auth

Documentation

Index

• Constants
• func WithIdentity(ctx context.Context, id Identity) context.Context
• type Identity
  • func IdentityFromContext(ctx context.Context) (Identity, bool)
• type Middleware
  • func NewMiddleware(db store.DBTX, logger *slog.Logger) *Middleware
  • func (m *Middleware) PurgeExpiredNonces(now time.Time) int
  • func (m *Middleware) Require(next http.Handler) http.Handler

Constants

const MaxClockSkew = 5 * time.Minute

MaxClockSkew is the maximum allowed difference between a request's Signature-Timestamp and the server's clock, in either direction.

Functions

func WithIdentity

func WithIdentity(ctx context.Context, id Identity) context.Context

WithIdentity returns a context carrying id.

Types

type Identity

type Identity struct {
	AccountID string
	DeviceID  string
	Role      store.Role
}

Identity is the authenticated caller of a signed request, injected into the request context by Middleware.Require.

func IdentityFromContext

func IdentityFromContext(ctx context.Context) (Identity, bool)

IdentityFromContext retrieves the Identity injected by Middleware.Require. ok is false if the request was never authenticated.

type Middleware

type Middleware struct {
	DB     store.DBTX
	Logger *slog.Logger
	// Now returns the current time; overridable in tests.
	Now func() time.Time
	// contains filtered or unexported fields
}

Middleware authenticates incoming requests using per-request Ed25519 signatures (see signature.go) against devices registered in db.

func NewMiddleware

func NewMiddleware(db store.DBTX, logger *slog.Logger) *Middleware

NewMiddleware builds a Middleware backed by db, logging authentication failures (at Warn level, with detail) to logger. The nonce replay cache is created internally, so callers (and tests) need not manage it.

func (*Middleware) PurgeExpiredNonces

func (m *Middleware) PurgeExpiredNonces(now time.Time) int

PurgeExpiredNonces drops replay-cache entries whose skew window has passed, returning the number removed. Intended to be called periodically from the server's cleanup ticker to keep the cache bounded during idle periods.

func (*Middleware) Require

func (m *Middleware) Require(next http.Handler) http.Handler

Require wraps next so it only runs for requests with a valid signature, injecting the resulting Identity into the request context. Every failure mode (unknown key, bad signature, expired timestamp, replayed nonce, revoked device) produces the same generic 401 response, so as not to give an attacker an oracle; specifics go only to the log.