regulation

Documentation

Index

• Constants
• Variables
• type Context
• type MetricsRecorder
• type Regulator
  • func NewRegulator(config schema.RegulationConfiguration, provider storage.RegulatorProvider, ...) *Regulator
  • func (r *Regulator) Mark(ctx Context, successful, banned bool, ...) error
  • func (r *Regulator) Regulate(ctx context.Context, username string) (time.Time, error)

Constants

const (
	// AuthType1FA is the string representing an auth log for first-factor authentication.
	AuthType1FA = "1FA"

	// AuthTypeTOTP is the string representing an auth log for second-factor authentication via TOTP.
	AuthTypeTOTP = "TOTP"

	// AuthTypeWebauthn is the string representing an auth log for second-factor authentication via FIDO2/CTAP2/WebAuthn.
	AuthTypeWebauthn = "Webauthn"

	// AuthTypeDuo is the string representing an auth log for second-factor authentication via DUO.
	AuthTypeDuo = "Duo"
)

Variables

var ErrUserIsBanned = fmt.Errorf("user is banned")

ErrUserIsBanned user is banned error message.

Types

type Context

type Context interface {
	context.Context
	MetricsRecorder

	RemoteIP() (ip net.IP)
}

Context represents a regulator context.

type MetricsRecorder

type MetricsRecorder interface {
	RecordAuthentication(success, banned bool, authType string)
}

MetricsRecorder represents the methods used to record regulation.

type Regulator

type Regulator struct {
	// contains filtered or unexported fields
}

Regulator an authentication regulator preventing attackers to brute force the service.

func NewRegulator

func NewRegulator(config schema.RegulationConfiguration, provider storage.RegulatorProvider, clock utils.Clock) *Regulator

NewRegulator create a regulator instance.

func (*Regulator) Mark

func (r *Regulator) Mark(ctx Context, successful, banned bool, username, requestURI, requestMethod, authType string) error

Mark an authentication attempt. We split Mark and Regulate in order to avoid timing attacks.

func (*Regulator) Regulate

func (r *Regulator) Regulate(ctx context.Context, username string) (time.Time, error)

Regulate the authentication attempts for a given user. This method returns ErrUserIsBanned if the user is banned along with the time until when the user is banned.