service

package
v0.0.0-...-a43836d Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 25, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func HashRefreshToken 

func HashRefreshToken(token string) string

HashRefreshToken returns the SHA-256 hex digest of a refresh-token value. It is used only for derived keys (e.g. the per-token refresh lock); the JWT itself is keyed by its jti claim.

Types

type AuditService 

type AuditService struct {
	// contains filtered or unexported fields
}

func (*AuditService) List 

func (s *AuditService) List(ctx context.Context, req structs.ListAuditRequest) ([]structs.AuditEvent, *structs.CursorMeta, error)

func (*AuditService) Record 

func (s *AuditService) Record(ctx context.Context, adminID, action, targetType, targetID string, metadata map[string]any) error

type AuditServiceInterface 

type AuditServiceInterface interface {
	Record(ctx context.Context, adminID, action, targetType, targetID string, metadata map[string]any) error
	List(ctx context.Context, req structs.ListAuditRequest) ([]structs.AuditEvent, *structs.CursorMeta, error)
}

func NewAuditService 

func NewAuditService(auditRepo repo.AuditRepoInterface) AuditServiceInterface

type DPoPService 

type DPoPService struct {
	// contains filtered or unexported fields
}

DPoPService delegates proof validation to the shared dpop.Validator so the token-issuing endpoints enforce exactly the same rules as the middleware.

func NewDPoPService 

func NewDPoPService(c cache.Cache) *DPoPService

func (*DPoPService) Validate 

func (s *DPoPService) Validate(ctx context.Context, r *http.Request) (*dpop.Proof, string, error)

func (*DPoPService) Validator 

func (s *DPoPService) Validator() *dpop.Validator

type DPoPServiceInterface 

type DPoPServiceInterface interface {
	Validate(ctx context.Context, r *http.Request) (*dpop.Proof, string, error)
	Validator() *dpop.Validator
}

DPoPServiceInterface validates DPoP proofs and issues nonces.

type JwksService 

type JwksService struct {
	// contains filtered or unexported fields
}

func NewJwksService 

func NewJwksService(repo repo.JwksRepository, log logger.Logger) *JwksService

func (*JwksService) GetActiveAccessKey 

func (s *JwksService) GetActiveAccessKey(ctx context.Context) (*domain.SigningKey, error)

func (*JwksService) GetActiveRefreshKey 

func (s *JwksService) GetActiveRefreshKey(ctx context.Context) (*domain.SigningKey, error)

func (*JwksService) GetJwkSet 

func (s *JwksService) GetJwkSet(ctx context.Context) (jwk.Set, error)

func (*JwksService) GetPublicKey 

func (s *JwksService) GetPublicKey(ctx context.Context, kid string) (*ecdsa.PublicKey, error)

func (*JwksService) GetRefreshKeyByKid 

func (s *JwksService) GetRefreshKeyByKid(ctx context.Context, kid string) (*domain.SigningKey, error)

GetRefreshKeyByKid loads the signing key referenced by a refresh-token JWT's kid and asserts it is a Refresh-type key. Rotated (INACTIVE) keys remain loadable so in-flight refresh tokens keep verifying until they expire.

func (*JwksService) LoadJWKS 

func (s *JwksService) LoadJWKS(ctx context.Context) error

func (*JwksService) RotateAccess 

func (s *JwksService) RotateAccess(ctx context.Context) error

func (*JwksService) RotateRefresh 

func (s *JwksService) RotateRefresh(ctx context.Context) error

type JwksServiceInterface 

type JwksServiceInterface interface {
	LoadJWKS(ctx context.Context) error
	GetJwkSet(ctx context.Context) (jwk.Set, error)
	RotateAccess(ctx context.Context) error
	RotateRefresh(ctx context.Context) error
	GetActiveAccessKey(ctx context.Context) (*domain.SigningKey, error)
	GetActiveRefreshKey(ctx context.Context) (*domain.SigningKey, error)
	GetPublicKey(ctx context.Context, kid string) (*ecdsa.PublicKey, error)
	GetRefreshKeyByKid(ctx context.Context, kid string) (*domain.SigningKey, error)
}

type JwtServiceImpl 

type JwtServiceImpl struct {
	// contains filtered or unexported fields
}

func (*JwtServiceImpl) NewAccessToken 

func (s *JwtServiceImpl) NewAccessToken(ctx context.Context, userId string, role domain.Role, jkt string) (*string, error)

type JwtServiceInterface 

type JwtServiceInterface interface {
	NewAccessToken(ctx context.Context, userId string, role domain.Role, jkt string) (*string, error)
}

func NewJwtService 

func NewJwtService(refreshService RefreshTokenServiceInterface, jwksService JwksServiceInterface) JwtServiceInterface

type RefreshTokenService 

type RefreshTokenService struct {
	Cache              cache.Cache
	Jwks               JwksServiceInterface
	RefreshTokenPrefix string
	RefreshTokenTTL    time.Duration
}

func NewRefreshTokenService 

func NewRefreshTokenService(cache cache.Cache, jwks JwksServiceInterface, prefix string, ttl time.Duration) *RefreshTokenService

func (*RefreshTokenService) CountSessions 

func (r *RefreshTokenService) CountSessions(ctx context.Context) (int64, error)

CountSessions returns the number of active session lineages.

func (*RefreshTokenService) GetLineage 

func (r *RefreshTokenService) GetLineage(ctx context.Context, lineageID string) (*structs.AdminSession, error)

GetLineage returns a single session (lineage) for inspection.

func (*RefreshTokenService) IssueRefreshToken 

func (r *RefreshTokenService) IssueRefreshToken(ctx context.Context, subject, jkt, sid string) (string, error)

func (*RefreshTokenService) ListAllSessions 

func (r *RefreshTokenService) ListAllSessions(ctx context.Context, cursorStr string, limit int) ([]structs.AdminSession, *structs.CursorMeta, error)

ListAllSessions returns a cursor-paginated page of all active sessions (lineages), newest first. It uses the global `refresh:sessions` Sorted Set so only the requested range is fetched from Redis; the cursor is deterministic on (created_at, lineage_id) to disambiguate identical timestamps.

func (*RefreshTokenService) ListSessionsByUser 

func (r *RefreshTokenService) ListSessionsByUser(ctx context.Context, userId string) ([]structs.AdminSession, error)

ListSessionsByUser returns all lineages (sessions) belonging to a user, newest first, using the per-user Sorted Set index.

func (*RefreshTokenService) RevokeLineage 

func (r *RefreshTokenService) RevokeLineage(ctx context.Context, lineageID string) error

func (*RefreshTokenService) RevokeUserSessions 

func (r *RefreshTokenService) RevokeUserSessions(ctx context.Context, userId string) error

RevokeUserSessions revokes every lineage belonging to the given user.

func (*RefreshTokenService) RotateRefreshToken 

func (r *RefreshTokenService) RotateRefreshToken(ctx context.Context, claims *structs.RefreshTokenClaims) (*structs.RotatedRefreshToken, error)

func (*RefreshTokenService) ValidateRefreshToken 

func (r *RefreshTokenService) ValidateRefreshToken(ctx context.Context, rawToken, jkt string) (*structs.RefreshTokenClaims, error)

type RefreshTokenServiceInterface 

type RefreshTokenServiceInterface interface {
	// ValidateRefreshToken performs ONLY cryptographic validation of the
	// refresh-token JWT (signature, alg, claims, signing-key type, DPoP
	// binding). It never touches Redis, so RT validation stays available during
	// a Redis outage.
	ValidateRefreshToken(ctx context.Context, rawToken, jkt string) (*structs.RefreshTokenClaims, error)
	// RotateRefreshToken signs a fresh RT for the same lineage and atomically
	// commits the rotation in Redis (consume old jti, activate new jti). It
	// returns dependency errors when Redis is unavailable — in that case NO
	// rotation state change happens.
	RotateRefreshToken(ctx context.Context, claims *structs.RefreshTokenClaims) (*structs.RotatedRefreshToken, error)
	// IssueRefreshToken signs and persists the initial RT for a new login.
	IssueRefreshToken(ctx context.Context, subject, jkt, sid string) (string, error)
	RevokeLineage(ctx context.Context, lineageID string) error
}

type UserService 

type UserService struct {
	Repo  repo.UserRepository
	Cache interface {
		Get(ctx context.Context, key string) (string, error)
	}
	JwkService     JwksServiceInterface
	RefreshService RefreshTokenServiceInterface
	// contains filtered or unexported fields
}

func NewUserService 

func NewUserService(
	userRepo repo.UserRepository,
	jwkService JwksServiceInterface,
	refreshService RefreshTokenServiceInterface,
	log logger.Logger,
	uow ...repo.UnitOfWork,
) *UserService

func (*UserService) AdminCreateUser 

func (s *UserService) AdminCreateUser(ctx context.Context, req structs.CreateAdminUserRequest) (*structs.AdminUserResponse, error)

func (*UserService) AdminDisableUser 

func (s *UserService) AdminDisableUser(ctx context.Context, id string) error

func (*UserService) AdminGetUser 

func (s *UserService) AdminGetUser(ctx context.Context, id string) (*structs.AdminUserResponse, error)

func (*UserService) AdminListUsers 

func (s *UserService) AdminListUsers(ctx context.Context, req structs.ListUsersRequest) ([]structs.AdminUserResponse, *structs.CursorMeta, error)

func (*UserService) AdminRestoreUser 

func (s *UserService) AdminRestoreUser(ctx context.Context, id string) (*structs.AdminUserResponse, error)

func (*UserService) AdminSetRole 

func (s *UserService) AdminSetRole(ctx context.Context, id, actorID, role string) error

func (*UserService) AdminUpdateUser 

func (s *UserService) AdminUpdateUser(ctx context.Context, id string, req structs.UpdateAdminUserRequest) (*structs.AdminUserResponse, error)

func (*UserService) CountUsers 

func (s *UserService) CountUsers(ctx context.Context) (int64, error)

func (*UserService) CreateOAuthUser 

func (s *UserService) CreateOAuthUser(ctx context.Context, user domain.User) error

func (*UserService) CreateUser 

func (s *UserService) CreateUser(ctx context.Context, req structs.CreateUserReq) (*domain.User, error)

func (*UserService) DeleteUser 

func (s *UserService) DeleteUser(ctx context.Context, id string) error

func (*UserService) GetUser 

func (s *UserService) GetUser(ctx context.Context, id string) (*domain.User, error)

func (*UserService) GetUserByEmail 

func (s *UserService) GetUserByEmail(ctx context.Context, email string) (*domain.User, error)

func (*UserService) Login 

func (s *UserService) Login(ctx context.Context, email string, pw string, jkt string) (*structs.TokenSet, error)

func (*UserService) UpdateUser 

func (s *UserService) UpdateUser(ctx context.Context, id string, req structs.UpdateUserReq) (*domain.User, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.