goauth

package module

Go to main page

Versions in this module

v0

v0.15.0

Oct 22, 2026

v0.14.0

Oct 20, 2026

Changes in this version

type Runtime

+ func (r *Runtime) RequestEmailChangeWithPreviousEmailNotice(ctx context.Context, subjectID SubjectID, newEmail, previousEmail string) error

v0.13.0

Oct 18, 2026

v0.12.0

Oct 18, 2026

Changes in this version

type Runtime

+ func (r *Runtime) ProvisionExternalIdentity(ctx context.Context, external ExternalIdentity) (Account, error)

v0.11.0

Oct 18, 2026

Changes in this version

+ const AssistedRecoveryLifetime

+ var ErrAssistedRecoveryDenied = errors.New("assisted recovery denied")

+ var ErrAssistedRecoveryUnavailable = errors.New("assisted recovery unavailable")

+ func AssistedRecoveryOwnerConfirmation(subject SubjectID, email string) string

+ type AssistedRecovery struct

+ func NewAssistedRecovery(runtime *Runtime, authorization AssistedRecoveryAuthorization, ...) (*AssistedRecovery, error)

+ func NewScopedAssistedRecovery(runtime *Runtime, authorization AssistedRecoveryAuthorization, ...) (*AssistedRecovery, error)

+ func (s *AssistedRecovery) Complete(ctx context.Context, request AssistedRecoveryCompletion) error

+ func (s *AssistedRecovery) Initiate(ctx context.Context, request AssistedRecoveryRequest) error

+ func (s *AssistedRecovery) InitiateOwner(ctx context.Context, request AssistedRecoveryOwnerRequest, ...) error

+ type AssistedRecoveryAuthorization interface

+ AuthorizeAssistedRecovery func(ctx context.Context, auth AuthContext, subject SubjectID, ...) error

+ type AssistedRecoveryCompletion struct

+ Code string

+ NewPassword string

+ Token string

+ type AssistedRecoveryOwnerAuthorization interface

+ AuthorizeOwnerAssistedRecovery func(ctx context.Context, subject SubjectID) error

+ type AssistedRecoveryOwnerRequest struct

+ Confirmation string

+ NewEmail string

+ Reason string

+ SubjectID SubjectID

+ type AssistedRecoveryRecord struct

+ ActorID SubjectID

+ CreatedAt time.Time

+ Digest SecretDigest

+ ExpiresAt time.Time

+ NewEmail string

+ OldEmail string

+ OwnerCLI bool

+ Scope string

+ SecurityVersion int64

+ Selector string

+ SubjectID SubjectID

+ TargetVersion int64

+ type AssistedRecoveryRequest struct

+ Auth AuthContext

+ Code string

+ EvidenceReference string

+ NewEmail string

+ Password string

+ Reason string

+ SubjectID SubjectID

+ type AssistedRecoveryStore interface

+ CompleteAssistedRecovery func(ctx context.Context, record AssistedRecoveryRecord, passwordPHC string, ...) (Account, error)

+ CreateAssistedRecovery func(ctx context.Context, record AssistedRecoveryRecord) error

+ FindAssistedRecoverySubject func(ctx context.Context, selector string) (SubjectID, error)

+ LockAssistedRecovery func(ctx context.Context, selector string) (AssistedRecoveryRecord, error)

+ type AssistedRecoveryTarget interface

+ PrepareAssistedRecoveryPassword func(ctx context.Context, subject SubjectID, password string) (string, error)

+ ReadAssistedRecoveryTarget func(ctx context.Context, subject SubjectID) (AssistedRecoveryTargetSnapshot, error)

+ ReplaceAssistedRecoveryTarget func(ctx context.Context, subject SubjectID, ...) error

+ VerifyAssistedRecoveryFactor func(ctx context.Context, subject SubjectID, code string, now time.Time) (bool, error)

+ type AssistedRecoveryTargetSnapshot struct

+ Email string

+ Version int64

v0.10.0

Oct 15, 2026

Changes in this version

+ type NotificationDiagnostic struct

+ Code string

+ HTTPStatus int

+ Outcome string

+ type NotificationDiagnosticError interface

+ NotificationDiagnostic func() NotificationDiagnostic

v0.9.0

Oct 14, 2026

v0.8.0

Oct 12, 2026

Changes in this version

+ const MFALoginLifetime

+ var ErrEmailChangeScopeUnavailable = errors.New("email change scope is unavailable")

+ var ErrMFALoginDenied = errors.New("MFA login denied")

+ var ErrMFARequired = errors.New("second factor required")

+ var ErrMFAUnavailable = errors.New("MFA unavailable")

+ func IsMFARecoveryCode(code string) bool

+ func MFATOTPStep(secret, code string, now time.Time) (int64, bool, error)

+ func NewMFALoginID() (string, error)

+ func NewMFARecoveryCode() (string, error)

+ func PasswordResetNotificationContext(ctx context.Context, notification Notification) (context.Context, error)

+ func PasswordResetScope(ctx context.Context) string

+ func ValidateMFALoginPending(pending MFALoginPending, account Account, factor MFAFactorRecord, realm Realm, ...) error

+ func WithEmailChangeScope(ctx context.Context, scope EmailChangeScope) context.Context

+ func WithPasswordResetScope(ctx context.Context, scope string) (context.Context, error)

type Config

+ EmailChangeTargets map[EmailChangeScope]EmailChangeTarget

+ MFAKeys *KeyRing

+ MFAMode MFAMode

type EmailChangeRecord

+ ExpectedSecurityVersion int64

+ Scope EmailChangeScope

+ TargetSnapshot EmailChangeTargetSnapshot

+ type EmailChangeScope string

+ func EmailChangeScopeFromContext(ctx context.Context) EmailChangeScope

+ type EmailChangeTarget interface

+ ApplyVerifiedEmailChange func(ctx context.Context, subject SubjectID, expected EmailChangeTargetSnapshot, ...) error

+ SnapshotEmailChangeTarget func(ctx context.Context, subject SubjectID) (EmailChangeTargetSnapshot, error)

+ type EmailChangeTargetSnapshot struct

+ NormalizedEmail string

+ Version int64

type EmailChangeVerifyRequest

+ ExpectedSecurityVersion int64

+ RecordID string

+ Scope EmailChangeScope

+ type LocalLoginResult struct

+ Login LoginResult

+ Pending *MFALoginChallenge

+ type MFAChangeRequest struct

+ Auth AuthContext

+ Code string

+ Password string

+ type MFAEnrollment struct

+ ExpiresAt time.Time

+ ID string

+ RecoveryCodes []string

+ Secret string

+ URL string

+ type MFAEnrollmentConfirmRequest struct

+ Auth AuthContext

+ Binding [32]byte

+ Code string

+ EnrollmentID string

+ Password string

+ type MFAEnrollmentRecord struct

+ Binding [32]byte

+ Ciphertext []byte

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ KeyID string

+ Revision int64

+ SecurityVersion int64

+ SessionID string

+ SubjectID SubjectID

+ type MFAEnrollmentRequest struct

+ Auth AuthContext

+ Binding [32]byte

+ CurrentCode string

+ Password string

+ type MFAEnrollmentStore interface

+ CancelMFAEnrollment func(ctx context.Context, subject SubjectID, sessionID string, binding [32]byte) error

+ EnsureMFAFactor func(ctx context.Context, subject SubjectID) (MFAFactorRecord, error)

+ InvalidateMFAState func(ctx context.Context, subject SubjectID) error

+ LockMFAEnrollment func(ctx context.Context, subject SubjectID) (MFAEnrollmentRecord, error)

+ ReplaceMFAFactor func(ctx context.Context, subject SubjectID, previous, next MFAFactorRecord) (bool, error)

+ ReplaceMFARecovery func(ctx context.Context, subject SubjectID, digests [][]byte) error

+ SaveMFAEnrollment func(ctx context.Context, enrollment MFAEnrollmentRecord) error

+ type MFAFactorCodec struct

+ func NewMFAFactorCodec(keys KeyRing, domain string) (*MFAFactorCodec, error)

+ func (c *MFAFactorCodec) CheckKey(keyID string) error

+ func (c *MFAFactorCodec) Open(subject SubjectID, factor, keyID string, ciphertext []byte) ([]byte, error)

+ func (c *MFAFactorCodec) RecoveryDigest(subject SubjectID, factor, code string) ([]byte, error)

+ func (c *MFAFactorCodec) Seal(subject SubjectID, factor, secret string) (string, []byte, error)

+ type MFAFactorDecision uint8

+ const MFAFactorDenied

+ const MFAFactorRateLimited

+ const MFAFactorVerified

+ func ConsumeMFAFactorLocked(ctx context.Context, store MFAFactorStore, codec *MFAFactorCodec, ...) (MFAFactorDecision, error)

+ func VerifyMFAFactorLocked(ctx context.Context, store MFAFactorStore, codec *MFAFactorCodec, ...) (MFAFactorDecision, error)

+ type MFAFactorRecord struct

+ Ciphertext []byte

+ Enabled bool

+ ID string

+ KeyID string

+ LastStep int64

+ Revision int64

+ type MFAFactorStore interface

+ AdvanceMFAStep func(ctx context.Context, subject SubjectID, factorID string, ...) (bool, error)

+ ConsumeMFARecovery func(ctx context.Context, subject SubjectID, factorID string, revision int64, ...) (bool, error)

+ LockMFAFactor func(ctx context.Context, subject SubjectID) (MFAFactorRecord, error)

+ TakeMFAAttempt func(ctx context.Context, subject SubjectID) (bool, error)

+ type MFALocalAdmissionStore interface

+ LocalMFARequired func(ctx context.Context, subject SubjectID) (bool, error)

+ type MFALoginChallenge struct

+ ExpiresAt time.Time

+ ID string

+ Kind MFALoginKind

+ type MFALoginKind string

+ const MFALoginKindEnrollment

+ const MFALoginKindFactor

+ type MFALoginPending struct

+ AuthenticatedAt time.Time

+ BindingDigest [32]byte

+ ExpiresAt time.Time

+ FactorID string

+ FactorRevision int64

+ ID string

+ Kind MFALoginKind

+ Realm Realm

+ SecurityVersion int64

+ Setup MFALoginSetup

+ SubjectID SubjectID

+ type MFALoginSetup struct

+ Ciphertext []byte

+ ID string

+ KeyID string

+ RecoveryDigests [][]byte

+ type MFAMode string

+ const MFAModeOptional

+ const MFAModeRequired

+ type MFARequiredStore interface

+ AdmitRequiredMFASession func(ctx context.Context, session Session) error

+ MarkMFASessionAdmission func(ctx context.Context, session Session, admission MFASessionAdmission) error

+ SaveMFALoginSetup func(ctx context.Context, pending MFALoginPending, setup MFALoginSetup) error

+ type MFASessionAdmission string

+ const MFASessionAdmissionExternal

+ const MFASessionAdmissionFactor

+ type MFAStore interface

+ ConsumeMFALogin func(ctx context.Context, pending MFALoginPending) (bool, error)

+ CreateMFALogin func(ctx context.Context, pending MFALoginPending) error

+ FindMFALoginSubject func(ctx context.Context, id string) (SubjectID, error)

+ LockMFALogin func(ctx context.Context, id string) (MFALoginPending, error)

type PendingEmailChange

+ ExpectedSecurityVersion int64

+ NewNormalizedValue string

+ Scope EmailChangeScope

+ TargetSnapshot EmailChangeTargetSnapshot

+ type PreparedPasswordChange struct

+ func (PreparedPasswordChange) GoString() string

+ func (PreparedPasswordChange) String() string

type Runtime

+ func (r *Runtime) BeginLocalLogin(ctx context.Context, request LoginRequest, binding [32]byte) (LocalLoginResult, error)

+ func (r *Runtime) BeginLocalLoginEnrollment(ctx context.Context, id string, binding [32]byte) (MFAEnrollment, error)

+ func (r *Runtime) BeginMFAEnrollment(ctx context.Context, request MFAEnrollmentRequest) (MFAEnrollment, error)

+ func (r *Runtime) CancelMFAEnrollment(ctx context.Context, auth AuthContext, binding [32]byte) error

+ func (r *Runtime) CompleteLocalLogin(ctx context.Context, id string, binding [32]byte, code string) (LoginResult, error)

+ func (r *Runtime) CompleteLocalLoginEnrollment(ctx context.Context, id, enrollmentID string, binding [32]byte, code string) (LoginResult, error)

+ func (r *Runtime) CompletePasswordChange(ctx context.Context, subjectID SubjectID, proof *PreparedPasswordChange) (Account, error)

+ func (r *Runtime) ConfirmMFAEnrollment(ctx context.Context, request MFAEnrollmentConfirmRequest) ([]string, error)

+ func (r *Runtime) DisableMFA(ctx context.Context, request MFAChangeRequest) error

+ func (r *Runtime) MFAMode() MFAMode

+ func (r *Runtime) MFAStatus(ctx context.Context, auth AuthContext) (bool, error)

+ func (r *Runtime) PreparePasswordChange(ctx context.Context, request ChangePasswordRequest) (*PreparedPasswordChange, error)

+ func (r *Runtime) PreparePasswordChangeWithIssuer(ctx context.Context, request ChangePasswordRequest, issuer *Runtime) (*PreparedPasswordChange, error)

+ func (r *Runtime) RegenerateMFARecovery(ctx context.Context, request MFAChangeRequest) ([]string, error)

+ type ScopedEmailChangeStore interface

+ GetPendingScopedEmailChange func(ctx context.Context, subject SubjectID, scope EmailChangeScope, now time.Time) (PendingEmailChange, error)

+ IssueScopedEmailChange func(ctx context.Context, record EmailChangeRecord, limits EmailChallengeLimits) (EmailChangeIssueResult, error)

+ VerifyScopedEmailChange func(ctx context.Context, request EmailChangeVerifyRequest) (EmailChangeVerifyResult, error)

v0.7.0

Oct 10, 2026

Changes in this version

type CommonPasswordChecker

+ func NewLocalCommonPasswordChecker(passwords []string, options ...LocalCommonPasswordCheckerOption) (CommonPasswordChecker, error)

type Config

+ PasswordResetRecipientResolver PasswordResetRecipientResolver

+ type LocalCommonPasswordCheckerOption func(*localCommonPasswordCheckerConfig)

+ func WithBuiltInCommonPasswords() LocalCommonPasswordCheckerOption

+ type PasswordResetRecipientResolver interface

+ LookupPasswordResetSubject func(ctx context.Context, normalizedEmail string) (SubjectID, error)

+ PreparePasswordResetPassword func(ctx context.Context, account Account, newPassword string) (string, error)

+ ResolvePasswordResetRecipient func(ctx context.Context, account Account, requestedEmail string) (string, error)

+ type PasswordResetSubjectStore interface

+ ConsumePasswordResetWithPreparation func(ctx context.Context, request PasswordResetConsumeRequest, ...) (PasswordResetConsumeResult, error)

+ CreatePasswordResetForSubject func(ctx context.Context, record PasswordResetRecord) error

v0.6.0

Oct 6, 2026

Changes in this version

+ var ErrIdentifierUnchanged = errors.New("local identifier is unchanged")

+ var ErrLocalIdentifierConflict = errors.New("local primary identifier is missing or changed")

+ var ErrLocalIdentifierUnsupported = errors.New("local identifier read capability is not supported")

+ var ErrLocalIdentityRenameUnsupported = errors.New("local identity rename capability is not supported")

+ var ErrLocalIdentityRetirementUnsupported = errors.New("local identity retirement capability is not supported")

+ var ErrLocalIdentityUnsupported = errors.New("local identity capability is not supported")

+ var ErrNotificationRejected = errors.New("notification permanently rejected")

+ var ErrSubjectLifecycleUnsupported = errors.New("subject lifecycle read capability is not supported")

+ var ErrSubjectRetired = errors.New("authentication subject is permanently retired")

+ var ErrTrustedLocalPasswordUnsupported = errors.New("trusted local password capability is not supported")

type Config

+ CredentialVerificationRateLimit RateLimitPolicy

+ EnableLegacyBytes256 bool

+ type ImportLocalIdentityRequest struct

+ Identifier IdentifierInput

+ PasswordInputPolicy PasswordInputPolicy

+ PasswordPHC string

+ Profile BasicProfile

+ Status SubjectStatus

+ SubjectID SubjectID

type LocalAccountRecord

+ PasswordInputPolicy PasswordInputPolicy

+ type LocalIdentifierReader interface

+ GetLocalIdentifier func(ctx context.Context, subjectID SubjectID, scheme IdentifierScheme) (Identifier, error)

+ type LocalIdentityRecord struct

+ Identifier Identifier

+ type LocalIdentityRenameStore interface

+ RenameLocalIdentity func(ctx context.Context, request RenameLocalIdentityStoreRequest) (LocalIdentityView, error)

+ type LocalIdentityRetirementStore interface

+ RetireLocalIdentity func(ctx context.Context, request RetireLocalIdentityStoreRequest) (SubjectLifecycleView, error)

+ type LocalIdentityStore interface

+ CreateLocalIdentity func(ctx context.Context, record LocalIdentityRecord) (Account, error)

+ type LocalIdentityView struct

+ Account Account

+ Identifier Identifier

+ type PasswordInputPolicy string

+ const PasswordInputPolicyLegacyBytes256

+ const PasswordInputPolicyUnicode

+ type ProvisionLocalIdentityRequest struct

+ Identifier IdentifierInput

+ Password string

+ Profile BasicProfile

+ type RenameLocalIdentityRequest struct

+ ExpectedIdentifier IdentifierInput

+ ExpectedSecurityVersion int64

+ NewIdentifier IdentifierInput

+ SubjectID SubjectID

+ type RenameLocalIdentityStoreRequest struct

+ ExpectedNormalizedValue string

+ ExpectedSecurityVersion int64

+ NewDisplayValue string

+ NewNormalizedValue string

+ Now time.Time

+ Scheme IdentifierScheme

+ SubjectID SubjectID

+ type RetireLocalIdentityRequest struct

+ ExpectedIdentifier IdentifierInput

+ ExpectedSecurityVersion int64

+ SubjectID SubjectID

+ type RetireLocalIdentityStoreRequest struct

+ ExpectedNormalizedValue string

+ ExpectedSecurityVersion int64

+ Now time.Time

+ Scheme IdentifierScheme

+ SubjectID SubjectID

type Runtime

+ func (r *Runtime) GetLocalIdentifier(ctx context.Context, subjectID SubjectID, scheme IdentifierScheme) (Identifier, error)

+ func (r *Runtime) GetSubjectLifecycle(ctx context.Context, id SubjectID) (SubjectLifecycleView, error)

+ func (r *Runtime) ImportLocalIdentity(ctx context.Context, request ImportLocalIdentityRequest) (Account, error)

+ func (r *Runtime) ProvisionLocalIdentity(ctx context.Context, request ProvisionLocalIdentityRequest) (Account, error)

+ func (r *Runtime) RenameLocalIdentity(ctx context.Context, request RenameLocalIdentityRequest) (LocalIdentityView, error)

+ func (r *Runtime) RetireLocalIdentity(ctx context.Context, request RetireLocalIdentityRequest) (SubjectLifecycleView, error)

+ func (r *Runtime) SetTrustedLocalPassword(ctx context.Context, request SetTrustedLocalPasswordRequest) (Account, error)

type SecurityEventType

+ const SecurityEventLocalIdentityImported

+ const SecurityEventLocalIdentityProvisioned

+ const SecurityEventLocalIdentityRenamed

+ const SecurityEventSubjectRetired

+ const SecurityEventTrustedLocalPasswordSet

+ type SetTrustedLocalPasswordRequest struct

+ NewPassword string

+ SubjectID SubjectID

+ type SubjectLifecycleReader interface

+ GetSubjectLifecycle func(ctx context.Context, subjectID SubjectID) (SubjectLifecycleView, error)

+ type SubjectLifecycleView struct

+ Account Account

+ RetiredAt *time.Time

+ type TrustedLocalPasswordStore interface

+ SetTrustedLocalPassword func(ctx context.Context, request TrustedLocalPasswordStoreRequest) (Account, error)

+ type TrustedLocalPasswordStoreRequest struct

+ ExpectedPasswordInputPolicy PasswordInputPolicy

+ ExpectedPasswordPHC string

+ ExpectedSecurityVersion int64

+ NewPasswordPHC string

+ Now time.Time

+ SubjectID SubjectID

v0.5.1

Oct 3, 2026

v0.5.0

Oct 1, 2026

Changes in this version

+ const DefaultMaxConcurrentPasswordHashes

+ var ErrNotificationDeliveryDisabled = errors.New("notification delivery is disabled")

+ var ErrOperationOutcomeUnknown = errors.New("operation commit outcome is unknown")

+ var ErrPasswordHashOverloaded = errors.New("password hashing capacity exhausted")

+ var ErrPasswordVerificationUnavailable = errors.New("password verification unavailable")

+ var ErrRateLimitTransactionUnsupported = errors.New("rate-limit admission requires no active auth transaction")

type AccountStore

+ LockAccount func(ctx context.Context, subjectID SubjectID) (Account, error)

+ type AuthTransaction interface

+ InAuthTransaction func(ctx context.Context, fn func(context.Context) error) error

type Config

+ AuthTransaction AuthTransaction

+ AutoLinkVerifiedEmailIssuers []string

+ MaxConcurrentPasswordHashes int

+ NotificationDelivery NotificationDeliveryPolicy

type NotificationDelivery

+ EncryptedEvent EncryptedEvent

+ type NotificationDeliveryPolicy uint8

+ const NotificationDeliveryDisabled

+ const NotificationDeliveryRequired

+ type PasswordEmailChangeRequest struct

+ CurrentPassword string

+ NewEmail string

+ SubjectID SubjectID

type PasswordPolicy

+ DisableBlocklist bool

+ type PasswordResetReceipt struct

+ Selector string

+ SubjectID SubjectID

type RefreshRotationRequest

+ ExpectedEmailVerified bool

+ ExpectedNormalizedEmail string

+ ExpectedSecurityVersion int64

type Runtime

+ func (r *Runtime) AuthenticateSession(ctx context.Context, token string) (AuthContext, error)

+ func (r *Runtime) RequestEmailChangeWithPassword(ctx context.Context, request PasswordEmailChangeRequest) error

+ func (r *Runtime) RequestPasswordResetWithReceipt(ctx context.Context, email string, ...) error

+ func (r *Runtime) VerifyJWT(ctx context.Context, token string) (AuthContext, error)

type SessionStore

+ PeekRefresh func(ctx context.Context, request RefreshRotationRequest) (RefreshRotationResult, error)

v0.4.1

Sep 28, 2026

Changes in this version

+ const DefaultArgon2Iterations

+ const DefaultArgon2MemoryKiB

+ const DefaultArgon2Parallelism

+ const DefaultPasswordMaxLength

+ const DefaultPasswordMinLength

+ const MaxAccessTokenTTL

+ var ErrAccountNotFound = errors.New("account not found")

+ var ErrAccountUnavailable = errors.New("account unavailable")

+ var ErrAuthenticationRateLimited = errors.New("authentication rate limited")

+ var ErrCommonPassword = errors.New("common password is not allowed")

+ var ErrConfirmationAttempts = errors.New("confirmation attempts exhausted")

+ var ErrConfirmationExpired = errors.New("confirmation code expired")

+ var ErrConfirmationRateLimited = errors.New("confirmation rate limited")

+ var ErrConfirmationResendDelay = errors.New("wait before resending confirmation")

+ var ErrCurrentPasswordInvalid = errors.New("current password is invalid")

+ var ErrEmailChangeNotFound = errors.New("pending email change not found")

+ var ErrEmailChangeSameValue = errors.New("new email matches current email")

+ var ErrEmailVerificationRequired = errors.New("verified email required")

+ var ErrExpiredToken = errors.New("token expired")

+ var ErrExplicitIdentityLink = errors.New("explicit authenticated identity linking is required")

+ var ErrIdentifierAlreadyExists = errors.New("identifier already exists")

+ var ErrIdentityLinkConflict = errors.New("identity link conflict")

+ var ErrIdentityLinkNotFound = errors.New("identity link not found")

+ var ErrInvalidChallengePurpose = errors.New("invalid email challenge purpose")

+ var ErrInvalidConfirmationCode = errors.New("invalid confirmation code")

+ var ErrInvalidCredentials = errors.New("invalid credentials")

+ var ErrInvalidIdentifier = errors.New("invalid identifier")

+ var ErrInvalidIdentifierScheme = errors.New("invalid identifier scheme")

+ var ErrInvalidPassword = errors.New("invalid password")

+ var ErrInvalidRealm = errors.New("invalid realm")

+ var ErrInvalidSubjectID = errors.New("invalid subject ID")

+ var ErrInvalidSubjectStatus = errors.New("invalid subject status")

+ var ErrInvalidToken = errors.New("invalid token")

+ var ErrKeyPurposeCollision = errors.New("cryptographic key reused across purposes")

+ var ErrKeyRingInvalid = errors.New("invalid key ring")

+ var ErrMembershipDenied = errors.New("realm membership denied")

+ var ErrNotificationSinkRequired = errors.New("encrypted notification sink is required")

+ var ErrPasswordChangeConflict = errors.New("password changed concurrently")

+ var ErrPasswordUnchanged = errors.New("new password matches current password")

+ var ErrRealmNotRegistered = errors.New("realm is not registered")

+ var ErrRefreshReplay = errors.New("refresh token replay detected")

+ var ErrReservedAccessTokenClaim = errors.New("claims enricher set a reserved access-token claim")

+ var ErrResetAlreadyUsed = errors.New("password reset token already used")

+ var ErrSecurityVersionMismatch = errors.New("security version mismatch")

+ var ErrSessionRevoked = errors.New("session revoked")

+ var ErrURLBuilderRequired = errors.New("URL builder is required")

+ var NilSubjectID = SubjectID(uuid.Nil)

+ func NormalizeEmail(value string) (string, error)

+ type Account struct

+ PrimaryEmail Identifier

+ Profile BasicProfile

+ Subject Subject

+ func (a Account) EmailVerified() bool

+ func (a Account) IsZero() bool

+ type AccountStore interface

+ ChangePassword func(ctx context.Context, request PasswordChangeStoreRequest) (PasswordChangeStoreResult, error)

+ CreateLocalAccount func(ctx context.Context, record LocalAccountRecord) (Account, error)

+ FindAccount func(ctx context.Context, identifier IdentifierInput) (Account, error)

+ FindLocalAccount func(ctx context.Context, identifier IdentifierInput) (LocalAccountRecord, error)

+ GetAccount func(ctx context.Context, subjectID SubjectID) (Account, error)

+ GetLocalAccount func(ctx context.Context, subjectID SubjectID) (LocalAccountRecord, error)

+ UpdateBasicProfile func(ctx context.Context, subjectID SubjectID, profile BasicProfile, now time.Time) (Account, error)

+ type Argon2idConfig struct

+ Iterations uint32

+ KeyLength uint32

+ MemoryKiB uint32

+ Parallelism uint8

+ Random io.Reader

+ SaltLength uint32

+ type Argon2idHasher struct

+ func NewArgon2idHasher(config Argon2idConfig) (*Argon2idHasher, error)

+ func (h *Argon2idHasher) HashPassword(password string) (string, error)

+ func (h *Argon2idHasher) VerifyPassword(phc, password string) error

+ type AuditSink interface

+ RecordSecurityEvent func(ctx context.Context, event SecurityEvent) error

+ type AuditSinkFunc func(context.Context, SecurityEvent) error

+ func (f AuditSinkFunc) RecordSecurityEvent(ctx context.Context, event SecurityEvent) error

+ type AuthContext struct

+ Claims map[string]any

+ Realm Realm

+ Scope SessionScope

+ SecurityVersion int64

+ SessionID string

+ SubjectID SubjectID

+ type BasicProfile struct

+ DisplayName string

+ FamilyName string

+ GivenName string

+ Username string

+ type ChangePasswordRequest struct

+ CurrentPassword string

+ NewPassword string

+ SubjectID SubjectID

+ type ClaimsEnricher interface

+ EnrichClaims func(ctx context.Context, realm Realm, account Account, claims map[string]any) error

+ type ClaimsEnricherFunc func(context.Context, Realm, Account, map[string]any) error

+ func (f ClaimsEnricherFunc) EnrichClaims(ctx context.Context, realm Realm, account Account, claims map[string]any) error

+ type CommonPasswordChecker interface

+ IsCommonPassword func(password string) bool

+ type CommonPasswordCheckerFunc func(string) bool

+ func (f CommonPasswordCheckerFunc) IsCommonPassword(password string) bool

+ type Config struct

+ AccessTTL time.Duration

+ AdditionalRealms []Realm

+ AuditSink AuditSink

+ ChallengeTTL time.Duration

+ ClaimsEnricher ClaimsEnricher

+ EmailChangeTTL time.Duration

+ EnvelopeRetention time.Duration

+ EventSink EncryptedEventSink

+ IdentifierResolvers map[IdentifierScheme]IdentifierResolver

+ IdentityLinkAuthMaxAge time.Duration

+ LoginRateLimit RateLimitPolicy

+ ManagedNotificationDelivery bool

+ MembershipGate MembershipGate

+ NotificationRenderer NotificationRenderer

+ NotificationTransaction NotificationTransaction

+ Now func() time.Time

+ OutboxAEADKeys KeyRing

+ PasswordHasher PasswordHasher

+ PasswordPolicy PasswordPolicy

+ PasswordResetRateLimit RateLimitPolicy

+ PasswordResetTTL time.Duration

+ Random io.Reader

+ RefreshTTL time.Duration

+ ResetResponseFloor time.Duration

+ SessionTTL time.Duration

+ Signing SigningConfig

+ Store RuntimeStore

+ TokenHMACKeys KeyRing

+ URLBuilder URLBuilder

+ type Credential struct

+ Identifier IdentifierInput

+ Password string

+ type EmailChallengeIssueResult struct

+ RetryAt time.Time

+ Status EmailChallengeIssueStatus

+ type EmailChallengeIssueStatus string

+ const EmailChallengeDailyLimit

+ const EmailChallengeHourlyLimit

+ const EmailChallengeIssued

+ const EmailChallengeWait

+ type EmailChallengeLimits struct

+ MinResendInterval time.Duration

+ PerDay int

+ PerHour int

+ type EmailChallengePurpose string

+ const EmailChallengePurposeVerification

+ func (p EmailChallengePurpose) Validate() error

+ type EmailChallengeRecord struct

+ CreatedAt time.Time

+ Digest SecretDigest

+ ExpectedNormalizedEmail string

+ ExpectedSecurityVersion int64

+ ExpiresAt time.Time

+ ID string

+ IdentifierID string

+ MaxAttempts int

+ Purpose EmailChallengePurpose

+ RateDigest SecretDigest

+ SubjectID SubjectID

+ type EmailChallengeStore interface

+ IssueEmailChallenge func(ctx context.Context, record EmailChallengeRecord, limits EmailChallengeLimits) (EmailChallengeIssueResult, error)

+ VerifyEmailChallenge func(ctx context.Context, request EmailChallengeVerifyRequest) (EmailChallengeVerifyResult, error)

+ type EmailChallengeVerifyRequest struct

+ Digests []SecretDigest

+ Now time.Time

+ Purpose EmailChallengePurpose

+ SubjectID SubjectID

+ type EmailChallengeVerifyResult struct

+ Account Account

+ Attempts int

+ Status EmailChallengeVerifyStatus

+ type EmailChallengeVerifyStatus string

+ const EmailChallengeAlreadyVerified

+ const EmailChallengeAttemptsUsed

+ const EmailChallengeExpired

+ const EmailChallengeInvalid

+ const EmailChallengeVerified

+ type EmailChangeIssueResult struct

+ RetryAt time.Time

+ Status EmailChangeIssueStatus

+ type EmailChangeIssueStatus string

+ const EmailChangeDailyLimit

+ const EmailChangeHourlyLimit

+ const EmailChangeIssued

+ const EmailChangeSameValue

+ const EmailChangeWait

+ type EmailChangeRecord struct

+ CreatedAt time.Time

+ Digest SecretDigest

+ ExpiresAt time.Time

+ ID string

+ MaxAttempts int

+ NewDisplayValue string

+ NewNormalizedValue string

+ RateDigest SecretDigest

+ SubjectID SubjectID

+ type EmailChangeStore interface

+ GetPendingEmailChange func(ctx context.Context, subjectID SubjectID, now time.Time) (PendingEmailChange, error)

+ IssueEmailChange func(ctx context.Context, record EmailChangeRecord, limits EmailChallengeLimits) (EmailChangeIssueResult, error)

+ VerifyEmailChange func(ctx context.Context, request EmailChangeVerifyRequest) (EmailChangeVerifyResult, error)

+ type EmailChangeVerifyRequest struct

+ Digests []SecretDigest

+ Now time.Time

+ SubjectID SubjectID

+ type EmailChangeVerifyResult struct

+ Account Account

+ Attempts int

+ Status EmailChangeVerifyStatus

+ type EmailChangeVerifyStatus string

+ const EmailChangeAttemptsUsed

+ const EmailChangeExpired

+ const EmailChangeInvalid

+ const EmailChangeNotFound

+ const EmailChangeVerified

+ type EncryptedEnvelope struct

+ AdditionalData []byte

+ Ciphertext []byte

+ CreatedAt time.Time

+ DeleteAfter time.Time

+ KeyID string

+ Nonce []byte

+ type EncryptedEvent struct

+ Envelope EncryptedEnvelope

+ ID string

+ ReferenceID string

+ SubjectID SubjectID

+ Type string

+ ValidUntil time.Time

+ type EncryptedEventSink interface

+ DeleteEncrypted func(ctx context.Context, eventID string) error

+ DeleteExpiredEncrypted func(ctx context.Context, before time.Time) (int64, error)

+ EnqueueEncrypted func(ctx context.Context, event EncryptedEvent) error

+ type ExternalIdentity struct

+ Email string

+ EmailVerified bool

+ Issuer string

+ Profile BasicProfile

+ Subject string

+ type ExternalLoginRequest struct

+ Identity ExternalIdentity

+ Realm Realm

+ type Identifier struct

+ CreatedAt time.Time

+ DisplayValue string

+ ID string

+ NormalizedValue string

+ Scheme IdentifierScheme

+ SubjectID SubjectID

+ UpdatedAt time.Time

+ VerifiedAt *time.Time

+ func (i Identifier) IsVerified() bool

+ type IdentifierInput struct

+ Scheme IdentifierScheme

+ Value string

+ type IdentifierResolver interface

+ NormalizeIdentifier func(ctx context.Context, input IdentifierInput) (IdentifierInput, error)

+ type IdentifierResolverFunc func(context.Context, IdentifierInput) (IdentifierInput, error)

+ func (f IdentifierResolverFunc) NormalizeIdentifier(ctx context.Context, input IdentifierInput) (IdentifierInput, error)

+ type IdentifierScheme string

+ const IdentifierSchemeEmail

+ func (s IdentifierScheme) Validate() error

+ type IdentityLink struct

+ CreatedAt time.Time

+ EmailNormalized string

+ EmailVerified bool

+ ExternalSubject string

+ ID string

+ Issuer string

+ SubjectID SubjectID

+ UpdatedAt time.Time

+ type IdentityLinkStore interface

+ CreateSSOAccount func(ctx context.Context, record SSOAccountRecord) (Account, IdentityLink, error)

+ LinkIdentity func(ctx context.Context, link IdentityLink) (IdentityLink, error)

+ ResolveIdentityLink func(ctx context.Context, issuer, externalSubject string) (Account, IdentityLink, error)

+ type Key struct

+ ID string

+ Material []byte

+ type KeyRing struct

+ func NewKeyRing(activeKeyID string, keys ...Key) (KeyRing, error)

+ func (r KeyRing) Active() (Key, error)

+ func (r KeyRing) ActiveKeyID() string

+ func (r KeyRing) Get(keyID string) (Key, error)

+ func (r KeyRing) IDs() []string

+ type LocalAccountRecord struct

+ Account Account

+ PasswordPHC string

+ type LoginRequest struct

+ Credential Credential

+ Realm Realm

+ type LoginResult struct

+ Account Account

+ Tokens TokenPair

+ type MembershipGate interface

+ AllowMembership func(ctx context.Context, realm Realm, account Account) error

+ type MembershipGateFunc func(context.Context, Realm, Account) error

+ func (f MembershipGateFunc) AllowMembership(ctx context.Context, realm Realm, account Account) error

+ type Notification struct

+ Data map[string]string

+ Template string

+ To string

+ type NotificationDelivery struct

+ ID string

+ Notification Notification

+ ValidUntil time.Time

+ type NotificationRenderer interface

+ RenderNotification func(ctx context.Context, notification Notification) ([]byte, error)

+ type NotificationRendererFunc func(context.Context, Notification) ([]byte, error)

+ func (f NotificationRendererFunc) RenderNotification(ctx context.Context, notification Notification) ([]byte, error)

+ type NotificationSender interface

+ SendNotification func(ctx context.Context, delivery NotificationDelivery) error

+ type NotificationSenderFunc func(context.Context, NotificationDelivery) error

+ func (f NotificationSenderFunc) SendNotification(ctx context.Context, delivery NotificationDelivery) error

+ type NotificationTransaction interface

+ InNotificationTransaction func(ctx context.Context, fn func(context.Context) error) error

+ type PasswordChangeStoreRequest struct

+ ExpectedPasswordPHC string

+ NewPasswordPHC string

+ Now time.Time

+ SubjectID SubjectID

+ type PasswordChangeStoreResult struct

+ Account Account

+ Status PasswordChangeStoreStatus

+ type PasswordChangeStoreStatus string

+ const PasswordChangeStoreConflict

+ const PasswordChangeStoreMissing

+ const PasswordChangeStoreSucceeded

+ type PasswordHasher interface

+ HashPassword func(password string) (string, error)

+ VerifyPassword func(phc, password string) error

+ type PasswordPolicy struct

+ Blocklist CommonPasswordChecker

+ MaxLength int

+ MinLength int

+ func DefaultPasswordPolicy() PasswordPolicy

+ func (p PasswordPolicy) Validate(password string) error

+ type PasswordResetConsumeRequest struct

+ Digest SecretDigest

+ Now time.Time

+ PasswordPHC string

+ Selector string

+ type PasswordResetConsumeResult struct

+ Account Account

+ Status PasswordResetConsumeStatus

+ type PasswordResetConsumeStatus string

+ const PasswordResetConsumed

+ const PasswordResetExpired

+ const PasswordResetInvalid

+ const PasswordResetUsed

+ type PasswordResetRecord struct

+ CreatedAt time.Time

+ Digest SecretDigest

+ ExpectedNormalizedEmail string

+ ExpectedSecurityVersion int64

+ ExpiresAt time.Time

+ Selector string

+ SubjectID SubjectID

+ type PasswordResetStore interface

+ ConsumePasswordReset func(ctx context.Context, request PasswordResetConsumeRequest) (PasswordResetConsumeResult, error)

+ CreatePasswordReset func(ctx context.Context, record PasswordResetRecord) error

+ type PendingEmailChange struct

+ Attempts int

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ MaxAttempts int

+ NewDisplayValue string

+ SubjectID SubjectID

+ type RateLimitPolicy struct

+ Limit int

+ Window time.Duration

+ func (p RateLimitPolicy) Validate() error

+ type RateLimitRequest struct

+ Action string

+ Bucket SecretDigest

+ Limit int

+ Now time.Time

+ SubjectID SubjectID

+ Window time.Duration

+ type RateLimitResult struct

+ Allowed bool

+ RetryAt time.Time

+ type RateLimitStore interface

+ TakeRateLimit func(ctx context.Context, request RateLimitRequest) (RateLimitResult, error)

+ type Realm string

+ const RealmAdmin

+ const RealmUser

+ func (r Realm) Validate() error

+ type RefreshRotationRequest struct

+ CurrentDigest SecretDigest

+ CurrentSelector string

+ NextDigest SecretDigest

+ NextExpiresAt time.Time

+ NextSelector string

+ Now time.Time

+ type RefreshRotationResult struct

+ Account Account

+ FamilyID string

+ Session Session

+ Status RefreshRotationStatus

+ type RefreshRotationStatus string

+ const RefreshRotationExpired

+ const RefreshRotationInvalid

+ const RefreshRotationReplayed

+ const RefreshRotationRevoked

+ const RefreshRotationSucceeded

+ type RegisterRequest struct

+ Email string

+ Password string

+ Profile BasicProfile

+ type RegisterResult struct

+ Account Account

+ Tokens TokenPair

+ type Runtime struct

+ func NewRuntime(config Config) (*Runtime, error)

+ func (r *Runtime) AcknowledgeEncryptedEvent(ctx context.Context, eventID string) error

+ func (r *Runtime) ChangePassword(ctx context.Context, request ChangePasswordRequest) (Account, error)

+ func (r *Runtime) CleanupExpiredEncryptedEvents(ctx context.Context) (int64, error)

+ func (r *Runtime) ConfirmEmailChange(ctx context.Context, subjectID SubjectID, code string) (Account, error)

+ func (r *Runtime) DecryptNotificationEvent(event EncryptedEvent) (Notification, error)

+ func (r *Runtime) FindAccount(ctx context.Context, identifier IdentifierInput) (Account, error)

+ func (r *Runtime) GetAccount(ctx context.Context, subjectID SubjectID) (Account, error)

+ func (r *Runtime) LinkExternalIdentity(ctx context.Context, auth AuthContext, external ExternalIdentity) (IdentityLink, error)

+ func (r *Runtime) Login(ctx context.Context, request LoginRequest) (LoginResult, error)

+ func (r *Runtime) LoginExternal(ctx context.Context, request ExternalLoginRequest) (LoginResult, error)

+ func (r *Runtime) Logout(ctx context.Context, subjectID SubjectID, sessionID string) error

+ func (r *Runtime) LogoutAll(ctx context.Context, subjectID SubjectID) (int64, error)

+ func (r *Runtime) PendingEmailChange(ctx context.Context, subjectID SubjectID) (PendingEmailChange, error)

+ func (r *Runtime) ProvisionTrustedLocalAccount(ctx context.Context, request RegisterRequest) (Account, error)

+ func (r *Runtime) Refresh(ctx context.Context, rawRefreshToken string) (TokenPair, error)

+ func (r *Runtime) Register(ctx context.Context, request RegisterRequest) (RegisterResult, error)

+ func (r *Runtime) RequestEmailChange(ctx context.Context, subjectID SubjectID, newEmail string) error

+ func (r *Runtime) RequestPasswordReset(ctx context.Context, email string) error

+ func (r *Runtime) ResetPassword(ctx context.Context, rawToken, newPassword string) error

+ func (r *Runtime) ResolveExternalIdentity(ctx context.Context, external ExternalIdentity) (Account, error)

+ func (r *Runtime) SendEmailChallenge(ctx context.Context, subjectID SubjectID, purpose EmailChallengePurpose) error

+ func (r *Runtime) SetSubjectStatus(ctx context.Context, subjectID SubjectID, status SubjectStatus) (Subject, error)

+ func (r *Runtime) UpdateBasicProfile(ctx context.Context, subjectID SubjectID, profile BasicProfile) (Account, error)

+ func (r *Runtime) VerifyAccessToken(ctx context.Context, rawAccessToken string, introspect bool) (AuthContext, error)

+ func (r *Runtime) VerifyCredential(ctx context.Context, credential Credential) (Account, error)

+ func (r *Runtime) VerifyEmailChallenge(ctx context.Context, subjectID SubjectID, purpose EmailChallengePurpose, ...) (Account, error)

+ type RuntimeStore interface

+ type SSOAccountRecord struct

+ Account Account

+ Link IdentityLink

+ type SecretDigest struct

+ Digest []byte

+ KeyID string

+ type SecurityEvent struct

+ At time.Time

+ Attributes map[string]string

+ Realm Realm

+ SubjectID SubjectID

+ Type SecurityEventType

+ type SecurityEventType string

+ const SecurityEventEmailChallengeIssued

+ const SecurityEventEmailChangeIssued

+ const SecurityEventEmailChanged

+ const SecurityEventEmailVerified

+ const SecurityEventIdentityLinked

+ const SecurityEventLoginFailed

+ const SecurityEventPasswordChanged

+ const SecurityEventPasswordResetIssued

+ const SecurityEventPasswordResetUsed

+ const SecurityEventRefreshReplay

+ const SecurityEventSessionRevoked

+ const SecurityEventSessionsRevoked

+ const SecurityEventSubjectStatusChanged

+ type Session struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ Realm Realm

+ RevokedAt *time.Time

+ Scope SessionScope

+ SecurityVersion int64

+ SubjectID SubjectID

+ func (s Session) Active(now time.Time) bool

+ type SessionRecord struct

+ FamilyID string

+ RefreshDigest SecretDigest

+ RefreshExpiresAt time.Time

+ RefreshSelector string

+ Session Session

+ type SessionScope string

+ const SessionScopeAuthenticated

+ const SessionScopeConfirmation

+ type SessionSecurity struct

+ CurrentVersion int64

+ Session Session

+ SubjectStatus SubjectStatus

+ type SessionStore interface

+ CreateSession func(ctx context.Context, record SessionRecord) error

+ IntrospectSession func(ctx context.Context, sessionID string) (SessionSecurity, error)

+ RevokeSession func(ctx context.Context, subjectID SubjectID, sessionID string, now time.Time) (bool, error)

+ RevokeSubjectSessions func(ctx context.Context, subjectID SubjectID, now time.Time) (int64, error)

+ RotateRefresh func(ctx context.Context, request RefreshRotationRequest) (RefreshRotationResult, error)

+ SetSubjectStatus func(ctx context.Context, subjectID SubjectID, status SubjectStatus, now time.Time) (Subject, error)

+ type SigningConfig struct

+ Audience string

+ Issuer string

+ Keys KeyRing

+ type Subject struct

+ CreatedAt time.Time

+ ID SubjectID

+ SecurityVersion int64

+ Status SubjectStatus

+ UpdatedAt time.Time

+ func (s Subject) IsZero() bool

+ type SubjectID uuid.UUID

+ func MustParseSubjectID(value string) SubjectID

+ func NewSubjectID() SubjectID

+ func ParseSubjectID(value string) (SubjectID, error)

+ func (id *SubjectID) Scan(source any) error

+ func (id *SubjectID) UnmarshalText(value []byte) error

+ func (id SubjectID) IsZero() bool

+ func (id SubjectID) MarshalText() ([]byte, error)

+ func (id SubjectID) String() string

+ func (id SubjectID) Validate() error

+ func (id SubjectID) Value() (driver.Value, error)

+ type SubjectStatus string

+ const SubjectStatusActive

+ const SubjectStatusDisabled

+ const SubjectStatusSuspended

+ func (s SubjectStatus) Validate() error

+ type TokenPair struct

+ AccessExpiresAt time.Time

+ AccessToken string

+ RefreshExpiresAt time.Time

+ RefreshToken string

+ Session Session

+ type URLBuilder interface

+ PasswordResetURL func(ctx context.Context, token string) (string, error)

+ type URLBuilderFunc func(context.Context, string) (string, error)

+ func (f URLBuilderFunc) PasswordResetURL(ctx context.Context, token string) (string, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL