auth

Documentation

Index

• Constants
• Variables
• type Allowlist
  • func NewAllowlist(emails []string, domains []string) (*Allowlist, error)
  • func (a *Allowlist) Allows(email string, verified bool) bool
• type Config
• type Identity
• type IdentityProvider
  • func NewIdentityProvider(ctx context.Context, provider string, cfg OIDCConfig) (IdentityProvider, error)
• type MagicLink
• type MagicLinkConsumption
• type MagicLinkStore
• type Message
• type OIDCConfig
• type Option
  • func WithClock(now func() time.Time) Option
  • func WithRandom(reader io.Reader) Option
• type SMTPConfig
• type Sender
  • func NewSMTPSender(cfg SMTPConfig) (Sender, error)
• type Service
  • func NewService(cfg Config, store Store, sender Sender, opts ...Option) (*Service, error)
  • func NewSessionService(cfg SessionConfig, store SessionStore, opts ...Option) (*Service, error)
  • func (s *Service) Authenticate(ctx context.Context, token string) (Session, error)
  • func (s *Service) ConsumeLink(ctx context.Context, token string) (string, Session, error)
  • func (s *Service) CreateLink(ctx context.Context, email string, next string) (string, time.Time, error)
  • func (s *Service) CreateSession(ctx context.Context, email string) (string, Session, error)
  • func (s *Service) RequestLink(ctx context.Context, email string, next string) error
  • func (s *Service) SecureCookie() bool
• type Session
• type SessionConfig
• type SessionRecord
• type SessionStore
• type Store

Constants

const IdentityProviderOIDC = "oidc"

Variables

var (
	ErrOIDCExchange        = errors.New("oidc authorization code exchange failed")
	ErrOIDCInvalidToken    = errors.New("oidc ID token is invalid")
	ErrOIDCInvalidNonce    = errors.New("oidc nonce is invalid")
	ErrOIDCMissingEmail    = errors.New("oidc ID token does not contain an email")
	ErrOIDCUnverifiedEmail = errors.New("oidc email is not verified")
)

var (
	ErrEmailNotAllowed = errors.New("email is not allowed")
	ErrInvalidLink     = errors.New("magic link is invalid or expired")
	ErrInvalidSession  = errors.New("web session is invalid or expired")
	ErrMissingStore    = errors.New("auth store is required")
	ErrMissingSender   = errors.New("magic link sender is required")
)

Types

type Allowlist

type Allowlist struct {
	// contains filtered or unexported fields
}

func NewAllowlist

func NewAllowlist(emails []string, domains []string) (*Allowlist, error)

func (*Allowlist) Allows

func (a *Allowlist) Allows(email string, verified bool) bool

type Config

type Config struct {
	AllowedEmails []string
	LinkTTL       time.Duration
	SessionTTL    time.Duration
	PublicURL     string
}

type Identity

type Identity struct {
	Subject       string
	Email         string
	EmailVerified bool
}

type IdentityProvider

type IdentityProvider interface {
	AuthorizationURL(state string, nonce string, verifier string) string
	Exchange(context.Context, string, string, string) (Identity, error)
}

func NewIdentityProvider

func NewIdentityProvider(ctx context.Context, provider string, cfg OIDCConfig) (IdentityProvider, error)

type MagicLink

type MagicLink struct {
	TokenHash string
	Email     string
	ExpiresAt time.Time
	CreatedAt time.Time
}

type MagicLinkConsumption

type MagicLinkConsumption struct {
	TokenHash        string
	SessionHash      string
	SessionExpiresAt time.Time
	Now              time.Time
}

type MagicLinkStore

type MagicLinkStore interface {
	CreateMagicLink(context.Context, MagicLink) error
	ConsumeMagicLink(context.Context, MagicLinkConsumption) (Session, error)
}

type Message

type Message struct {
	To        string
	URL       string
	ExpiresAt time.Time
}

type OIDCConfig

type OIDCConfig struct {
	IssuerURL    string
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string
}

type Option

type Option func(*Service)

func WithClock

func WithClock(now func() time.Time) Option

func WithRandom

func WithRandom(reader io.Reader) Option

type SMTPConfig

type SMTPConfig struct {
	Host     string
	Port     int
	Username string
	Password string
	From     string
}

type Sender

type Sender interface {
	SendMagicLink(context.Context, Message) error
}

func NewSMTPSender

func NewSMTPSender(cfg SMTPConfig) (Sender, error)

type Service

type Service struct {
	// contains filtered or unexported fields
}

func NewService

func NewService(cfg Config, store Store, sender Sender, opts ...Option) (*Service, error)

func NewSessionService

func NewSessionService(cfg SessionConfig, store SessionStore, opts ...Option) (*Service, error)

func (*Service) Authenticate

func (s *Service) Authenticate(ctx context.Context, token string) (Session, error)

func (*Service) ConsumeLink

func (s *Service) ConsumeLink(ctx context.Context, token string) (string, Session, error)

func (*Service) CreateLink

func (s *Service) CreateLink(ctx context.Context, email string, next string) (string, time.Time, error)

func (*Service) CreateSession

func (s *Service) CreateSession(ctx context.Context, email string) (string, Session, error)

func (*Service) RequestLink

func (s *Service) RequestLink(ctx context.Context, email string, next string) error

func (*Service) SecureCookie

func (s *Service) SecureCookie() bool

type Session

type Session struct {
	Email     string
	ExpiresAt time.Time
}

type SessionConfig

type SessionConfig struct {
	SessionTTL time.Duration
	PublicURL  string
}

type SessionRecord

type SessionRecord struct {
	TokenHash string
	Email     string
	ExpiresAt time.Time
	CreatedAt time.Time
}

type SessionStore

type SessionStore interface {
	CreateWebSession(context.Context, SessionRecord) error
	WebSession(context.Context, string, time.Time) (Session, error)
}

type Store

type Store interface {
	SessionStore
	MagicLinkStore
}