auth

Documentation

Index

• type EmailService
• type Handler
  • func NewHandler(db *db.DB, emailService EmailService) *Handler
  • func NewHandlerWithEmailService(db *db.DB, emailService *email.Service) *Handler
  • func (h *Handler) BeginPasskeyAuthentication(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) BeginPasskeyRegistration(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) CheckAuthHandler(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) DeletePasskey(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) FinishPasskeyAuthentication(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) FinishPasskeyRegistration(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) GetWebAuthnSettings(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) ListPasskeys(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) LoginHandler(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) LogoutHandler(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) RefreshTokenHandler(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) RenamePasskey(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) SetupMFAHandler(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) UpdateWebAuthnSettings(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) VerifyMFAHandler(w http.ResponseWriter, r *http.Request)
• type LDAPLoginRequest
• type LoginRequest
• type MFAHandler
  • func NewMFAHandler(db *db.DB, emailService EmailService) *MFAHandler
  • func (h *MFAHandler) DisableAuthenticator(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) DisableMFA(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) EnableMFA(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) GenerateBackupCodes(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) GetMFASettings(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) GetUserMFASettings(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) SendEmailMFACode(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) UpdatePreferredMFAMethod(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) VerifyMFACode(w http.ResponseWriter, r *http.Request)
  • func (h *MFAHandler) VerifyMFASetup(w http.ResponseWriter, r *http.Request)
• type MFASetupRequest
• type MFASetupResponse
• type MFAVerifyRequest
• type SSOHandler
  • func NewSSOHandler(database *db.DB, ssoManager *sso.Manager, ssoRepo *repository.SSORepository, ...) *SSOHandler
  • func (h *SSOHandler) GetEnabledProviders(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) LDAPLogin(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) OAuthCallback(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) OAuthStart(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) SAMLACS(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) SAMLMetadata(w http.ResponseWriter, r *http.Request)
  • func (h *SSOHandler) SAMLStart(w http.ResponseWriter, r *http.Request)

Types

type EmailService

type EmailService interface {
	SendMFACode(ctx context.Context, to string, code string) error
}

EmailService defines the interface for email operations needed by auth handlers

type Handler

type Handler struct {
	// contains filtered or unexported fields
}

Handler handles authentication-related requests

func NewHandler

func NewHandler(db *db.DB, emailService EmailService) *Handler

NewHandler creates a new auth handler

func NewHandlerWithEmailService

func NewHandlerWithEmailService(db *db.DB, emailService *email.Service) *Handler

NewHandlerWithEmailService creates a new auth handler with the concrete email service This is a convenience function for production code

func (*Handler) BeginPasskeyAuthentication

func (h *Handler) BeginPasskeyAuthentication(w http.ResponseWriter, r *http.Request)

BeginPasskeyAuthentication starts the passkey authentication process (MFA flow)

func (*Handler) BeginPasskeyRegistration

func (h *Handler) BeginPasskeyRegistration(w http.ResponseWriter, r *http.Request)

BeginPasskeyRegistration starts the passkey registration process

func (*Handler) CheckAuthHandler

func (h *Handler) CheckAuthHandler(w http.ResponseWriter, r *http.Request)

* CheckAuthHandler verifies if the current request has valid authentication. * It checks for the presence of a valid JWT token in the cookies and verifies * it exists in the database. * * Responses: * - 200: JSON response indicating authentication status * { * "authenticated": boolean * }

func (*Handler) DeletePasskey

func (h *Handler) DeletePasskey(w http.ResponseWriter, r *http.Request)

DeletePasskey removes a passkey for the current user

func (*Handler) FinishPasskeyAuthentication

func (h *Handler) FinishPasskeyAuthentication(w http.ResponseWriter, r *http.Request)

FinishPasskeyAuthentication completes the passkey authentication and logs the user in

func (*Handler) FinishPasskeyRegistration

func (h *Handler) FinishPasskeyRegistration(w http.ResponseWriter, r *http.Request)

FinishPasskeyRegistration completes the passkey registration process

func (*Handler) GetWebAuthnSettings

func (h *Handler) GetWebAuthnSettings(w http.ResponseWriter, r *http.Request)

GetWebAuthnSettings returns the current WebAuthn settings (for admin)

func (*Handler) ListPasskeys

func (h *Handler) ListPasskeys(w http.ResponseWriter, r *http.Request)

ListPasskeys returns all passkeys for the current user

func (*Handler) LoginHandler

func (h *Handler) LoginHandler(w http.ResponseWriter, r *http.Request)

* LoginHandler processes user login requests. * It validates credentials, generates a JWT token, and sets a secure cookie. * * Request body expects JSON: * { * "username": "string", * "password": "string" * } * * Responses: * - 200: Successfully logged in, sets auth cookie * - 400: Invalid request format * - 401: Invalid credentials * - 500: Server error (token generation/storage)

func (*Handler) LogoutHandler

func (h *Handler) LogoutHandler(w http.ResponseWriter, r *http.Request)

* LogoutHandler processes user logout requests. * It removes the token from the database and invalidates the auth cookie. * * Responses: * - 200: Successfully logged out * - 500: Error removing token from database

func (*Handler) RefreshTokenHandler

func (h *Handler) RefreshTokenHandler(w http.ResponseWriter, r *http.Request)

* RefreshTokenHandler generates a new JWT token for the authenticated user. * This extends the session without requiring re-login. * * This handler: * - Returns immediately for auto-refresh requests (X-Auto-Refresh header) * - Uses SwapTokenWithGrace for manual refresh (old token valid 5 more minutes) * - Checks concurrent session limits and revokes oldest if needed * - Checks absolute session timeout * - Preserves session_started_at across token refresh * * Responses: * - 200: New token generated and cookie set (or success for auto-refresh) * - 401: Authentication required or session expired * - 500: Internal server error

func (*Handler) RenamePasskey

func (h *Handler) RenamePasskey(w http.ResponseWriter, r *http.Request)

RenamePasskey renames a passkey for the current user

func (*Handler) SetupMFAHandler

func (h *Handler) SetupMFAHandler(w http.ResponseWriter, r *http.Request)

SetupMFAHandler initiates MFA setup for a user

func (*Handler) UpdateWebAuthnSettings

func (h *Handler) UpdateWebAuthnSettings(w http.ResponseWriter, r *http.Request)

UpdateWebAuthnSettings updates the WebAuthn settings (admin only)

func (*Handler) VerifyMFAHandler

func (h *Handler) VerifyMFAHandler(w http.ResponseWriter, r *http.Request)

VerifyMFAHandler verifies MFA setup or login

type LDAPLoginRequest

type LDAPLoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

LDAPLoginRequest represents the LDAP login request body

type LoginRequest

type LoginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

LoginRequest represents the expected JSON structure for login attempts

type MFAHandler

type MFAHandler struct {
	// contains filtered or unexported fields
}

MFAHandler handles MFA-related requests

func NewMFAHandler

func NewMFAHandler(db *db.DB, emailService EmailService) *MFAHandler

NewMFAHandler creates a new MFA handler

func (*MFAHandler) DisableAuthenticator

func (h *MFAHandler) DisableAuthenticator(w http.ResponseWriter, r *http.Request)

DisableAuthenticator handles the request to disable authenticator MFA for a user

func (*MFAHandler) DisableMFA

func (h *MFAHandler) DisableMFA(w http.ResponseWriter, r *http.Request)

DisableMFA handles the request to disable MFA for a user

func (*MFAHandler) EnableMFA

func (h *MFAHandler) EnableMFA(w http.ResponseWriter, r *http.Request)

EnableMFA enables MFA for a user

func (*MFAHandler) GenerateBackupCodes

func (h *MFAHandler) GenerateBackupCodes(w http.ResponseWriter, r *http.Request)

GenerateBackupCodes generates new backup codes for a user

func (*MFAHandler) GetMFASettings

func (h *MFAHandler) GetMFASettings(w http.ResponseWriter, r *http.Request)

GetMFASettings returns the MFA settings for a user

func (*MFAHandler) GetUserMFASettings

func (h *MFAHandler) GetUserMFASettings(w http.ResponseWriter, r *http.Request)

GetUserMFASettings returns the MFA settings for the authenticated user

func (*MFAHandler) SendEmailMFACode

func (h *MFAHandler) SendEmailMFACode(w http.ResponseWriter, r *http.Request)

SendEmailMFACode generates and sends a new email MFA code

func (*MFAHandler) UpdatePreferredMFAMethod

func (h *MFAHandler) UpdatePreferredMFAMethod(w http.ResponseWriter, r *http.Request)

UpdatePreferredMFAMethod updates the user's preferred MFA method

func (*MFAHandler) VerifyMFACode

func (h *MFAHandler) VerifyMFACode(w http.ResponseWriter, r *http.Request)

VerifyMFACode verifies a provided MFA code during login

func (*MFAHandler) VerifyMFASetup

func (h *MFAHandler) VerifyMFASetup(w http.ResponseWriter, r *http.Request)

VerifyMFASetup verifies the setup of authenticator-based MFA

type MFASetupRequest

type MFASetupRequest struct {
	Method string `json:"method"` // "email" or "authenticator"
}

type MFASetupResponse

type MFASetupResponse struct {
	Secret    string `json:"secret,omitempty"`    // For authenticator
	QRCode    string `json:"qrCode,omitempty"`    // For authenticator
	CodeSent  bool   `json:"codeSent,omitempty"`  // For email
	ExpiresAt string `json:"expiresAt,omitempty"` // For email
}

type MFAVerifyRequest

type MFAVerifyRequest struct {
	Method       string `json:"method"`
	Code         string `json:"code"`
	SessionToken string `json:"sessionToken"`
}

type SSOHandler

type SSOHandler struct {
	// contains filtered or unexported fields
}

SSOHandler handles SSO authentication requests

func NewSSOHandler

func NewSSOHandler(database *db.DB, ssoManager *sso.Manager, ssoRepo *repository.SSORepository, externalURL string) *SSOHandler

NewSSOHandler creates a new SSO handler

func (*SSOHandler) GetEnabledProviders

func (h *SSOHandler) GetEnabledProviders(w http.ResponseWriter, r *http.Request)

GetEnabledProviders returns the list of enabled SSO providers for the login page

func (*SSOHandler) LDAPLogin

func (h *SSOHandler) LDAPLogin(w http.ResponseWriter, r *http.Request)

LDAPLogin handles LDAP authentication

func (*SSOHandler) OAuthCallback

func (h *SSOHandler) OAuthCallback(w http.ResponseWriter, r *http.Request)

OAuthCallback handles the OAuth callback

func (*SSOHandler) OAuthStart

func (h *SSOHandler) OAuthStart(w http.ResponseWriter, r *http.Request)

OAuthStart initiates the OAuth flow

func (*SSOHandler) SAMLACS

func (h *SSOHandler) SAMLACS(w http.ResponseWriter, r *http.Request)

SAMLACS handles the SAML Assertion Consumer Service

func (*SSOHandler) SAMLMetadata

func (h *SSOHandler) SAMLMetadata(w http.ResponseWriter, r *http.Request)

SAMLMetadata returns the SAML SP metadata

func (*SSOHandler) SAMLStart

func (h *SSOHandler) SAMLStart(w http.ResponseWriter, r *http.Request)

SAMLStart initiates the SAML flow