security

Documentation

Index

• func Decrypt(ciphertext []byte, key [32]byte) (plaintext []byte, err error)
• func Encrypt(plaintext []byte, key [32]byte) (ciphertext []byte)
• func GenerateKey() [32]byte
• func Getenv(key string) (out [32]byte)
• func Hash(tag string, data []byte) (sum []byte)
• func IsPasswordValid(ciphertext, plaintext []byte) bool
• func NewClient(certFile, keyFile, caFile string) *http.Client
• func NewServer(mux *http.ServeMux) *http.Server
• func NewServerWithTLS(mux *http.ServeMux, domains ...string) *http.Server
• func OAuthCallback(homePath string, sessions *ServerSessions) http.HandlerFunc
• func OAuthLogin(w http.ResponseWriter, r *http.Request)
• func Password(plaintext []byte) ([]byte, error)
• type ServerSession
• type ServerSessions
  • func Mux(ctx context.Context, efs embed.FS) (mux *http.ServeMux, serverSessions *ServerSessions)
  • func NewServerSessions() *ServerSessions
  • func (a *ServerSessions) Get(sessionID string) (*ServerSession, bool)
  • func (a *ServerSessions) Update(info ServerSession) (sessionID string)

Functions

func Decrypt

func Decrypt(ciphertext []byte, key [32]byte) (plaintext []byte, err error)

Decrypt takes an encrypted byte slice (ciphertext) and a 256-bit AES key, and decrypts the ciphertext using AES-GCM.

func Encrypt

func Encrypt(plaintext []byte, key [32]byte) (ciphertext []byte)

Encrypt takes an input byte slice (plaintext) and encrypts it using AES-GCM. It returns the encrypted data (ciphertext) and the key used for encryption.

func GenerateKey

func GenerateKey() [32]byte

GenerateKey generates a 256-bit (32-byte) random key for AES encryption. It uses a cryptographically secure random number generator.

func Getenv

func Getenv(key string) (out [32]byte)

Getenv retrieves an environment variable by the given key, interprets its value as a hexadecimal string, and decodes it into a 32-byte array. If the environment variable is not set, the value is not a valid hex string, or the decoded byte length is not 32, the function returns an empty array.

func Hash

func Hash(tag string, data []byte) (sum []byte)

Hash generates an HMAC hash using the SHA-512/256 algorithm.

func IsPasswordValid

func IsPasswordValid(ciphertext, plaintext []byte) bool

IsPasswordValid checks if a given plaintext password matches a hashed password.

func NewClient

func NewClient(certFile, keyFile, caFile string) *http.Client

NewClient creates and returns a new *http.Client configured for mutual TLS authentication.

func NewServer

func NewServer(mux *http.ServeMux) *http.Server

NewServer creates and returns a configured HTTP server.

func NewServerWithTLS

func NewServerWithTLS(mux *http.ServeMux, domains ...string) *http.Server

NewServerWithTLS creates and returns a configured HTTP server with the given TLS configuration.

func OAuthCallback

func OAuthCallback(homePath string, sessions *ServerSessions) http.HandlerFunc

OAuthLogin is the handler for the /github/login route.

func OAuthLogin

func OAuthLogin(w http.ResponseWriter, r *http.Request)

OAuthLogin redirects the user to the GitHub login page.

func Password

func Password(plaintext []byte) ([]byte, error)

Password hashes a plaintext password using bcrypt with a cost of 14.

Types

type ServerSession

type ServerSession struct {
	ID        string `json:"id"`
	AvatarURL string `json:"avatar_url"`
	Name      string `json:"name"`
}

ServerSession is a session for a user.

type ServerSessions

type ServerSessions struct {
	// contains filtered or unexported fields
}

ServerSessions is a thread-safe map of email addresses to tokens.

func Mux

func Mux(ctx context.Context, efs embed.FS) (mux *http.ServeMux, serverSessions *ServerSessions)

Mux creates a new mux with the liveness check endpoint (/liveness) and the readiness check endpoint (/readiness). It also adds an authentication endpoint (/auth/callback) and a login endpoint (/auth/login). The mux is returned along with a new ServerSessions instance.

func NewServerSessions

func NewServerSessions() *ServerSessions

NewServerSessions creates a new serverSessions.

func (*ServerSessions) Get

func (a *ServerSessions) Get(sessionID string) (*ServerSession, bool)

Get returns the session for the given sessionID.

func (*ServerSessions) Update

func (a *ServerSessions) Update(info ServerSession) (sessionID string)

Update adds a new session to the serverSessions.