auth

Documentation

Index

• Constants
• Variables
• func AccessCookie(c *echo.Context) (*http.Cookie, error)
• func ComparePassword(hash, password string) error
• func HashPassword(password string) (string, error)
• func RefreshCookie(c *echo.Context) (*http.Cookie, error)
• func RequireAuth(manager *Manager) echo.MiddlewareFunc
• func SetViewer(c *echo.Context, viewer *Viewer)
• type Claims
  • func ClaimsFromContext(c *echo.Context) (*Claims, bool)
• type KeyStore
  • func NewKeyStore(pool *pgxpool.Pool) *KeyStore
  • func (s *KeyStore) ActiveSigningKey(ctx context.Context, tokenType string) (*SigningKey, error)
  • func (s *KeyStore) CreateSigningKey(ctx context.Context, tokenType string, verifyOldFor time.Duration) (*SigningKey, *SigningKey, error)
  • func (s *KeyStore) DeleteSigningKey(ctx context.Context, keyID uuid.UUID) error
  • func (s *KeyStore) EnsureReady(ctx context.Context) error
  • func (s *KeyStore) ExpireSigningKey(ctx context.Context, keyID uuid.UUID, verifyFor time.Duration) (*SigningKey, error)
  • func (s *KeyStore) VerificationKey(ctx context.Context, keyID uuid.UUID, tokenType string, now time.Time) (*SigningKey, error)
• type Manager
  • func NewManager(keys *KeyStore, accessTTL, refreshTTL time.Duration, cookieSecure bool) *Manager
  • func (m *Manager) ClearAuthCookies(c *echo.Context)
  • func (m *Manager) IssueTokens(ctx context.Context, userID uuid.UUID) (TokenPair, error)
  • func (m *Manager) ParseAccessToken(ctx context.Context, token string) (*Claims, error)
  • func (m *Manager) ParseRefreshToken(ctx context.Context, token string) (*Claims, error)
  • func (m *Manager) SetAuthCookies(c *echo.Context, pair TokenPair)
• type SigningKey
• type TokenPair
• type Viewer
  • func CurrentViewer(c *echo.Context) (*Viewer, bool)
  • func (v *Viewer) HasRole(role string) bool

Constants

const (
	TokenTypeAccess  = "access"
	TokenTypeRefresh = "refresh"
)

Variables

var (
	ErrInvalidTokenType          = errors.New("token type must be access or refresh")
	ErrNoActiveSigningKey        = errors.New("no active signing key configured")
	ErrSigningKeyNotFound        = errors.New("signing key not found")
	ErrSigningKeyUnavailable     = errors.New("signing key is not valid for verification")
	ErrCannotDeleteActiveKey     = errors.New("active signing keys must be rotated or expired before deletion")
	ErrNegativeVerificationGrace = errors.New("verification grace period must be non-negative")
)

Functions

func AccessCookie

func AccessCookie(c *echo.Context) (*http.Cookie, error)

func ComparePassword

func ComparePassword(hash, password string) error

func HashPassword

func HashPassword(password string) (string, error)

func RefreshCookie

func RefreshCookie(c *echo.Context) (*http.Cookie, error)

func RequireAuth

func RequireAuth(manager *Manager) echo.MiddlewareFunc

func SetViewer

func SetViewer(c *echo.Context, viewer *Viewer)

Types

type Claims

type Claims struct {
	TokenType string `json:"token_type"`
	jwt.RegisteredClaims
}

func ClaimsFromContext

func ClaimsFromContext(c *echo.Context) (*Claims, bool)

type KeyStore

type KeyStore struct {
	// contains filtered or unexported fields
}

func NewKeyStore

func NewKeyStore(pool *pgxpool.Pool) *KeyStore

func (*KeyStore) ActiveSigningKey

func (s *KeyStore) ActiveSigningKey(ctx context.Context, tokenType string) (*SigningKey, error)

func (*KeyStore) CreateSigningKey

func (s *KeyStore) CreateSigningKey(ctx context.Context, tokenType string, verifyOldFor time.Duration) (*SigningKey, *SigningKey, error)

func (*KeyStore) DeleteSigningKey

func (s *KeyStore) DeleteSigningKey(ctx context.Context, keyID uuid.UUID) error

func (*KeyStore) EnsureReady

func (s *KeyStore) EnsureReady(ctx context.Context) error

func (*KeyStore) ExpireSigningKey

func (s *KeyStore) ExpireSigningKey(ctx context.Context, keyID uuid.UUID, verifyFor time.Duration) (*SigningKey, error)

func (*KeyStore) VerificationKey

func (s *KeyStore) VerificationKey(ctx context.Context, keyID uuid.UUID, tokenType string, now time.Time) (*SigningKey, error)

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager

func NewManager(keys *KeyStore, accessTTL, refreshTTL time.Duration, cookieSecure bool) *Manager

func (*Manager) ClearAuthCookies

func (m *Manager) ClearAuthCookies(c *echo.Context)

func (*Manager) IssueTokens

func (m *Manager) IssueTokens(ctx context.Context, userID uuid.UUID) (TokenPair, error)

func (*Manager) ParseAccessToken

func (m *Manager) ParseAccessToken(ctx context.Context, token string) (*Claims, error)

func (*Manager) ParseRefreshToken

func (m *Manager) ParseRefreshToken(ctx context.Context, token string) (*Claims, error)

func (*Manager) SetAuthCookies

func (m *Manager) SetAuthCookies(c *echo.Context, pair TokenPair)

type SigningKey

type SigningKey struct {
	ID          uuid.UUID
	TokenType   string
	Algorithm   string
	Secret      []byte
	State       string
	VerifyUntil *time.Time
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type TokenPair

type TokenPair struct {
	AccessToken   string
	AccessExpiry  time.Time
	RefreshToken  string
	RefreshExpiry time.Time
}

type Viewer

type Viewer struct {
	ID       uuid.UUID
	Handle   string
	Email    string
	IsActive bool
	Roles    []string
}

func CurrentViewer

func CurrentViewer(c *echo.Context) (*Viewer, bool)

CurrentViewer returns the authenticated viewer for the current request, or a synthetic guest viewer when no session is present. The boolean reports whether an authenticated viewer was found — a false result always pairs with the guest sentinel, so callers can safely call HasRole or read Roles without a nil check.

func (*Viewer) HasRole

func (v *Viewer) HasRole(role string) bool