auth

Documentation

Overview

Package auth provides token generation, password hashing, and session management.

Index

• Variables
• func CheckPassword(hash, password string) error
• func GenerateAPIKey() (string, error)
• func GenerateAgentToken() (string, error)
• func GenerateSessionToken() (string, error)
• func HashPassword(password string) (string, error)
• func HashToken(token string) string
• type SessionManager
  • func NewSessionManager(key []byte) *SessionManager
  • func (sm *SessionManager) Sign(token string) string
  • func (sm *SessionManager) Verify(signedToken string) (string, error)
  • func (sm *SessionManager) WithTTL(ttl time.Duration) *SessionManager
  • func (sm *SessionManager) WithTTLFunc(fn func() time.Duration) *SessionManager
  • func (sm *SessionManager) WithVersion(fn func() int) *SessionManager

Variables

var (
	ErrSessionExpired = errors.New("session expired")
	ErrSessionRevoked = errors.New("session revoked")
)

ErrSessionExpired is returned by Verify when a token's embedded expiry has passed. ErrSessionRevoked is returned when the token's session version is older than the current server-side version (logout / password change bump it).

Functions

func CheckPassword

func CheckPassword(hash, password string) error

CheckPassword compares a bcrypt hash with a plaintext password. Returns nil on success or an error if they do not match.

func GenerateAPIKey

func GenerateAPIKey() (string, error)

GenerateAPIKey returns a token prefixed with "np_ak_" followed by 32 random hex bytes.

func GenerateAgentToken

func GenerateAgentToken() (string, error)

GenerateAgentToken returns a token prefixed with "np_ag_" followed by 32 random hex bytes.

func GenerateSessionToken

func GenerateSessionToken() (string, error)

GenerateSessionToken returns 32 random hex bytes (no prefix).

func HashPassword

func HashPassword(password string) (string, error)

HashPassword returns a bcrypt hash of the given password using cost 12.

func HashToken

func HashToken(token string) string

HashToken returns the SHA-256 hex digest of a token for storage comparison.

Types

type SessionManager

type SessionManager struct {
	// contains filtered or unexported fields
}

SessionManager provides HMAC-based session token signing and verification.

A signed token embeds a tamper-proof expiry and a server-side session version inside the HMAC-protected payload, so Verify can reject sessions that have outlived their lifetime or that were invalidated server-side (logout or password change bump the version). This makes the previously client-only cookie expiry actually enforced and gives logout real teeth.

func NewSessionManager

func NewSessionManager(key []byte) *SessionManager

NewSessionManager creates a SessionManager with the given HMAC key and the default session TTL.

func (*SessionManager) Sign

func (sm *SessionManager) Sign(token string) string

Sign produces a signed token in the format "token.meta.signature" where meta encodes the session version and expiry (version:expiryUnix, base64url) and the signature is the base64url-encoded HMAC-SHA256 of "token.meta". The original token is recoverable from Verify, so existing callers keep their semantics.

func (*SessionManager) Verify

func (sm *SessionManager) Verify(signedToken string) (string, error)

Verify checks the signed token and returns the original token if valid. It rejects tokens with a bad format or signature, tokens past their embedded expiry (ErrSessionExpired), and tokens whose version is older than the current server-side version (ErrSessionRevoked). The HMAC comparison is constant-time.

func (*SessionManager) WithTTL

func (sm *SessionManager) WithTTL(ttl time.Duration) *SessionManager

WithTTL sets the lifetime embedded into freshly signed tokens. A non-positive TTL falls back to the default. Returns the receiver for chaining.

func (*SessionManager) WithTTLFunc

func (sm *SessionManager) WithTTLFunc(fn func() time.Duration) *SessionManager

WithTTLFunc wires a provider that supplies the session lifetime dynamically at Sign time. Set it once at construction; it is read without locking on every Sign, so the configured session_expiry_hours is honored live without the shared-state writes a per-request WithTTL would incur. Returns the receiver.

func (*SessionManager) WithVersion

func (sm *SessionManager) WithVersion(fn func() int) *SessionManager

WithVersion wires a provider for the current server-side session version. Verify rejects any token whose embedded version is lower than the value this returns, so bumping it (on logout or password change) invalidates every outstanding cookie. Returns the receiver for chaining.