auth

Documentation

Index

• Variables
• func LoginUnavailable() http.HandlerFunc
• func Logout(local *Local) http.HandlerFunc
• func User(r *http.Request) (model.User, bool)
• func ValidLocalPassword(password string) bool
• func WithUser(r *http.Request, user model.User) *http.Request
• type AuthMode
• type Authenticator
• type Bearer
  • func NewBearer(repository bearerRepository) *Bearer
  • func (a *Bearer) Authenticate(r *http.Request) (model.User, error)
• type BrowserAuth
  • func ConfigureBrowserAuth(ctx context.Context, config BrowserConfig, repository browserRepository) (BrowserAuth, error)
• type BrowserConfig
• type Local
  • func NewLocal(repository localRepository, publicURL string) *Local
  • func (l *Local) Authenticate(r *http.Request) (model.User, error)
  • func (l *Local) ChangePassword(ctx context.Context, userID int64, ...) (string, error)
  • func (l *Local) ClearSession(w http.ResponseWriter, r *http.Request)
  • func (l *Local) SetPassword(ctx context.Context, userID int64, password string) error
  • func (l *Local) Setup(ctx context.Context, username, email, displayName, password string) (model.User, string, error)
  • func (l *Local) SignIn(ctx context.Context, username, password string) (model.User, string, error)
  • func (l *Local) WriteSessionCookie(w http.ResponseWriter, token string)
• type None
  • func NewNone(repository noneRepository) *None
  • func (a *None) Authenticate(r *http.Request) (model.User, error)
• type OIDC
  • func NewOIDC(ctx context.Context, config OIDCConfig, repository oidcRepository) (*OIDC, error)
  • func (o *OIDC) Authenticate(r *http.Request) (model.User, error)
  • func (o *OIDC) Callback() http.HandlerFunc
  • func (o *OIDC) Login() http.HandlerFunc
• type OIDCConfig
• type TrustedProxy
  • func NewTrustedProxy(repository trustedProxyRepository, headers TrustedProxyHeaders) *TrustedProxy
  • func (a *TrustedProxy) Authenticate(r *http.Request) (model.User, error)
• type TrustedProxyHeaders

Variables

var (
	// ErrUnauthenticated indicates that an authenticator could not resolve a valid identity.
	ErrUnauthenticated = errors.New("unauthenticated")
	// ErrInvalidCredentials indicates that explicit authentication credentials were supplied but rejected.
	ErrInvalidCredentials = errors.New("invalid credentials")
	// ErrRegistrationDisabled indicates that an authenticated external identity is not allowed to create an account.
	ErrRegistrationDisabled = errors.New("user registration is disabled")
)

Functions

func LoginUnavailable

func LoginUnavailable() http.HandlerFunc

LoginUnavailable redirects to the home page when the configured auth mode has no login flow.

func Logout

func Logout(local *Local) http.HandlerFunc

Logout clears OIDC and local browser sessions and redirects home.

func User

func User(r *http.Request) (model.User, bool)

User returns the authenticated user stored in the request context.

func ValidLocalPassword

func ValidLocalPassword(password string) bool

ValidLocalPassword reports whether a password satisfies the local-login minimum length.

func WithUser

func WithUser(r *http.Request, user model.User) *http.Request

WithUser returns a request whose context contains the authenticated user.

Types

type AuthMode

type AuthMode string

AuthMode identifies a supported browser authentication mode.

const (
	// AuthModeNone authenticates every request as the local administrator.
	AuthModeNone AuthMode = "none"
	// AuthModeLocal authenticates browser requests with Lore-managed credentials.
	AuthModeLocal AuthMode = "local"
	// AuthModeTrustedProxy authenticates users from trusted proxy headers.
	AuthModeTrustedProxy AuthMode = "trusted-proxy"
	// AuthModeOIDC authenticates users through an OIDC provider.
	AuthModeOIDC AuthMode = "oidc"
)

type Authenticator

type Authenticator interface {
	// Authenticate resolves an authenticated user from the request.
	Authenticate(*http.Request) (model.User, error)
}

Authenticator resolves an authenticated user from an HTTP request.

type Bearer

type Bearer struct {
	// contains filtered or unexported fields
}

Bearer authenticates API requests using bearer tokens.

func NewBearer

func NewBearer(repository bearerRepository) *Bearer

NewBearer creates a bearer-token authenticator.

func (*Bearer) Authenticate

func (a *Bearer) Authenticate(r *http.Request) (model.User, error)

Authenticate resolves the bearer token in the Authorization header.

type BrowserAuth

type BrowserAuth struct {
	Authenticator     Authenticator
	Login             http.Handler
	Callback          http.Handler
	Validate          func(context.Context, model.AuthenticationSettings) error
	Local             *Local
	LocalLoginAllowed func(context.Context) (bool, error)
}

BrowserAuth groups dynamic browser identity resolution with its public handlers.

func ConfigureBrowserAuth

func ConfigureBrowserAuth(
	ctx context.Context,
	config BrowserConfig,
	repository browserRepository,
) (BrowserAuth, error)

ConfigureBrowserAuth constructs database-managed browser authentication.

type BrowserConfig

type BrowserConfig struct {
	// ModeOverride forces one authentication mode for recovery when non-empty.
	ModeOverride AuthMode
	// TrustedProxy contains header overrides used with trusted-proxy recovery mode.
	TrustedProxy TrustedProxyHeaders
	// OIDC contains deployment secrets plus OIDC overrides used with recovery mode.
	OIDC OIDCConfig
	// LocalLoginEnabled exposes local login alongside another configured mode for recovery.
	LocalLoginEnabled bool
}

BrowserConfig contains deployment-level browser authentication configuration.

type Local

type Local struct {
	// contains filtered or unexported fields
}

Local authenticates optional password-backed Lore accounts.

func NewLocal

func NewLocal(repository localRepository, publicURL string) *Local

NewLocal creates the local-login authenticator used by setup and recovery login.

func (*Local) Authenticate

func (l *Local) Authenticate(r *http.Request) (model.User, error)

Authenticate resolves a valid local session cookie.

func (*Local) ChangePassword

func (l *Local) ChangePassword(
	ctx context.Context,
	userID int64,
	username, currentPassword, newPassword string,
) (string, error)

ChangePassword verifies the current credential, replaces it, and creates a fresh session.

func (*Local) ClearSession

func (l *Local) ClearSession(w http.ResponseWriter, r *http.Request)

ClearSession revokes the current local session and removes its cookie.

func (*Local) SetPassword

func (l *Local) SetPassword(ctx context.Context, userID int64, password string) error

SetPassword creates or replaces one Lore user's local recovery password.

func (*Local) Setup

func (l *Local) Setup(
	ctx context.Context,
	username, email, displayName, password string,
) (model.User, string, error)

Setup creates the first local administrator and starts its initial session.

func (*Local) SignIn

func (l *Local) SignIn(ctx context.Context, username, password string) (model.User, string, error)

SignIn verifies local credentials and creates a new browser session.

func (*Local) WriteSessionCookie

func (l *Local) WriteSessionCookie(w http.ResponseWriter, token string)

WriteSessionCookie stores a local session token in an HTTP-only cookie.

type None

type None struct {
	// contains filtered or unexported fields
}

None authenticates every request as the local administrator.

func NewNone

func NewNone(repository noneRepository) *None

NewNone creates a no-auth authenticator.

func (*None) Authenticate

func (a *None) Authenticate(r *http.Request) (model.User, error)

Authenticate resolves the local administrator account.

type OIDC

type OIDC struct {
	// contains filtered or unexported fields
}

OIDC authenticates browser sessions and handles the OIDC authorization flow.

func NewOIDC

func NewOIDC(
	ctx context.Context,
	config OIDCConfig,
	repository oidcRepository,
) (*OIDC, error)

NewOIDC creates an OIDC authenticator and authorization-flow handler.

func (*OIDC) Authenticate

func (o *OIDC) Authenticate(r *http.Request) (model.User, error)

Authenticate resolves the authenticated OIDC browser session by issuer and subject.

func (*OIDC) Callback

func (o *OIDC) Callback() http.HandlerFunc

Callback completes the OIDC flow and establishes the browser session.

func (*OIDC) Login

func (o *OIDC) Login() http.HandlerFunc

Login starts the OIDC authorization-code flow.

type OIDCConfig

type OIDCConfig struct {
	ClientID            string
	ClientSecret        string
	Issuer              string
	SessionSecret       string
	PublicURL           string
	GroupClaim          string
	GroupSync           bool
	GroupsAuthoritative bool
	GroupMappings       []model.OIDCGroupMapping
}

OIDCConfig contains the settings required for the OIDC authorization flow.

type TrustedProxy

type TrustedProxy struct {
	// contains filtered or unexported fields
}

TrustedProxy authenticates requests using identity headers from a trusted proxy.

func NewTrustedProxy

func NewTrustedProxy(repository trustedProxyRepository, headers TrustedProxyHeaders) *TrustedProxy

NewTrustedProxy creates a trusted-proxy authenticator.

func (*TrustedProxy) Authenticate

func (a *TrustedProxy) Authenticate(r *http.Request) (model.User, error)

Authenticate resolves the first populated trusted identity header.

type TrustedProxyHeaders

type TrustedProxyHeaders struct {
	Username    []string
	Email       []string
	DisplayName []string
}

TrustedProxyHeaders contains ordered header candidates for each external identity field.