auth

package
v0.0.0-...-31b1c06 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: MIT Imports: 28 Imported by: 0

Documentation

Overview

Package auth provides authentication functionality for SesameFS

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrSessionInvalid  = errors.New("invalid session")
	ErrSessionNotFound = errors.New("session not found")
	ErrSessionExpired  = errors.New("session has expired")
	ErrSessionRevoked  = errors.New("session revoked")
)

Functions

func IsSessionExpired 

func IsSessionExpired(err error) bool

func IsSessionInvalid 

func IsSessionInvalid(err error) bool

func IsSessionNotFound 

func IsSessionNotFound(err error) bool

func IsSessionRevoked 

func IsSessionRevoked(err error) bool

Types

type AuthResult 

type AuthResult struct {
	UserID       string
	OrgID        string
	Email        string
	Name         string
	Role         string
	SessionToken string
	ExpiresAt    time.Time
	IsNewUser    bool
	ReturnURL    string // Original return URL from the auth state (carries sso_token for desktop client)
}

AuthResult represents the result of a successful authentication

type AuthState 

type AuthState struct {
	State        string
	Nonce        string
	CodeVerifier string // For PKCE
	RedirectURI  string
	CreatedAt    time.Time
	ReturnURL    string // Where to redirect after successful auth
}

AuthState holds the state for an ongoing authorization request

type DepartmentClaim 

type DepartmentClaim struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	ParentID string `json:"parent_id,omitempty"`
}

DepartmentClaim represents a department membership from OIDC claims.

type GroupClaim 

type GroupClaim struct {
	ID   string `json:"id"`   // External group ID
	Name string `json:"name"` // Group display name
}

GroupClaim represents a group membership from OIDC claims.

type IDTokenClaims 

type IDTokenClaims struct {
	// Standard OIDC claims
	Issuer    string `json:"iss"`
	Subject   string `json:"sub"`
	Audience  string `json:"aud"`
	ExpiresAt int64  `json:"exp"`
	IssuedAt  int64  `json:"iat"`
	Nonce     string `json:"nonce,omitempty"`

	// Profile claims
	Name              string `json:"name,omitempty"`
	GivenName         string `json:"given_name,omitempty"`
	FamilyName        string `json:"family_name,omitempty"`
	PreferredUsername string `json:"preferred_username,omitempty"`
	Picture           string `json:"picture,omitempty"`

	// Email claims
	Email         string `json:"email,omitempty"`
	EmailVerified bool   `json:"email_verified,omitempty"`

	// Custom claims (will be extracted dynamically)
	Extra map[string]interface{} `json:"-"`
}

IDTokenClaims represents the claims in an OIDC ID token

type OIDCClient 

type OIDCClient struct {
	// contains filtered or unexported fields
}

OIDCClient handles OIDC authentication flows

func NewOIDCClient 

func NewOIDCClient(appCfg *config.Config, database *db.DB, sessions *SessionManager) *OIDCClient

NewOIDCClient creates a new OIDC client

func (*OIDCClient) AllowPrivateIPsForTesting 

func (c *OIDCClient) AllowPrivateIPsForTesting()

AllowPrivateIPsForTesting disables the DNS-rebinding guard so tests that use httptest.Server on 127.0.0.1 can exercise the OIDC flow end-to-end. Never enable this in production code.

func (*OIDCClient) ExchangeCode 

func (c *OIDCClient) ExchangeCode(ctx context.Context, code, state, redirectURI string) (*AuthResult, error)

ExchangeCode exchanges an authorization code for tokens

func (*OIDCClient) GetAuthorizationURL 

func (c *OIDCClient) GetAuthorizationURL(ctx context.Context, redirectURI, returnURL string) (string, error)

GetAuthorizationURL returns the URL to redirect users to for authentication

func (*OIDCClient) GetDiscovery 

func (c *OIDCClient) GetDiscovery(ctx context.Context) (*OIDCDiscovery, error)

GetDiscovery fetches and caches the OIDC discovery document

func (*OIDCClient) GetLogoutURL 

func (c *OIDCClient) GetLogoutURL(ctx context.Context, idToken, postLogoutRedirectURI string) (string, error)

GetLogoutURL returns the URL to redirect users to for logout

func (*OIDCClient) IsEnabled 

func (c *OIDCClient) IsEnabled() bool

IsEnabled returns whether OIDC authentication is enabled

func (*OIDCClient) StopStateSweeper 

func (c *OIDCClient) StopStateSweeper()

StopStateSweeper halts the background sweeper. Safe to call multiple times.

type OIDCDiscovery 

type OIDCDiscovery struct {
	Issuer                string   `json:"issuer"`
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	TokenEndpoint         string   `json:"token_endpoint"`
	UserInfoEndpoint      string   `json:"userinfo_endpoint"`
	JwksURI               string   `json:"jwks_uri"`
	ScopesSupported       []string `json:"scopes_supported"`
	ClaimsSupported       []string `json:"claims_supported"`
	EndSessionEndpoint    string   `json:"end_session_endpoint"`
}

OIDCDiscovery represents the OIDC discovery document

type Session 

type Session struct {
	Token            string    `json:"token"`
	UserID           string    `json:"user_id"`
	OrgID            string    `json:"org_id"`
	Email            string    `json:"email"`
	Role             string    `json:"role"`
	CreatedAt        time.Time `json:"created_at"`
	ExpiresAt        time.Time `json:"expires_at"`
	APIKeyScope      string    `json:"-"`
	SourceAPIKeyHash string    `json:"-"`
}

Session represents an authenticated user session

type SessionClaims 

type SessionClaims struct {
	jwt.RegisteredClaims
	UserID      string `json:"user_id"`
	OrgID       string `json:"org_id"`
	Email       string `json:"email"`
	Role        string `json:"role"`
	APIKeyScope string `json:"api_key_scope,omitempty"`
}

SessionClaims represents the JWT claims for a session token

type SessionManager 

type SessionManager struct {
	// contains filtered or unexported fields
}

SessionManager handles session creation and validation

func NewSessionManager 

func NewSessionManager(cfg *config.OIDCConfig, database *db.DB) *SessionManager

NewSessionManager creates a new session manager

func (*SessionManager) CreateAPITokenSession 

func (sm *SessionManager) CreateAPITokenSession(userID, orgID, email, role string) (*Session, error)

CreateAPITokenSession creates a long-lived session for desktop/mobile sync clients. Seafile/SeaDrive clients don't support token refresh, so this uses APITokenTTL (default 180 days).

func (*SessionManager) CreateAPITokenSessionFromAPIKey 

func (sm *SessionManager) CreateAPITokenSessionFromAPIKey(userID, orgID, email, role, sourceAPIKeyHash, apiKeyScope string, apiKeyExpiresAt *time.Time) (*Session, error)

CreateAPITokenSessionFromAPIKey creates a long-lived session derived from an API key exchange.

func (*SessionManager) CreateSession 

func (sm *SessionManager) CreateSession(userID, orgID, email, role string) (*Session, error)

CreateSession creates a new session for a user using the default SessionTTL (web sessions).

func (*SessionManager) CreateSessionWithTTL 

func (sm *SessionManager) CreateSessionWithTTL(userID, orgID, email, role string, ttl time.Duration) (*Session, error)

CreateSessionWithTTL creates a new session with a custom TTL.

func (*SessionManager) InvalidateAPIKeySessions 

func (sm *SessionManager) InvalidateAPIKeySessions(apiKeyHash string) error

InvalidateAPIKeySessions invalidates all sessions minted from a specific API key.

func (*SessionManager) InvalidateOrgSessions 

func (sm *SessionManager) InvalidateOrgSessions(orgID string) error

InvalidateOrgSessions invalidates all active sessions for an organization.

func (*SessionManager) InvalidateSession 

func (sm *SessionManager) InvalidateSession(token string) error

InvalidateSession invalidates a session token

func (*SessionManager) InvalidateUserSessions 

func (sm *SessionManager) InvalidateUserSessions(orgID, userID string) error

InvalidateUserSessions invalidates ALL sessions for a given user. Used when a user is deactivated or deleted so the middleware doesn't need per-request status checks.

func (*SessionManager) ValidateSession 

func (sm *SessionManager) ValidateSession(token string) (*Session, error)

ValidateSession validates a session token and returns the session

type TokenResponse 

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token,omitempty"`
	IDToken      string `json:"id_token,omitempty"`
	Scope        string `json:"scope,omitempty"`
}

TokenResponse represents the OIDC token endpoint response

type UserInfo 

type UserInfo struct {
	Subject       string   `json:"sub"`
	Email         string   `json:"email"`
	EmailVerified bool     `json:"email_verified"`
	Name          string   `json:"name"`
	Picture       string   `json:"picture"`
	Locale        string   `json:"locale"`
	OrgID         string   `json:"org_id,omitempty"` // Extracted from custom claim
	Roles         []string `json:"roles,omitempty"`  // Extracted from custom claim
}

UserInfo represents the user information from OIDC

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.