local

Documentation

Overview

Package local provides password hashing and verification for application-owned user stores.

Index

• func HashPassword(password string) (string, error)
• func VerifyPassword(hash, password string) error
• type CredentialStore
• type Service
  • func (s Service[User]) SignIn(ctx context.Context, username, password string) (User, string, error)

Functions

func HashPassword

func HashPassword(password string) (string, error)

HashPassword hashes a password with bcrypt, using its default work factor. Applications must enforce their own password and account policies before calling it.

func VerifyPassword

func VerifyPassword(hash, password string) error

VerifyPassword compares a supplied password with a stored bcrypt hash.

Types

type CredentialStore

type CredentialStore[User any] interface {
	// LookupCredential fetches a user's current bcrypt password hash.
	LookupCredential(context.Context, string) (User, string, error)
}

CredentialStore loads an application-owned user and a bcrypt password hash. Unknown or disabled accounts must return auth.ErrInvalidCredentials.

type Service

type Service[User any] struct {
	// Credentials provides application-owned user lookup and account policy.
	Credentials CredentialStore[User]
	// Sessions provides durable, revocable session persistence.
	Sessions session.Manager[User]
}

Service verifies local passwords and issues hashed server-side sessions.

func (Service[User]) SignIn

func (s Service[User]) SignIn(ctx context.Context, username, password string) (User, string, error)

SignIn verifies credentials and creates a new opaque session. The caller writes the session cookie using session.CookieConfig.