authkit

package module

Go to main page

Versions in this module

v0

v0.21.1

Oct 18, 2026

Changes in this version

type SecretConfig

+ TenantKey func(ctx context.Context, tenantID string) ([]byte, error)

v0.21.0

Oct 13, 2026

Changes in this version

+ var ErrEmailNotVerified = model.ErrEmailNotVerified

+ var ErrIdentityAlreadyLinked = model.ErrIdentityAlreadyLinked

+ var ErrIdentityLinkRequired = model.ErrIdentityLinkRequired

+ var ErrInvalidSecondFactor = model.ErrInvalidSecondFactor

+ var ErrPasskeyAlreadyRegistered = model.ErrPasskeyAlreadyRegistered

+ var ErrPasskeyCloned = model.ErrPasskeyCloned

+ var ErrSecondFactorRequired = model.ErrSecondFactorRequired

+ var ErrTenantExists = model.ErrTenantExists

+ var ErrTwoFactorAlreadyEnabled = model.ErrTwoFactorAlreadyEnabled

+ var ErrTwoFactorNotConfigured = model.ErrTwoFactorNotConfigured

+ func Migrations(schema string) (fs.FS, error)

+ func ParsePrivateKeyPEM(data []byte) (crypto.Signer, error)

+ func ParsePublicKeyPEM(data []byte) (crypto.PublicKey, error)

+ func WithTx(ctx context.Context, tx *sql.Tx) context.Context

type AuthKit

+ func (k *AuthKit) ExternalIdentityService() ExternalIdentityService

+ func (k *AuthKit) InTx(ctx context.Context, fn func(ctx context.Context, tx *sql.Tx) error) error

+ func (k *AuthKit) JSONWebKeySet() JSONWebKeySet

+ func (k *AuthKit) PasskeyService() PasskeyService

+ func (k *AuthKit) SignInHistoryService() SignInHistoryService

+ func (k *AuthKit) TwoFactorService() TwoFactorService

+ func (k *AuthKit) VerifiedLoginService() VerifiedLoginService

type Config

+ RecordSignIns bool

+ TwoFactorConfig TwoFactorConfig

+ type ExternalIdentityService interface

+ Get func(ctx context.Context, provider, subject string) (*model.ExternalIdentity, error)

+ Link func(ctx context.Context, req model.LinkExternalIdentityRequest) (*model.ExternalIdentity, error)

+ ListByUser func(ctx context.Context, userID string) ([]*model.ExternalIdentity, error)

+ Resolve func(ctx context.Context, req model.ResolveExternalIdentityRequest) (*model.ResolvedExternalIdentity, error)

+ Unlink func(ctx context.Context, userID, provider, subject string) error

+ type JSONWebKey = model.JSONWebKey

+ type JSONWebKeySet = model.JSONWebKeySet

type JWTConfig

+ RefreshGracePeriod time.Duration

+ SigningKey *SigningKey

+ VerificationKeys []VerificationKey

+ type PasskeyService interface

+ List func(ctx context.Context, userID, rpID string) ([]*model.Passkey, error)

+ RecordUse func(ctx context.Context, req model.PasskeyUseRequest) error

+ Register func(ctx context.Context, req model.RegisterPasskeyRequest) (*model.Passkey, error)

+ Remove func(ctx context.Context, userID, rpID string, credentialID []byte) error

+ Rename func(ctx context.Context, userID, rpID string, credentialID []byte, name string) error

+ User func(ctx context.Context, userID, rpID string) (*model.PasskeyUser, error)

+ UserByHandle func(ctx context.Context, rpID string, userHandle []byte) (*model.PasskeyUser, error)

+ type SignInHistoryService interface

+ Cleanup func(ctx context.Context, olderThan time.Duration) (int64, error)

+ List func(ctx context.Context, userID string, limit, offset int) ([]*model.SignInEvent, error)

+ type SigningKey = model.SigningKey

+ type TwoFactorConfig struct

+ EncryptionKey string

+ Issuer string

+ type TwoFactorService interface

+ CleanupExpired func(ctx context.Context) (int64, error)

+ CompleteSecondFactor func(ctx context.Context, req model.CompleteSecondFactorRequest) (*model.InstallationLoginResponse, error)

+ ConfirmTOTP func(ctx context.Context, userID, code string) ([]string, error)

+ Disable func(ctx context.Context, userID string) error

+ EnrollTOTP func(ctx context.Context, userID string) (*model.TOTPEnrollment, error)

+ RegenerateRecoveryCodes func(ctx context.Context, userID string) ([]string, error)

+ Status func(ctx context.Context, userID string) (*model.TwoFactorStatus, error)

+ Verify func(ctx context.Context, userID, code string) error

type UserService

+ MarkEmailVerified func(ctx context.Context, userID string) error

+ type VerificationKey = model.VerificationKey

+ type VerifiedLoginService interface

+ OpenSession func(ctx context.Context, req model.OpenSessionRequest) (*model.OpenSessionResponse, error)

v0.20.2

Sep 7, 2026

Changes in this version

+ const SessionDisabled

+ const SessionOptional

+ const SessionRequired

+ var ErrSessionDisabled = model.ErrSessionDisabled

+ var ErrSessionRequired = model.ErrSessionRequired

+ var ErrSessionRevoked = model.ErrSessionRevoked

type AuthKit

+ func (k *AuthKit) InstallationAuthService() InstallationAuthService

+ func (k *AuthKit) SessionService() SessionService

type Config

+ SessionConfig SessionConfig

+ type InstallationAuthService interface

+ LoginByEmailWithInstallation func(context.Context, model.InstallationLoginByEmailRequest) (*model.InstallationLoginResponse, error)

+ LoginWithInstallation func(context.Context, model.InstallationLoginRequest) (*model.InstallationLoginResponse, error)

+ ValidateInstallationJWT func(context.Context, string) (*model.InstallationClaims, error)

+ type SessionConfig = model.SessionConfig

+ type SessionMode = model.SessionMode

+ type SessionService interface

+ CleanupExpired func(ctx context.Context) (int64, error)

+ Get func(ctx context.Context, userID, sessionID string) (*model.Session, error)

+ List func(ctx context.Context, userID string, limit, offset int) ([]model.Session, error)

+ Revoke func(ctx context.Context, userID, sessionID string) error

+ RevokeInstallation func(ctx context.Context, userID, installationID string) error

v0.20.1

Jul 3, 2026

Changes in this version

+ var ErrLastRoleHolder = model.ErrLastRoleHolder

type MembershipService

+ RemoveGuarded func(ctx context.Context, userID, tenantID, requireRole string) error

+ UpdateRolesGuarded func(ctx context.Context, userID, tenantID string, roles []string, ...) error

v0.20.0

Jul 1, 2026

Changes in this version

+ const DefaultAccessExpiry

+ const DefaultOTPRateLimitPeriod

+ const DefaultRefreshExpiry

+ const HighBcryptCostThreshold

+ const MinSecretLength

+ var ErrAccountDisabled = model.ErrAccountDisabled

+ var ErrAccountLocked = model.ErrAccountLocked

+ var ErrIncorrectPassword = model.ErrIncorrectPassword

+ var ErrInternal = model.ErrInternal

+ var ErrInvalidAPIKey = model.ErrInvalidAPIKey

+ var ErrInvalidCredentials = model.ErrInvalidCredentials

+ var ErrInvalidInput = model.ErrInvalidInput

+ var ErrInvalidOTP = model.ErrInvalidOTP

+ var ErrInvalidRefreshToken = model.ErrInvalidRefreshToken

+ var ErrInvalidToken = model.ErrInvalidToken

+ var ErrInvitationInvalid = model.ErrInvitationInvalid

+ var ErrNoActiveMembership = model.ErrNoActiveMembership

+ var ErrNotFound = model.ErrNotFound

+ var ErrOTPLockedOut = model.ErrOTPLockedOut

+ var ErrOTPRateLimited = model.ErrOTPRateLimited

+ var ErrOTPSecretMissing = model.ErrOTPSecretMissing

+ var ErrPasswordTooWeak = model.ErrPasswordTooWeak

+ var ErrRateLimited = model.ErrRateLimited

+ var ErrRefreshTokenReuse = model.ErrRefreshTokenReuse

+ var ErrSecretEncryptionKeyMissing = model.ErrSecretEncryptionKeyMissing

+ var ErrTokenRevoked = model.ErrTokenRevoked

+ var ErrUserExists = model.ErrUserExists

+ var ErrValueTooLong = model.ErrValueTooLong

+ type APIKeyConfig struct

+ HMACSecret string

+ type APIKeyService interface

+ CleanupExpired func(ctx context.Context) (int64, error)

+ Count func(ctx context.Context, tenantID string) (int, error)

+ Create func(ctx context.Context, req model.CreateAPIKeyRequest) (*model.CreateAPIKeyResponse, error)

+ Get func(ctx context.Context, keyID, tenantID string) (*model.APIKey, error)

+ List func(ctx context.Context, tenantID string, includeExpired bool) ([]*model.APIKey, error)

+ Revoke func(ctx context.Context, keyID, tenantID string) error

+ Validate func(ctx context.Context, apiKey string) (*model.APIKeyContext, error)

+ type AuthKit struct

+ func New(config Config) (*AuthKit, error)

+ func (k *AuthKit) APIKeyService() APIKeyService

+ func (k *AuthKit) AuthService() AuthService

+ func (k *AuthKit) InvitationService() InvitationService

+ func (k *AuthKit) JWTService() JWTService

+ func (k *AuthKit) MembershipService() MembershipService

+ func (k *AuthKit) OTPService() OTPService

+ func (k *AuthKit) PasswordService() PasswordService

+ func (k *AuthKit) Ping(ctx context.Context) error

+ func (k *AuthKit) SecretService() SecretService

+ func (k *AuthKit) TenantService() TenantService

+ func (k *AuthKit) TokenService() TokenService

+ func (k *AuthKit) UserService() UserService

+ type AuthService interface

+ ChangePassword func(ctx context.Context, req model.ChangePasswordRequest) error

+ Login func(ctx context.Context, req model.LoginRequest) (*model.LoginResponse, error)

+ LoginByEmail func(ctx context.Context, req model.LoginByEmailRequest) (*model.LoginResponse, error)

+ Logout func(ctx context.Context, refreshToken string) error

+ LogoutAll func(ctx context.Context, userID string) error

+ MintWorkspaceToken func(ctx context.Context, refreshToken, tenantID string) (*model.WorkspaceTokenResponse, error)

+ RefreshToken func(ctx context.Context, req model.RefreshRequest) (*model.RefreshResponse, error)

+ ValidateJWT func(ctx context.Context, token string) (*model.JWTClaims, error)

+ type Config struct

+ APIKeyConfig APIKeyConfig

+ DBConnection DatabaseConnection

+ JWTConfig JWTConfig

+ Logger logger.Logger

+ Metrics metrics.Metrics

+ OTPConfig OTPConfig

+ PasswordConfig PasswordConfig

+ RateLimiter RateLimiter

+ SecretConfig SecretConfig

+ VerifyConnectivity bool

+ type DatabaseConnection struct

+ IdentityRODB *sql.DB

+ IdentityRWDB *sql.DB

+ IdentitySchema string

+ type InvitationService interface

+ Accept func(ctx context.Context, req model.AcceptInvitationRequest) (userID string, created bool, err error)

+ CleanupExpired func(ctx context.Context) (int64, error)

+ Create func(ctx context.Context, req model.CreateInvitationRequest) (*model.Invitation, error)

+ Delete func(ctx context.Context, code string) error

+ Get func(ctx context.Context, code string) (*model.Invitation, error)

+ HasPending func(ctx context.Context, email, tenantID string) (bool, error)

+ IncrementUseCount func(ctx context.Context, code string) error

+ List func(ctx context.Context, tenantID string) ([]*model.Invitation, error)

+ ListActive func(ctx context.Context, tenantID string) ([]*model.Invitation, error)

+ Revoke func(ctx context.Context, code string) error

+ Validate func(ctx context.Context, code string) (bool, error)

+ type JWTConfig struct

+ AccessExpiry time.Duration

+ AccessSecret string

+ Audience string

+ Issuer string

+ RefreshExpiry time.Duration

+ RefreshTokenHMACSecret string

+ type JWTService interface

+ GenerateAccessToken func(user *model.User, membership *model.Membership) (string, error)

+ GenerateRefreshToken func() (string, error)

+ GetAccessExpiry func() time.Duration

+ GetRefreshExpiry func() time.Duration

+ ValidateAccessToken func(tokenString string) (*model.JWTClaims, error)

+ type MembershipService interface

+ Add func(ctx context.Context, req model.AddMembershipRequest) error

+ CountByTenant func(ctx context.Context, tenantID string) (int, error)

+ Get func(ctx context.Context, userID, tenantID string) (*model.Membership, error)

+ ListByTenant func(ctx context.Context, tenantID string) ([]*model.Membership, error)

+ ListByUser func(ctx context.Context, userID string) ([]*model.Membership, error)

+ Remove func(ctx context.Context, userID, tenantID string) error

+ UpdateRoles func(ctx context.Context, userID, tenantID string, roles []string) error

+ type OTPConfig struct

+ HMACSecret string

+ RateLimitDuration time.Duration

+ type OTPService interface

+ CleanupExpired func(ctx context.Context) (int64, error)

+ Delete func(ctx context.Context, email, purpose string) error

+ Generate func(ctx context.Context, req model.OTPGenerateRequest) (*model.GenerateResponse, error)

+ Validate func(ctx context.Context, req model.OTPValidateRequest) error

+ type PasswordConfig struct

+ BcryptCost int

+ type PasswordService interface

+ DummyVerify func(password string)

+ HashPassword func(password string) (string, error)

+ ValidatePasswordStrength func(password string, requirements model.PasswordStrengthRequirements) error

+ VerifyPassword func(password, hash string) error

+ type RateLimiter = ratelimit.RateLimiter

+ type SecretConfig struct

+ EncryptionKey string

+ type SecretService interface

+ Count func(ctx context.Context, tenantID string) (int, error)

+ Delete func(ctx context.Context, tenantID, key string) error

+ Get func(ctx context.Context, tenantID, key string) (string, error)

+ List func(ctx context.Context, tenantID string) ([]*model.Secret, error)

+ MarkVerified func(ctx context.Context, tenantID, key string) error

+ Save func(ctx context.Context, req model.SaveSecretRequest) (*model.SaveSecretResponse, error)

+ type TenantService interface

+ AddAllowedDomain func(ctx context.Context, tenantID, domain string) error

+ Create func(ctx context.Context, req model.CreateTenantRequest) (*model.Tenant, error)

+ Exists func(ctx context.Context, tenantID string) (bool, error)

+ Get func(ctx context.Context, tenantID string) (*model.Tenant, error)

+ GetByDomain func(ctx context.Context, domain string) (*model.Tenant, error)

+ List func(ctx context.Context) ([]*model.Tenant, error)

+ SetAllowedDomains func(ctx context.Context, tenantID string, domains []string) error

+ UpdateName func(ctx context.Context, tenantID, name string) error

+ UpdateSettings func(ctx context.Context, tenantID string, settings map[string]interface{}) error

+ ValidateDomainAccess func(ctx context.Context, email, tenantID string) error

+ type TokenService interface

+ CleanupExpired func(ctx context.Context) (int64, error)

+ GenerateTokenPair func(ctx context.Context, user *model.User, membership *model.Membership, ...) (*model.TokenPairResponse, error)

+ RefreshTokenPair func(ctx context.Context, refreshToken string, tenantID string, ...) (*model.TokenPairResponse, error)

+ RevokeRefreshToken func(ctx context.Context, tokenString string) error

+ ValidateRefreshToken func(ctx context.Context, tokenString string) (*model.User, error)

+ type UserService interface

+ CleanupStatusChanges func(ctx context.Context, olderThan time.Duration) (int64, error)

+ Create func(ctx context.Context, req model.CreateUserRequest) (string, error)

+ Delete func(ctx context.Context, userID string) error

+ Disable func(ctx context.Context, userID string) error

+ Enable func(ctx context.Context, userID string) error

+ Exists func(ctx context.Context, email string) (bool, error)

+ ExistsActive func(ctx context.Context, email string) (bool, error)

+ GetActiveUserIDByEmail func(ctx context.Context, email string) (string, error)

+ GetByEmail func(ctx context.Context, email string) (*model.User, error)

+ GetByID func(ctx context.Context, userID string) (*model.User, error)

+ GetDisplayName func(ctx context.Context, userID string) (string, error)

+ IncrementFailedLoginCount func(ctx context.Context, userID string) error

+ IncrementTokenVersion func(ctx context.Context, userID string) error

+ List func(ctx context.Context, limit, offset int) ([]*model.User, error)

+ Lock func(ctx context.Context, userID string, lockedUntil *time.Time) error

+ SetPassword func(ctx context.Context, userID, hashedPassword string) error

+ StatusHistory func(ctx context.Context, userID string) ([]*model.UserStatusChange, error)

+ Unlock func(ctx context.Context, userID string) error

+ Update func(ctx context.Context, req model.UpdateUserRequest) error

+ UpdateLastLogin func(ctx context.Context, userID string) error

+ VerifyPassword func(ctx context.Context, userID string) (string, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL