWTSecret struct {
	Secret []byte
}

JWTSecret is the type for holding the signing secret of a JWT.

func (*JWTSecret) SetSecret

func (s *JWTSecret) SetSecret(secret []byte)

SetSecret allows for the secret of the signer to be set with a copied byte slice for safety.

func (*JWTSecret) Sign

func (s *JWTSecret) Sign(role string) (string, error)

Sign takes a role string to be stored in the JWT and signed. WARNING: This method is dangerous to call with a cryptographically insecure secret.

func (*JWTSecret) ValidSecret

func (s *JWTSecret) ValidSecret() error

ValidSecret returns an error if the secret is not long enough. Must be MinBytes long at minimum to be safe.

func (*JWTSecret) ValidateToken

func (s *JWTSecret) ValidateToken(tokenString string) (jwt.MapClaims, error)

ValidateToken takes a token string, usually provided by the user, and validates whether or not it is properly signed as well as parses out any claims.