auth

package module

Go to main page

Versions in this module

v0

v0.12.0

Sep 30, 2026

Changes in this version

type MemoryUserStore

+ func (s *MemoryUserStore) FindUserByID(_ context.Context, id string) (User, error)

+ type UserLookupStore interface

+ FindUserByID func(ctx context.Context, id string) (User, error)

v0.11.0

Sep 12, 2026

Changes in this version

+ const DefaultInboundScriptTimeout

+ const DefaultInboundWebhookMaxBytes

+ const ToolsTelemetryEventParam

+ const ToolsTelemetryFromParam

+ const ToolsTelemetryLimitParam

+ const ToolsTelemetryOffsetParam

+ const ToolsTelemetryTenantIDParam

+ const ToolsTelemetryToParam

+ const ToolsTelemetryUserIDParam

+ var HTTPErrTelemetryQueryUnsupported = HTTPError

+ var HTTPErrWebhookFailed = HTTPError

+ type InboundScriptRequest struct

+ Actions []string

+ Body json.RawMessage

+ Provider string

+ Script string

+ WebhookID string

+ type InboundScriptResult struct

+ Data map[string]any

+ Event string

+ TenantID string

+ UserID string

+ type InboundScriptRunner interface

+ RunInboundScript func(ctx context.Context, req InboundScriptRequest) (InboundScriptResult, bool, error)

type TelemetryFilter

+ Offset int

type ToolsOpenAPIInfo

+ TelemetryQuery bool

type ToolsOptions

+ InboundWebhooks InboundWebhookStore

+ OnWebhook func(r *http.Request, provider string, body []byte) (InboundScriptResult, bool, error)

+ ScriptRunner InboundScriptRunner

+ ScriptTimeout time.Duration

+ TelemetryStore TelemetryStore

+ WebhookMaxBytes int64

v0.10.0

Sep 12, 2026

Changes in this version

+ const AdminAPIKeysPath

+ const AdminActionsPath

+ const AdminCSSPath

+ const AdminDocsPath

+ const AdminJSPath

+ const AdminLoginPath

+ const AdminLogoutPath

+ const AdminMailTemplatesPath

+ const AdminOpenAPIPath

+ const AdminPingPath

+ const AdminPromoteSuffix

+ const AdminPromoteUsersPath

+ const AdminRolesPath

+ const AdminSessionsPath

+ const AdminSettingsPath

+ const AdminSettingsUIPath

+ const AdminShellPath

+ const AdminTenantsPath

+ const AdminTwoFAPolicyPath

+ const AdminUITemplatesPath

+ const AdminUploadBGImagePath

+ const AdminUploadFilesPath

+ const AdminUploadLogoPath

+ const AdminUploadPath

+ const AdminUsersPath

+ const AdminWebhooksPath

+ const DefaultAdminPath

+ const DefaultSseHeartbeatInterval

+ const DefaultToolsPath

+ const DefaultWebhookTimeout

+ const MaxUploadKeyLen

+ const SseTopicGlobal

+ const SseTopicSessionPrefix

+ const SseTopicTenantPrefix

+ const SseTopicUserPrefix

+ const ToolsNotifyPath

+ const ToolsStreamPath

+ const ToolsStreamTokenParam

+ const ToolsStreamTopicsParam

+ const ToolsTelemetryPath

+ const ToolsTrackPath

+ const ToolsWebhookPath

+ const UploadMaxBytes

+ var ErrSseStreamingUnsupported = errors.New("auth: response writer does not support streaming")

+ var ErrUploadNotFound = errors.New("auth: uploaded file not found")

+ var HTTPErrSseNotEnabled = HTTPError

+ func AdminOpenAPIHandler(info AdminOpenAPIInfo) http.Handler

+ func EventTopics(ev Event) []string

+ func GenerateAdminOpenAPISpec(info AdminOpenAPIInfo) map[string]any

+ func GenerateToolsOpenAPISpec(info ToolsOpenAPIInfo) map[string]any

+ func SortUploadedFiles(files []UploadedFile)

+ func StreamTopics(userID, tenantID string, requested []string) []string

+ func ToolsOpenAPIHandler(info ToolsOpenAPIInfo) http.Handler

+ func ToolsProtectMiddleware(cfg HTTPConfig) func(http.Handler) http.Handler

+ func ToolsSseTokenMiddleware(next http.Handler) http.Handler

+ func UploadContentType(key string) string

+ func UploadFS(store UploadStore) fs.FS

+ func UploadNameAllowed(name string) bool

+ func ValidUploadKey(key string) bool

+ func WebhookTimestamp(t time.Time) string

+ type AdminAccessPolicy struct

+ Kind AdminPolicyKind

+ Predicate AdminPolicyFunc

+ func AdminFirstUser() *AdminAccessPolicy

+ func AdminIsAdminFlag() *AdminAccessPolicy

+ func AdminOpen() *AdminAccessPolicy

+ func AdminPredicate(fn AdminPolicyFunc) *AdminAccessPolicy

+ type AdminGuard struct

+ func (g *AdminGuard) LoginRoutesMounted() bool

+ func (g *AdminGuard) Protect(next http.Handler) http.Handler

+ func (g *AdminGuard) ProtectShell(next http.Handler) http.Handler

+ func (g *AdminGuard) SessionBased() bool

+ type AdminOpenAPIInfo struct

+ APIKeys bool

+ BasePath string

+ Description string

+ Docs bool

+ LinkedAccounts bool

+ Metadata bool

+ Roles bool

+ Sessions bool

+ Settings bool

+ Tenants bool

+ Title string

+ UI bool

+ Version string

+ Webhooks bool

+ type AdminOptions struct

+ AccessPolicy *AdminAccessPolicy

+ AuthAPIPrefix string

+ CookiePrefix *string

+ Docs DocsOptions

+ Enabled bool

+ JWTSecret string

+ LoginPath string

+ Path string

+ RateLimiter func(http.Handler) http.Handler

+ RootUser *AdminRootUser

+ Secret string

+ UploadBaseURL string

+ type AdminPolicyFunc func(ctx context.Context, user User, rbac RolesPermissionsStore) (bool, error)

+ type AdminPolicyKind string

+ const AdminPolicyFirstUser

+ const AdminPolicyIsAdminFlag

+ const AdminPolicyOpen

+ type AdminRootUser struct

+ Email string

+ PasswordHash string

type Auth

+ func (a *Auth) AdminGuard(cfg HTTPConfig) *AdminGuard

+ func (a *Auth) AdminHandler(cfg HTTPConfig) http.Handler

+ func (a *Auth) AdminOpenAPIInfo(cfg HTTPConfig) AdminOpenAPIInfo

+ func (a *Auth) ToolsHandler(cfg HTTPConfig) http.Handler

+ type AuthTools struct

+ Events *EventBus

+ SSE *SseManager

+ func NewAuthTools(ctx context.Context, bus *EventBus, opts AuthToolsOptions) (*AuthTools, error)

+ func (t *AuthTools) Bridge(ctx context.Context) (cancel func())

+ func (t *AuthTools) Notify(ctx context.Context, target string, data any, opts NotifyOptions)

+ func (t *AuthTools) Track(ctx context.Context, eventName string, data map[string]any, opts TrackOptions)

+ type AuthToolsOptions struct

+ Mail MailerTransport

+ OnError func(err error)

+ SMS SMSTransport

+ SSE bool

+ SSEOptions []SseOption

+ Telemetry TelemetryStore

+ Users UserStore

+ WebhookSender *WebhookSender

+ WebhookVersion string

+ Webhooks WebhookStore

type Config

+ Events *EventBus

+ Uploads UploadStore

type Event

+ func (e Event) OutgoingWebhook(version string) OutgoingWebhookEvent

type HTTPConfig

+ Admin AdminOptions

+ Tools ToolsOptions

+ func (c HTTPConfig) AdminDocsBasePath() string

+ func (c HTTPConfig) AdminMounted() bool

+ func (c HTTPConfig) AdminPath() string

+ func (c HTTPConfig) ToolsDocsBasePath() string

+ func (c HTTPConfig) ToolsMounted() bool

+ func (c HTTPConfig) ToolsOpenAPIInfo() ToolsOpenAPIInfo

+ func (c HTTPConfig) ToolsPath() string

+ type HTTPWebhookDeliverer struct

+ Client *http.Client

+ Timeout time.Duration

+ func (d *HTTPWebhookDeliverer) DeliverWebhook(ctx context.Context, attempt WebhookAttempt) error

+ type MemoryUploadStore struct

+ func NewMemoryUploadStore() *MemoryUploadStore

+ func (s *MemoryUploadStore) Delete(_ context.Context, key string) error

+ func (s *MemoryUploadStore) List(_ context.Context) ([]UploadedFile, error)

+ func (s *MemoryUploadStore) Open(_ context.Context, key string) (io.ReadCloser, UploadedFile, error)

+ func (s *MemoryUploadStore) Put(_ context.Context, key string, content io.Reader) (UploadedFile, error)

type MemoryUserStore

+ func (s *MemoryUserStore) UpdateIsAdmin(_ context.Context, userID, tenantID string, isAdmin bool) error

+ func (s *MemoryUserStore) UpdateRequire2FA(_ context.Context, userID, tenantID string, required bool) error

+ type NotifyChannel string

+ const NotifyChannelEmail

+ const NotifyChannelSMS

+ const NotifyChannelSSE

+ type NotifyOptions struct

+ Channels []NotifyChannel

+ EmailSubject string

+ Metadata map[string]any

+ SMSMessage string

+ TenantID string

+ Type string

+ UserID string

type Option

+ func WithAPIKeyStore(store APIKeyStore) Option

+ func WithEventBus(bus *EventBus) Option

+ func WithUploadStore(store UploadStore) Option

+ func WithWebhookStore(store WebhookStore) Option

+ type SseConnectionMeta struct

+ TenantID string

+ UserID string

+ type SseManager struct

+ func NewSseManager(ctx context.Context, opts ...SseOption) (*SseManager, error)

+ func (m *SseManager) BridgeEventBus(ctx context.Context, bus *EventBus, topics func(Event) []string) (cancel func())

+ func (m *SseManager) Broadcast(ctx context.Context, topic string, ev StreamEvent)

+ func (m *SseManager) ConnectionCount() int

+ func (m *SseManager) Deduplicate() bool

+ func (m *SseManager) Disconnect(connectionID string)

+ func (m *SseManager) HeartbeatInterval() time.Duration

+ func (m *SseManager) Serve(w http.ResponseWriter, r *http.Request, topics []string, ...) error

+ type SseOption func(*SseManager)

+ func WithSseDeduplicate(on bool) SseOption

+ func WithSseDistributor(d SseDistributor) SseOption

+ func WithSseHeartbeat(d time.Duration) SseOption

+ func WithSseSendBuffer(frames int) SseOption

+ type StreamEvent struct

+ Data any

+ ID string

+ Metadata map[string]any

+ TenantID string

+ Timestamp string

+ Topic string

+ Type string

+ UserID string

+ type ToolsAccess struct

+ Middleware func(http.Handler) http.Handler

+ func ToolsProtected(mw func(http.Handler) http.Handler) *ToolsAccess

+ func ToolsPublic() *ToolsAccess

+ type ToolsFeatures struct

+ Notify bool

+ Stream bool

+ Telemetry bool

+ Webhook bool

+ type ToolsOpenAPIInfo struct

+ BasePath string

+ Description string

+ Docs bool

+ Notify bool

+ Stream bool

+ Telemetry bool

+ Title string

+ Version string

+ Webhook bool

+ type ToolsOptions struct

+ Access *ToolsAccess

+ AuthTools *AuthTools

+ DisableNotify bool

+ DisableStream bool

+ DisableTelemetry bool

+ DisableWebhook bool

+ Docs DocsOptions

+ Enabled bool

+ Path string

+ func (o ToolsOptions) Features() ToolsFeatures

+ type TrackOptions struct

+ CorrelationID string

+ IP string

+ SessionID string

+ TenantID string

+ UserAgent string

+ UserID string

+ type UploadStore interface

+ Delete func(ctx context.Context, key string) error

+ List func(ctx context.Context) ([]UploadedFile, error)

+ Open func(ctx context.Context, key string) (io.ReadCloser, UploadedFile, error)

+ Put func(ctx context.Context, key string, content io.Reader) (UploadedFile, error)

+ type UploadedFile struct

+ ModTime time.Time

+ Name string

+ Size int64

type User

+ func AdminUserFromContext(ctx context.Context) (User, bool)

+ type UserAdminFlagStore interface

+ UpdateIsAdmin func(ctx context.Context, userID, tenantID string, isAdmin bool) error

+ type UserTwoFactorPolicyStore interface

+ UpdateRequire2FA func(ctx context.Context, userID, tenantID string, required bool) error

+ type WebhookAttempt struct

+ Attempt int

+ Body []byte

+ ConfigID string

+ DeliveryID string

+ Event string

+ Headers http.Header

+ Remaining int

+ URL string

+ func (a WebhookAttempt) NewRequest(ctx context.Context) (*http.Request, error)

+ type WebhookDeliverer interface

+ DeliverWebhook func(ctx context.Context, attempt WebhookAttempt) error

+ type WebhookDelivererFunc func(ctx context.Context, attempt WebhookAttempt) error

+ func (f WebhookDelivererFunc) DeliverWebhook(ctx context.Context, attempt WebhookAttempt) error

+ type WebhookEmitter struct

+ OnError func(config WebhookConfig, err error)

+ Sender *WebhookSender

+ Store WebhookStore

+ Version string

+ func (e *WebhookEmitter) Emit(ctx context.Context, ev Event)

+ func (e *WebhookEmitter) Subscribe(bus *EventBus)

+ type WebhookSender struct

+ Deliverer WebhookDeliverer

+ func (s *WebhookSender) Send(ctx context.Context, config WebhookConfig, event OutgoingWebhookEvent) error

+ type WebhookStatusError struct

+ StatusCode int

+ func (e *WebhookStatusError) Error() string

v0.9.0

Sep 12, 2026

Changes in this version

+ const CorrelationIDHeader

+ const EventAuthLoginFailed

+ const EventAuthLoginSuccess

+ const EventAuthLogout

+ const EventAuthOAuthConflict

+ const EventAuthOAuthSuccess

+ const EventBusWildcard

+ const EventPermissionGranted

+ const EventPermissionRevoked

+ const EventRoleAssigned

+ const EventRoleRevoked

+ const EventSessionCreated

+ const EventSessionExpired

+ const EventSessionRevoked

+ const EventSessionRotated

+ const EventTenantCreated

+ const EventTenantDeleted

+ const EventTenantUserAdded

+ const EventTenantUserRemoved

+ const EventUser2FADisabled

+ const EventUser2FAEnabled

+ const EventUserCreated

+ const EventUserDeleted

+ const EventUserEmailChanged

+ const EventUserEmailVerified

+ const EventUserLinked

+ const EventUserPasswordChanged

+ const EventUserUnlinked

+ const UIRoute

+ const UpstreamUIAssetCommit

+ const UpstreamUIAssetDir

+ func ContextWithEventContext(ctx context.Context, ec EventContext) context.Context

+ func EventContextMiddleware(cfg HTTPConfig) func(http.Handler) http.Handler

+ func EventNames() []string

+ func IsEventName(name string) bool

+ func ReadUpstreamUIAsset(name string) ([]byte, error)

+ func UpstreamUIAssetFS() fs.FS

type Auth

+ func (a *Auth) UIHandler(cfg HTTPConfig, configRoute http.Handler) http.Handler

type Event

+ CorrelationID string

+ IP string

+ SessionID string

+ UserAgent string

+ func (e Event) WebhookMetadata() map[string]any

+ func (e Event) WithRequestContext(ctx context.Context) Event

type EventBus

+ func (b *EventBus) PublishContext(ctx context.Context, ev Event)

+ type EventContext struct

+ CorrelationID string

+ IP string

+ UserAgent string

+ func EventContextFromContext(ctx context.Context) (EventContext, bool)

+ func EventContextFromRequest(r *http.Request, cfg HTTPConfig) EventContext

type HTTPConfig

+ ClientIP func(*http.Request) string

type TelemetryEvent

+ CorrelationID string

+ SessionID string

type TelemetryFilter

+ SessionID string

+ type UpstreamUIAsset struct

+ Commit string

+ Name string

+ SHA256 string

+ Size int

+ UpstreamPath string

+ func UpstreamUIAssets() []UpstreamUIAsset

v0.8.0

Sep 12, 2026

Changes in this version

+ const DefaultWebhookMaxRetries

+ const DefaultWebhookRetryDelay

+ const OutgoingWebhookVersion

+ const WebhookEventWildcard

+ var ErrAPIKeyNotFound = errors.New("auth: api key not found")

+ type APIKeyAdminStore interface

+ ListAll func(ctx context.Context, limit, offset int) ([]APIKeyRecord, error)

+ type APIKeyAuditEntry struct

+ FailureReason string

+ IP string

+ KeyID string

+ Method string

+ Path string

+ Success bool

+ Timestamp time.Time

+ UserAgent string

+ type APIKeyAuditStore interface

+ LogUsage func(ctx context.Context, entry APIKeyAuditEntry) error

+ type APIKeyDeleteStore interface

+ Delete func(ctx context.Context, id string) error

type APIKeyRecord

+ CreatedAt time.Time

+ type APIKeyServiceIndexStore interface

+ ListByServiceID func(ctx context.Context, serviceID string) ([]APIKeyRecord, error)

type APIKeyStore

+ FindByID func(ctx context.Context, id string) (APIKeyRecord, error)

+ type AdminUserStore interface

+ ListUsers func(ctx context.Context, tenantID string, limit, offset int) ([]User, error)

+ type InboundWebhookStore interface

+ FindByProvider func(ctx context.Context, provider string) (WebhookConfig, bool, error)

+ type MemoryAPIKeyStore struct

+ func NewMemoryAPIKeyStore() *MemoryAPIKeyStore

+ func (s *MemoryAPIKeyStore) Delete(_ context.Context, id string) error

+ func (s *MemoryAPIKeyStore) FindByID(_ context.Context, id string) (APIKeyRecord, error)

+ func (s *MemoryAPIKeyStore) FindByPrefix(_ context.Context, prefix string) (APIKeyRecord, error)

+ func (s *MemoryAPIKeyStore) ListAll(_ context.Context, limit, offset int) ([]APIKeyRecord, error)

+ func (s *MemoryAPIKeyStore) ListByServiceID(_ context.Context, serviceID string) ([]APIKeyRecord, error)

+ func (s *MemoryAPIKeyStore) LogUsage(_ context.Context, entry APIKeyAuditEntry) error

+ func (s *MemoryAPIKeyStore) Revoke(_ context.Context, id string) error

+ func (s *MemoryAPIKeyStore) Save(_ context.Context, key APIKeyRecord) error

+ func (s *MemoryAPIKeyStore) UpdateLastUsed(_ context.Context, id string, when time.Time) error

+ func (s *MemoryAPIKeyStore) Usage() []APIKeyAuditEntry

type MemoryRolesPermissionsStore

+ func (s *MemoryRolesPermissionsStore) GetAllRoles(_ context.Context) ([]string, error)

type MemorySessionStore

+ func (s *MemorySessionStore) GetAllSessions(_ context.Context, limit, offset int) ([]Session, error)

type MemoryUserStore

+ func (s *MemoryUserStore) ListUsers(_ context.Context, tenantID string, limit, offset int) ([]User, error)

+ type MemoryWebhookStore struct

+ func NewMemoryWebhookStore() *MemoryWebhookStore

+ func (s *MemoryWebhookStore) AddWebhook(_ context.Context, config WebhookConfig) (WebhookConfig, error)

+ func (s *MemoryWebhookStore) FindByEvent(_ context.Context, event, tenantID string) ([]WebhookConfig, error)

+ func (s *MemoryWebhookStore) FindByProvider(_ context.Context, provider string) (WebhookConfig, bool, error)

+ func (s *MemoryWebhookStore) ListWebhooks(_ context.Context, limit, offset int) ([]WebhookConfig, error)

+ func (s *MemoryWebhookStore) RemoveWebhook(_ context.Context, id string) error

+ func (s *MemoryWebhookStore) UpdateWebhook(_ context.Context, id string, patch WebhookPatch) error

+ type OutgoingWebhookEvent struct

+ Data any

+ Event string

+ Metadata map[string]any

+ Timestamp string

+ Version string

+ type RoleLister interface

+ GetAllRoles func(ctx context.Context) ([]string, error)

type Service

+ func (s *Service) ListAllRoles(ctx context.Context) ([]string, error)

+ func (s *Service) ListAllSessions(ctx context.Context, limit, offset int) ([]Session, error)

+ func (s *Service) ListUsers(ctx context.Context, tenantID string, limit, offset int) ([]User, error)

+ type SessionLister interface

+ GetAllSessions func(ctx context.Context, limit, offset int) ([]Session, error)

type User

+ IsAdmin bool

+ type WebhookAdminStore interface

+ AddWebhook func(ctx context.Context, config WebhookConfig) (WebhookConfig, error)

+ ListWebhooks func(ctx context.Context, limit, offset int) ([]WebhookConfig, error)

+ RemoveWebhook func(ctx context.Context, id string) error

+ UpdateWebhook func(ctx context.Context, id string, patch WebhookPatch) error

+ type WebhookConfig struct

+ AllowedActions []string

+ Events []string

+ ID string

+ IsActive *bool

+ JSScript string

+ MaxRetries *int

+ Provider string

+ RetryDelayMs *int

+ Secret string

+ TenantID string

+ URL string

+ func (c WebhookConfig) Active() bool

+ func (c WebhookConfig) Matches(event, tenantID string) bool

+ func (c WebhookConfig) Retries() int

+ func (c WebhookConfig) RetryDelay() time.Duration

+ type WebhookPatch struct

+ AllowedActions []string

+ Events []string

+ IsActive *bool

+ JSScript *string

+ MaxRetries *int

+ Provider *string

+ RetryDelayMs *int

+ Secret *string

+ TenantID *string

+ URL *string

+ type WebhookStore interface

+ FindByEvent func(ctx context.Context, event, tenantID string) ([]WebhookConfig, error)

v0.7.0

Sep 12, 2026

Changes in this version

+ const CodeInvalidInput

+ const DevLineRevision

+ const DocsSpecPath

+ const DocsUIPath

+ const OIDCAuthorizePath

+ const OIDCDiscoveryPath

+ const OIDCTokenPath

+ const OIDCUserInfoPath

+ const UIConfigRoute

+ const UIDefaultLang

+ const UIDefaultPrimaryColor

+ const UIDefaultSecondaryColor

+ const UIDefaultSiteName

+ var ErrInvalidInput = errors.New("auth: email and password are required")

+ var HTTPErrInvalidInput = HTTPError

+ func OpenAPIHandler(info OpenAPIInfo) http.Handler

+ func RateLimitMiddleware(cfg HTTPConfig) func(http.Handler) http.Handler

+ func SwaggerUIHandler(specURL string) http.Handler

type Auth

+ func (a *Auth) UIConfig(ctx context.Context, r *http.Request, cfg HTTPConfig) UIConfig

type Config

+ PasswordVerifier PasswordVerifier

+ type DocsOptions struct

+ BasePath string

+ Enabled bool

type HTTPConfig

+ Docs DocsOptions

+ RateLimiter func(http.Handler) http.Handler

+ UI UIOptions

+ func (c HTTPConfig) DocsBasePath() string

type IDP

+ func (idp *IDP) OIDCMounts() []OIDCMount

+ type OIDCMount struct

+ Handler http.Handler

+ Path string

+ ResourceServerGated bool

type OpenAPIInfo

+ Docs bool

+ OIDC bool

+ UI bool

type Option

+ func WithPasswordVerifier(verify PasswordVerifier) Option

+ type PasswordVerifier func(ctx context.Context, user User, password string) (ok bool, migrated bool, err error)

+ type UIBranding struct

+ BgColor string

+ BgImage string

+ CardBg string

+ CustomLogo string

+ LogoURL string

+ PrimaryColor string

+ SecondaryColor string

+ SiteName string

+ type UIConfig struct

+ APIPrefix string

+ Features UIFeatures

+ Headless bool

+ Lang string

+ Translations map[string]string

+ UI UIConfigBranding

+ type UIConfigBranding struct

+ BgColor string

+ BgImage string

+ CardBg string

+ CustomCSS string

+ LogoURL string

+ PrimaryColor string

+ SecondaryColor string

+ SiteName string

+ type UIFeatures struct

+ ForgotPassword bool

+ GitHub bool

+ Google bool

+ MagicLink bool

+ Register bool

+ SMS bool

+ TwoFactor bool

+ VerifyEmail bool

+ func (f UIFeatures) MarshalJSON() ([]byte, error)

+ type UIOptions struct

+ Assets fs.FS

+ Branding UIBranding

+ CustomCSS string

+ DefaultLang string

+ Enabled bool

+ Headless bool

+ Uploads fs.FS

v0.6.0

Sep 11, 2026

Changes in this version

+ const CodeOAuthAccountConflict

+ const CodeOAuthEmailDomainNotAllowed

+ const CodeOAuthEmailNotVerified

+ const CodeOAuthUserNotProvisioned

+ const DefaultJWKSCacheTTL

+ const DefaultJWKSFetchTimeout

+ const DefaultJWKSMinRefreshInterval

+ const DefaultJWKSPath

+ const OAuthEmailMatchConflict

+ const OAuthEmailMatchLink

+ const OAuthEmailMatchReject

+ var ErrOAuthAccountConflict = errors.New("auth: oauth account conflict")

+ var HTTPErrInvalidTokenRS = HTTPError

+ var HTTPErrOAuthEmailDomainNotAllowed = HTTPError

+ var HTTPErrOAuthEmailNotVerified = HTTPError

+ var HTTPErrOAuthUserNotProvisioned = HTTPError

+ func ContextWithUser(ctx context.Context, user User) context.Context

+ func ResourceServerGatedRoutes() map[string]string

+ func ResourceServerMiddleware(a *Auth, cfg ResourceServerConfig) func(http.Handler) http.Handler

+ func ResourceServerPrincipal(r *http.Request, a *Auth, client *JWKSClient, issuer string) (User, HTTPError, bool)

+ func VerifyRS256(ctx context.Context, token string, client *JWKSClient, expectedIssuer string) (map[string]any, error)

type Auth

+ func (a *Auth) IDP() *IDP

+ func (a *Auth) JWKSHandler() http.Handler

+ type AuthSettings struct

+ EmailVerificationMode *string

+ EnabledWebhookActions []string

+ LazyEmailVerificationGracePeriodDays *int

+ Require2FA *bool

+ RequireEmailVerification *bool

+ UI *UISettings

+ func MergeSettings(current, patch AuthSettings) AuthSettings

+ func (s AuthSettings) MarshalJSON() ([]byte, error)

type Config

+ Settings SettingsStore

type HTTPConfig

+ ResourceServer bool

+ func (c HTTPConfig) AccountConflictLink(siteURL, provider, email string) string

type IDP

+ func (idp *IDP) JWKSHandler() http.Handler

+ func (idp *IDP) JWKSPath() string

type IDPConfig

+ JWKSCORSOrigins []string

+ JWKSPath string

+ JWKSURL string

type JWK

+ func (j JWK) RSAPublicKey() (*rsa.PublicKey, error)

+ type JWKSClient struct

+ func NewJWKSClient(cfg ResourceServerConfig) *JWKSClient

+ func (c *JWKSClient) Document(ctx context.Context) (JWKS, error)

+ func (c *JWKSClient) GetKey(ctx context.Context, kid string) (*rsa.PublicKey, error)

+ func (c *JWKSClient) Invalidate()

+ func (c *JWKSClient) URL() string

+ type MemorySettingsStore struct

+ func NewMemorySettingsStore() *MemorySettingsStore

+ func (s *MemorySettingsStore) GetSettings(_ context.Context) (AuthSettings, error)

+ func (s *MemorySettingsStore) UpdateSettings(_ context.Context, patch AuthSettings) (AuthSettings, error)

+ type OAuthAccountConflictError struct

+ Email string

+ Provider string

+ ProviderAccountID string

+ func (e *OAuthAccountConflictError) Error() string

+ func (e *OAuthAccountConflictError) Unwrap() error

+ type OAuthProvisioning struct

+ AllowedEmailDomains []string

+ AutoCreate bool

+ FieldMap map[string]string

+ OnEmailMatch string

+ RequireVerifiedEmail bool

+ func DefaultOAuthProvisioning() OAuthProvisioning

+ func (p OAuthProvisioning) Validate() error

type OAuthService

+ func (s *OAuthService) HandleCallbackWithPolicy(ctx context.Context, authSvc *Service, linkedAccounts LinkedAccountStore, ...) (User, AuthTokens, error)

type OAuthWiring

+ Provisioning *OAuthProvisioning

type OpenAPIInfo

+ IDProvider bool

+ JWKSPath string

+ ResourceServer bool

type Option

+ func WithIDP(idp *IDP) Option

+ func WithSettingsStore(store SettingsStore) Option

+ type ResourceServerConfig struct

+ CacheTTL time.Duration

+ Client *http.Client

+ FetchTimeout time.Duration

+ Issuer string

+ JWKSURL string

+ MinRefreshInterval time.Duration

+ type SettingsStore interface

+ GetSettings func(ctx context.Context) (AuthSettings, error)

+ UpdateSettings func(ctx context.Context, patch AuthSettings) (AuthSettings, error)

+ type UISettings struct

+ BgColor *string

+ BgImage *string

+ CardBg *string

+ LogoPath *string

+ LogoURL *string

+ PrimaryColor *string

+ SecondaryColor *string

+ SiteName *string

type User

+ func UserFromContext(ctx context.Context) (User, bool)

+ func UserFromRS256Claims(claims map[string]any) User

v0.5.0

Sep 11, 2026

Changes in this version

+ const ClaimsWebhookEvent

+ const DefaultIDPKeyID

+ func BuildRS256JWT(signer crypto.Signer, kid string, claims map[string]any) (string, error)

+ func ParseRSAPrivateKeyPEM(pemText string) (*rsa.PrivateKey, error)

type Auth

+ func (a *Auth) Authenticate(ctx context.Context, accessToken string) (User, error)

+ type ClaimsWebhook struct

+ Client *http.Client

+ Secret string

+ Timeout time.Duration

+ URL string

+ func NewClaimsWebhook(rawURL, secret string) (*ClaimsWebhook, error)

+ func (w *ClaimsWebhook) Build(ctx context.Context, user User) (map[string]any, error)

type IDP

+ func (idp *IDP) IssueIdPTokenPair(ctx context.Context, user User) (AuthTokens, error)

+ func (idp *IDP) JWKS() JWKS

type IDPConfig

+ KeyID string

+ Logger func(format string, args ...any)

+ PublicKeys []JWK

+ RefreshTokenTTL time.Duration

+ Signer crypto.Signer

+ type JWK struct

+ Alg string

+ E string

+ Kid string

+ Kty string

+ N string

+ Use string

+ func NewRSAJWK(pub *rsa.PublicKey, kid string) (JWK, error)

+ type JWKS struct

+ Keys []JWK

type Service

+ func (s *Service) Authenticate(ctx context.Context, accessToken string) (User, error)

+ type TokenClaimsBuilder = func(ctx context.Context, user User) (map[string]any, error)

+ func ChainClaims(builders ...TokenClaimsBuilder) TokenClaimsBuilder

+ func StaticClaims(claims map[string]any) TokenClaimsBuilder

+ func UserFieldClaims(fields map[string]string) (TokenClaimsBuilder, error)

v0.4.0

Sep 11, 2026

Changes in this version

+ const DeliveryKindEmailChange

+ const DeliveryKindEmailVerification

+ const DeliveryKindMagicLink

+ const DeliveryKindPasswordReset

+ const DeliveryKindSMSCode

+ const LoginProviderLocal

+ const TOTPAlgorithm

+ const TOTPDigits

+ const TOTPPeriod

+ const TOTPSkew

+ const TemplateEmailChanged

+ const TemplateInvitation

+ const TemplateMagicLink

+ const TemplatePasswordReset

+ const TemplateVerifyEmail

+ const TemplateWelcome

+ func CompileProfileMap(m map[string]string) (func(map[string]any) (OAuthUserInfo, error), error)

type Auth

+ func (a *Auth) ResolveSiteURL(r *http.Request) string

+ type AuthCode struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ CodeHash string

+ ExpiresAt time.Time

+ Nonce string

+ RedirectURI string

+ Scope string

+ TenantID string

+ UserID string

+ type AuthCodeStore interface

+ ConsumeCode func(ctx context.Context, codeHash string) (AuthCode, error)

+ SaveCode func(ctx context.Context, code AuthCode) error

type ChangeEmailRequestInput

+ Lang string

+ LinkBase string

type Config

+ SendEmailChanged EmailChangedSender

+ SiteURLs []string

+ Templates TemplateStore

+ TwoFactorAppName string

type ConfirmEmailChangeInput

+ Lang string

+ type DeliveryWebhook struct

+ Client *http.Client

+ Secret string

+ Timeout time.Duration

+ URL string

+ func NewDeliveryWebhook(rawURL, secret string) (*DeliveryWebhook, error)

+ func (w *DeliveryWebhook) SendEmailChange(ctx context.Context, delivery EmailChangeDelivery) error

+ func (w *DeliveryWebhook) SendEmailVerification(ctx context.Context, delivery EmailVerificationDelivery) error

+ func (w *DeliveryWebhook) SendMagicLink(ctx context.Context, delivery MagicLinkDelivery) error

+ func (w *DeliveryWebhook) SendPasswordReset(ctx context.Context, delivery PasswordResetDelivery) error

+ func (w *DeliveryWebhook) SendSMSCode(ctx context.Context, delivery SMSCodeDelivery) error

+ type DeliveryWebhookRequest struct

+ Delivery json.RawMessage

+ Kind string

type EmailChangeDelivery

+ Lang string

+ LinkBase string

+ type EmailChangedDelivery struct

+ Lang string

+ NewEmail string

+ OldEmail string

+ TenantID string

+ UserID string

+ type EmailChangedMailer struct

+ Locale string

+ Templates *MailTemplater

+ Transport MailerTransport

+ func NewEmailChangedMailer(transport MailerTransport, appName string) *EmailChangedMailer

+ func (m *EmailChangedMailer) Send(ctx context.Context, delivery EmailChangedDelivery) error

+ type EmailChangedSender func(ctx context.Context, delivery EmailChangedDelivery) error

type EmailVerificationDelivery

+ Lang string

+ LinkBase string

type EmailVerificationInput

+ Lang string

+ LinkBase string

type ForgotPasswordInput

+ Lang string

+ LinkBase string

type HTTPConfig

+ UIEnabled bool

+ func (c HTTPConfig) LinkBase(siteURL string) string

+ func (c HTTPConfig) UILink(siteURL, path string) string

type IDPConfig

+ CodeTTL time.Duration

+ Codes AuthCodeStore

type MagicLinkDelivery

+ Lang string

+ LinkBase string

type MagicLinkSendInput

+ Lang string

+ LinkBase string

type MailMessage

+ Text string

+ type MailRendered struct

+ HTML string

+ Subject string

+ Text string

+ type MailTemplate struct

+ BaseHTML string

+ BaseText string

+ ID string

+ Translations map[string]map[string]string

type MailTemplateData

+ NewEmail string

+ OldEmail string

+ type MailTemplatePatch struct

+ BaseHTML *string

+ BaseText *string

+ Translations map[string]map[string]string

type MailTemplater

+ Store TemplateStore

+ func (t *MailTemplater) Register(locale, id, subject, html, text string)

+ func (t *MailTemplater) RenderMail(ctx context.Context, locale, id string, data MailTemplateData) (MailRendered, error)

+ type MailerConfig struct

+ APIKey string

+ Client *http.Client

+ DefaultLang string

+ Endpoint string

+ From string

+ FromName string

+ Provider string

type MailerTransport

+ func NewGatewayMailerTransport(cfg MailerConfig) (MailerTransport, error)

+ type MemoryAuthCodeStore struct

+ func NewMemoryAuthCodeStore() *MemoryAuthCodeStore

+ func (s *MemoryAuthCodeStore) ConsumeCode(_ context.Context, codeHash string) (AuthCode, error)

+ func (s *MemoryAuthCodeStore) SaveCode(_ context.Context, code AuthCode) error

+ type MemoryTemplateStore struct

+ func NewMemoryTemplateStore() *MemoryTemplateStore

+ func (s *MemoryTemplateStore) GetMailTemplate(_ context.Context, id string) (MailTemplate, bool, error)

+ func (s *MemoryTemplateStore) GetUITranslations(_ context.Context, page string) (UITranslation, bool, error)

+ func (s *MemoryTemplateStore) ListMailTemplates(_ context.Context) ([]MailTemplate, error)

+ func (s *MemoryTemplateStore) ListUITranslations(_ context.Context) ([]UITranslation, error)

+ func (s *MemoryTemplateStore) UpdateMailTemplate(_ context.Context, id string, patch MailTemplatePatch) (MailTemplate, error)

+ func (s *MemoryTemplateStore) UpdateUITranslations(_ context.Context, page string, translations map[string]map[string]string) (UITranslation, error)

type OAuthProvider

+ AdditionalAuthParams map[string]string

+ GitHubEmailsURL string

+ MapProfile func(raw map[string]any) (OAuthUserInfo, error)

+ ProfileMap map[string]string

type OAuthService

+ func NewOAuthServiceWithConfig(providers ...OAuthProvider) (*OAuthService, error)

type OAuthUserInfo

+ EmailVerified *bool

type Option

+ func WithEmailChangedSender(sender EmailChangedSender) Option

+ func WithSiteURLs(urls ...string) Option

+ func WithTemplateStore(store TemplateStore) Option

+ func WithTwoFactorAppName(name string) Option

type PasswordResetDelivery

+ Lang string

+ LinkBase string

type PublicUser

+ LoginProvider string

+ type TemplateStore interface

+ GetMailTemplate func(ctx context.Context, id string) (MailTemplate, bool, error)

+ GetUITranslations func(ctx context.Context, page string) (UITranslation, bool, error)

+ ListMailTemplates func(ctx context.Context) ([]MailTemplate, error)

+ ListUITranslations func(ctx context.Context) ([]UITranslation, error)

+ UpdateMailTemplate func(ctx context.Context, id string, patch MailTemplatePatch) (MailTemplate, error)

+ UpdateUITranslations func(ctx context.Context, page string, translations map[string]map[string]string) (UITranslation, error)

+ type UITranslation struct

+ Page string

+ Translations map[string]map[string]string

type User

+ LoginProvider string

v0.3.1

Aug 15, 2026

Changes in this version

type PublicUser

+ Role string

+ Sub string

v0.3.0

Aug 15, 2026

Changes in this version

+ const CodeEmailNotConfigured

+ const CodeSMSNotConfigured

+ const CodeTwoFactorSetupRequired

+ const EmailChangeConfirmPath

+ const EmailVerificationPath

+ const MagicLinkVerifyPath

+ const PasswordResetPath

+ const ReferenceRevision

+ const TwoFactorMethodMagicLink

+ const TwoFactorMethodSMS

+ const TwoFactorMethodTOTP

+ var ErrDeliveryFailed = errors.New("auth: delivery failed after the credential was stored")

+ var ErrEmailNotConfigured = errors.New("auth: email delivery is not configured")

+ var ErrSMSNotConfigured = errors.New("auth: sms delivery is not configured")

+ var HTTPErrEmailNotConfigured = HTTPError

+ var HTTPErrSMSNotConfigured = HTTPError

+ func EmailChangeConfirmURL(base, token string) string

+ func EmailVerificationURL(base, token string) string

+ func MagicLinkURL(base, token string) string

+ func PasswordResetURL(base, token string) string

+ func SMSCodeMessage(code string) string

+ func WriteTwoFactorChallenge(w http.ResponseWriter, challenge TwoFactorChallenge)

+ type APICompatibilityNotes struct

+ BearerConventions string

+ ContractTarget string

+ CookieConventions string

+ KnownDeviations []Deviation

+ ReferenceRevision string

+ func CompatibilityNotes() APICompatibilityNotes

type Auth

+ func (a *Auth) LoginWithChallenge(ctx context.Context, in LoginInput) (LoginResult, error)

+ func (a *Auth) SMSConfigured() bool

type Config

+ SendEmailChange EmailChangeSender

+ SendEmailVerification EmailVerificationSender

+ SendMagicLink MagicLinkSender

+ SendPasswordReset PasswordResetSender

+ SendSMSCode SMSCodeSender

+ type Deviation struct

+ Behaviour string

+ Citations []string

+ ID string

+ Notes []DeviationNote

+ Reference string

+ Surface string

+ Title string

+ Why string

+ type DeviationNote struct

+ Label string

+ Text string

+ type EmailChangeDelivery struct

+ ExpiresAt time.Time

+ NewEmail string

+ TenantID string

+ Token string

+ UserID string

+ type EmailChangeMailer struct

+ func NewEmailChangeMailer(transport MailerTransport, appName, baseURL string) *EmailChangeMailer

+ func (m *EmailChangeMailer) Send(ctx context.Context, delivery EmailChangeDelivery) error

+ type EmailChangeSender func(ctx context.Context, delivery EmailChangeDelivery) error

+ type EmailVerificationDelivery struct

+ Email string

+ ExpiresAt time.Time

+ TenantID string

+ Token string

+ UserID string

+ type EmailVerificationMailer struct

+ func NewEmailVerificationMailer(transport MailerTransport, appName, baseURL string) *EmailVerificationMailer

+ func (m *EmailVerificationMailer) Send(ctx context.Context, delivery EmailVerificationDelivery) error

+ type EmailVerificationSender func(ctx context.Context, delivery EmailVerificationDelivery) error

+ type HTTPSMSTransport struct

+ APIKey string

+ EndpointURL string

+ Password string

+ Username string

+ func NewHTTPSMSTransport(endpointURL, apiKey, username, password string) *HTTPSMSTransport

+ func (t *HTTPSMSTransport) Send(ctx context.Context, phone, message string) error

+ type LoginResult struct

+ Challenge *TwoFactorChallenge

+ Tokens AuthTokens

+ User User

+ type MagicLinkDelivery struct

+ Email string

+ ExpiresAt time.Time

+ TenantID string

+ Token string

+ UserID string

+ type MagicLinkMailer struct

+ BaseURL string

+ Locale string

+ Templates *MailTemplater

+ Transport MailerTransport

+ func NewMagicLinkMailer(transport MailerTransport, appName, baseURL string) *MagicLinkMailer

+ func (m *MagicLinkMailer) Send(ctx context.Context, delivery MagicLinkDelivery) error

+ type MagicLinkSender func(ctx context.Context, delivery MagicLinkDelivery) error

type OpenAPIInfo

+ APIPrefix string

type Option

+ func WithEmailChangeSender(sender EmailChangeSender) Option

+ func WithEmailVerificationSender(sender EmailVerificationSender) Option

+ func WithMagicLinkSender(sender MagicLinkSender) Option

+ func WithPasswordResetSender(sender PasswordResetSender) Option

+ func WithSMSCodeSender(sender SMSCodeSender) Option

+ type PasswordResetDelivery struct

+ Email string

+ ExpiresAt time.Time

+ TenantID string

+ Token string

+ UserID string

+ type PasswordResetMailer struct

+ func NewPasswordResetMailer(transport MailerTransport, appName, baseURL string) *PasswordResetMailer

+ func (m *PasswordResetMailer) Send(ctx context.Context, delivery PasswordResetDelivery) error

+ type PasswordResetSender func(ctx context.Context, delivery PasswordResetDelivery) error

+ type SMSCodeDelivery struct

+ Code string

+ ExpiresAt time.Time

+ Phone string

+ TenantID string

+ UserID string

+ type SMSCodeSender func(ctx context.Context, delivery SMSCodeDelivery) error

+ func SMSTransportSender(transport SMSTransport) SMSCodeSender

+ type SMSTransport interface

+ Send func(ctx context.Context, phone, message string) error

type Service

+ func (s *Service) LoginWithChallenge(ctx context.Context, in LoginInput) (LoginResult, error)

+ type TokenMailer struct

+ BaseURL string

+ Locale string

+ Templates *MailTemplater

+ Transport MailerTransport

+ type TwoFactorChallenge struct

+ Methods []string

+ SetupRequired bool

+ TempToken string

v0.2.0

Aug 10, 2026

Changes in this version

+ const AccessTokenCookieName

+ const AuthStrategyBearer

+ const AuthStrategyHeader

+ const CSRFHeaderName

+ const CSRFTokenCookieName

+ const CodeCSRFInvalid

+ const CodeEmailNotVerified

+ const CodeEmailRequired

+ const CodeInvalidAccessToken

+ const CodeInvalidBody

+ const CodeInvalidCredentials

+ const CodeInvalidLinkToken

+ const CodeInvalidMagicLink

+ const CodeInvalidRefreshToken

+ const CodeInvalidTempToken

+ const CodeInvalidToken

+ const CodeLinkTokenExpired

+ const CodeNotImplemented

+ const CodeOAuthProfileFailed

+ const CodeOAuthStateInvalid

+ const CodeOAuthTokenExchangeFail

+ const CodePasswordRequired

+ const CodePhoneNotSet

+ const CodeSessionRevoked

+ const CodeTempTokenRequired

+ const CodeTokenMismatch

+ const CodeTokenRequired

+ const CodeTwoFactorRequired

+ const CodeUnauthorized

+ const CodeUserExists

+ const CodeUserNotFound

+ const CodeWeakPassword

+ const DefaultAPIPrefix

+ const RefreshTokenCookieName

+ const StepUpMode

+ var ErrMagicLinkOwnerMismatch = errors.New("auth: magic link belongs to another user")

+ var HTTPErrCSRFInvalid = HTTPError

+ var HTTPErrChangeEmailStoreMissing = HTTPError

+ var HTTPErrCurrentPasswordIncorrect = HTTPError

+ var HTTPErrEmailAlreadyVerified = HTTPError

+ var HTTPErrEmailInUse = HTTPError

+ var HTTPErrEmailNotVerified = HTTPError

+ var HTTPErrEmailVerificationStoreMissing = HTTPError

+ var HTTPErrExpiredRefreshToken = HTTPError

+ var HTTPErrInternal = HTTPError

+ var HTTPErrInvalidAccessToken = HTTPError

+ var HTTPErrInvalidBody = HTTPError

+ var HTTPErrInvalidCredentials = HTTPError

+ var HTTPErrInvalidEmailChangeToken = HTTPError

+ var HTTPErrInvalidLinkToken = HTTPError

+ var HTTPErrInvalidMagicLink = HTTPError

+ var HTTPErrInvalidRefreshToken = HTTPError

+ var HTTPErrInvalidResetToken = HTTPError

+ var HTTPErrInvalidSMSCode = HTTPError

+ var HTTPErrInvalidStepUpToken = HTTPError

+ var HTTPErrInvalidTOTPCode = HTTPError

+ var HTTPErrInvalidTOTPSetupCode = HTTPError

+ var HTTPErrInvalidTempToken = HTTPError

+ var HTTPErrInvalidToken = HTTPError

+ var HTTPErrInvalidVerifyToken = HTTPError

+ var HTTPErrLinkEmailRequired = HTTPError

+ var HTTPErrLinkTokenExpired = HTTPError

+ var HTTPErrLinkUnauthorized = HTTPError

+ var HTTPErrNewPasswordRequired = HTTPError

+ var HTTPErrNoAccessToken = HTTPError

+ var HTTPErrNoRefreshToken = HTTPError

+ var HTTPErrNotImplemented = HTTPError

+ var HTTPErrOAuthState = HTTPError

+ var HTTPErrPasswordRequired = HTTPError

+ var HTTPErrPasswordlessEmailRequired = HTTPError

+ var HTTPErrPhoneNotSet = HTTPError

+ var HTTPErrResetTokenStoreMissing = HTTPError

+ var HTTPErrSessionNotFound = HTTPError

+ var HTTPErrSessionRevoked = HTTPError

+ var HTTPErrTOTPNotSetUp = HTTPError

+ var HTTPErrTargetUserNotFound = HTTPError

+ var HTTPErrTempTokenRequired = HTTPError

+ var HTTPErrTokenMismatch = HTTPError

+ var HTTPErrTokenRequired = HTTPError

+ var HTTPErrTwoFactorRequired = HTTPError

+ var HTTPErrTwoFactorRequiredByPolicy = HTTPError

+ var HTTPErrTwoFactorRequiredForUser = HTTPError

+ var HTTPErrUserExists = HTTPError

+ var HTTPErrUserIDOrEmailRequired = HTTPError

+ var HTTPErrUserIDRequired = HTTPError

+ var HTTPErrUserNotFound = HTTPError

+ var HTTPErrVerifyTokenRequired = HTTPError

+ var HTTPErrWeakPassword = HTTPError

+ func AccessTokenFromRequest(r *http.Request) string

+ func BearerToken(header string) string

+ func CookieValue(r *http.Request, base string) string

+ func DecodeOptionalJSON(w http.ResponseWriter, r *http.Request, dst any) bool

+ func DecodeOptionalJSONBody(r *http.Request, dst any) error

+ func IsBearerRequest(r *http.Request) bool

+ func OAuthNotConfiguredError(provider string) error

+ func RefreshTokenFromRequest(r *http.Request) string

+ func SessionHandleParam(r *http.Request, raw string) string

+ func TwoFactorMode(mode string) bool

+ func VerifyEmailToken(r *http.Request) string

+ func WriteHTTPError(w http.ResponseWriter, e HTTPError)

+ func WriteJSON(w http.ResponseWriter, status int, payload any)

+ func WriteServiceError(w http.ResponseWriter, err error)

+ func WriteSuccess(w http.ResponseWriter, status int, extra map[string]any)

+ type AddPhoneInput struct

+ PhoneNumber string

+ TenantID string

+ UserID string

type Auth

+ func NewWithConfig(cfg Config, opts ...Option) (*Auth, error)

+ func (a *Auth) ChangePassword(ctx context.Context, in ChangePasswordInput) error

+ func (a *Auth) CleanupExpiredSessions(ctx context.Context) (int, error)

+ func (a *Auth) ConfirmEmailChange(ctx context.Context, in ConfirmEmailChangeInput) error

+ func (a *Auth) DisableTOTP(ctx context.Context, userID, tenantID string) error

+ func (a *Auth) FindUser(ctx context.Context, userID, email, tenantID string) (User, error)

+ func (a *Auth) ForgotPassword(ctx context.Context, in ForgotPasswordInput) (string, error)

+ func (a *Auth) IssueTempToken(ctx context.Context, user User) (string, error)

+ func (a *Auth) IssueTokensForUser(ctx context.Context, userID, tenantID string) (User, AuthTokens, error)

+ func (a *Auth) LinkRequest(ctx context.Context, in LinkRequestInput) (LinkRequestResult, error)

+ func (a *Auth) LinkVerify(ctx context.Context, in LinkVerifyInput) (LinkVerifyResult, error)

+ func (a *Auth) ListLinkedAccounts(ctx context.Context, userID string) ([]PublicLinkedAccount, error)

+ func (a *Auth) ListSessions(ctx context.Context, userID, tenantID string) ([]Session, error)

+ func (a *Auth) LogoutAccessToken(ctx context.Context, accessToken string) error

+ func (a *Auth) LogoutRequest(ctx context.Context, r *http.Request)

+ func (a *Auth) OAuthBegin(ctx context.Context, in OAuthBeginInput) (OAuthBeginResult, error)

+ func (a *Auth) OAuthComplete(ctx context.Context, in OAuthCompleteInput) (OAuthCompleteResult, error)

+ func (a *Auth) OAuthConfigured() bool

+ func (a *Auth) RequestEmailChange(ctx context.Context, in ChangeEmailRequestInput) (string, error)

+ func (a *Auth) ResetPassword(ctx context.Context, in ResetPasswordInput) error

+ func (a *Auth) ResolveHTTPConfig(cfg HTTPConfig) HTTPConfig

+ func (a *Auth) RevokeUserSession(ctx context.Context, userID, tenantID, sessionID string) error

+ func (a *Auth) SendMagicLink(ctx context.Context, in MagicLinkSendInput) (string, error)

+ func (a *Auth) SendSMSCode(ctx context.Context, in SMSCodeSendInput) (string, error)

+ func (a *Auth) SendVerificationEmailToken(ctx context.Context, in EmailVerificationInput) (string, error)

+ func (a *Auth) StartTOTPEnrolment(ctx context.Context, userID, tenantID string) (TOTPSetup, error)

+ func (a *Auth) StepUpSubject(tempToken string, missing, invalid HTTPError) (TempTokenSubject, HTTPError, bool)

+ func (a *Auth) TwoFactorPolicy() bool

+ func (a *Auth) UnlinkAccount(ctx context.Context, userID, provider, providerAccountID string) error

+ func (a *Auth) UpdatePhoneNumber(ctx context.Context, in AddPhoneInput) (User, error)

+ func (a *Auth) VerifyEmail(ctx context.Context, in VerifyEmailInput) error

+ func (a *Auth) VerifyMagicLink(ctx context.Context, in MagicLinkVerifyInput) (User, AuthTokens, error)

+ func (a *Auth) VerifyMagicLinkForUser(ctx context.Context, in MagicLinkVerifyInput, userID string) (User, AuthTokens, error)

+ func (a *Auth) VerifySMSCode(ctx context.Context, in SMSCodeVerifyInput) (User, AuthTokens, error)

+ func (a *Auth) VerifyTOTP(ctx context.Context, userID, tenantID, code string) (User, AuthTokens, error)

+ func (a *Auth) VerifyTOTPSetup(ctx context.Context, userID, tenantID, secret, code string) error

type CSRFConfig

+ Enabled bool

type Config

+ BcryptCost int

+ type CookieOptions struct

+ AccessTokenMaxAge time.Duration

+ CSRFTokenMaxAge time.Duration

+ Domain string

+ Path string

+ RefreshTokenMaxAge time.Duration

+ RefreshTokenPath string

+ SameSite http.SameSite

+ Secure bool

+ func DefaultCookieOptions() CookieOptions

+ func (o CookieOptions) ClearAuthCookies(w http.ResponseWriter, includeCSRF bool)

+ func (o CookieOptions) CookieName(base string) string

+ func (o CookieOptions) SetAccessTokenCookie(w http.ResponseWriter, value string)

+ func (o CookieOptions) SetCSRFTokenCookie(w http.ResponseWriter, value string)

+ func (o CookieOptions) SetRefreshTokenCookie(w http.ResponseWriter, value string)

+ type HTTPConfig struct

+ APIPrefix string

+ CSRF CSRFConfig

+ Cookies CookieOptions

+ func DefaultHTTPConfig() HTTPConfig

+ func (c HTTPConfig) Prefix() string

+ func (c HTTPConfig) WriteTokens(w http.ResponseWriter, r *http.Request, status int, tokens AuthTokens, ...)

+ type HTTPError struct

+ Code string

+ Message string

+ Status int

+ func AccessHTTPError(err error) HTTPError

+ func ChangeEmailConfirmHTTPError(err error) HTTPError

+ func ChangeEmailInlineError(user User) (HTTPError, bool)

+ func ChangeEmailRequestHTTPError(err error) HTTPError

+ func ChangePasswordHTTPError(err error) HTTPError

+ func ChangePasswordInlineError(user User, currentPassword, newPassword string) (HTTPError, bool)

+ func ForgotPasswordHTTPError(error) HTTPError

+ func HTTPErrorFor(err error) HTTPError

+ func MagicLinkVerifyHTTPError(err error) HTTPError

+ func OAuthHTTPError(err error) HTTPError

+ func RefreshHTTPError(err error) HTTPError

+ func ResetPasswordHTTPError(err error) HTTPError

+ func SMSVerifyHTTPError(err error) HTTPError

+ func SendVerificationEmailHTTPError(err error) HTTPError

+ func TOTPSetupHTTPError(err error) HTTPError

+ func TOTPVerifyHTTPError(err error) HTTPError

+ func VerifyEmailHTTPError(err error) HTTPError

+ func (e HTTPError) Error() string

+ type LinkRequestInput struct

+ APIPrefix string

+ AccessToken string

+ Email string

+ EmailLang string

+ Origin string

+ Provider string

+ Referer string

+ type LinkRequestResult struct

+ Token string

+ URL string

+ type LinkTokenDelivery struct

+ Email string

+ EmailLang string

+ Provider string

+ Token string

+ URL string

+ type LinkVerifyInput struct

+ LoginAfterLinking bool

+ Token string

+ type LinkVerifyResult struct

+ LoggedIn bool

+ Tokens AuthTokens

+ User User

+ type MemoryPendingLinks struct

+ func NewMemoryPendingLinks() *MemoryPendingLinks

+ func (m *MemoryPendingLinks) Delete(_ context.Context, key string) error

+ func (m *MemoryPendingLinks) Get(_ context.Context, key string) (OAuthPendingMeta, error)

+ func (m *MemoryPendingLinks) Save(_ context.Context, key string, meta OAuthPendingMeta, ttl time.Duration) error

type MemoryUserStore

+ func (s *MemoryUserStore) UpdatePhoneNumber(_ context.Context, userID, tenantID, phoneNumber string) (User, error)

+ type OAuthBeginInput struct

+ Origin string

+ Provider string

+ Referer string

+ ReturnPath string

+ type OAuthBeginResult struct

+ AuthorizationURL string

+ State string

+ type OAuthCompleteInput struct

+ Code string

+ Provider string

+ State string

+ type OAuthCompleteResult struct

+ RedirectTo string

+ Tokens AuthTokens

+ User User

type OAuthLinkedAccount

+ Email string

+ Name string

+ Picture string

type OAuthPendingMeta

+ Email string

+ ExpiresAt time.Time

+ ProviderAccountID string

type OAuthService

+ func (s *OAuthService) AuthorizeURLPKCE(providerName, state, codeChallenge string) (string, error)

+ func (s *OAuthService) ExchangeCodePKCE(ctx context.Context, providerName, code, codeVerifier string) (OAuthUserInfo, error)

+ func (s *OAuthService) Has(name string) bool

+ type OAuthWiring struct

+ AllowedOrigins []string

+ DeliverLinkToken func(ctx context.Context, delivery LinkTokenDelivery) error

+ LinkTokenTTL time.Duration

+ LinkedAccounts LinkedAccountStore

+ PendingLinks PendingLinkStore

+ Service *OAuthService

+ SiteURL string

+ StateTTL time.Duration

+ TenantID string

type Option

+ func WithBcryptCost(cost int) Option

+ func WithOAuth(wiring OAuthWiring) Option

+ func WithSessionCheckOn(mode string) Option

+ type PublicLinkedAccount struct

+ Email string

+ LinkedAt time.Time

+ Name string

+ Picture string

+ Provider string

+ ProviderAccountID string

+ type PublicSession struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ SessionHandle string

+ TenantID string

+ UserID string

+ func NewPublicSession(session Session) PublicSession

+ func NewPublicSessions(sessions []Session) []PublicSession

type Service

+ func (s *Service) FindUser(ctx context.Context, userID, email, tenantID string) (User, error)

+ func (s *Service) IssueTempToken(ctx context.Context, user User) (string, error)

+ func (s *Service) IssueTokensForUser(ctx context.Context, userID, tenantID string) (User, AuthTokens, error)

+ func (s *Service) LogoutAccessToken(ctx context.Context, accessToken string) error

+ func (s *Service) RevokeUserSession(ctx context.Context, userID, tenantID, sessionID string) error

+ func (s *Service) StartTOTPEnrolment(ctx context.Context, userID, tenantID string) (TOTPSetup, error)

+ func (s *Service) TokenTTLs() (access, refresh time.Duration)

+ func (s *Service) UpdatePhoneNumber(ctx context.Context, in AddPhoneInput) (User, error)

+ func (s *Service) VerifyMagicLinkForUser(ctx context.Context, in MagicLinkVerifyInput, userID string) (User, AuthTokens, error)

+ func (s *Service) VerifyTempToken(token string) (TempTokenSubject, error)

+ type TOTPSetup struct

+ OTPAuthURL string

+ Secret string

+ type TempTokenSubject struct

+ TenantID string

+ UserID string

+ type UserPhoneStore interface

+ UpdatePhoneNumber func(ctx context.Context, userID, tenantID, phoneNumber string) (User, error)

v0.1.0

Aug 2, 2026

Changes in this version

+ const EmailVerificationModeLazy

+ const EmailVerificationModeNone

+ const EmailVerificationModeStrict

+ const SessionCheckOnAllCalls

+ const SessionCheckOnNone

+ const SessionCheckOnRefresh

+ var ErrAlreadyExists = errors.New("auth: resource already exists")

+ var ErrEmailNotVerified = errors.New("auth: email not verified")

+ var ErrFeatureNotSupported = errors.New("auth: feature not supported by configured stores")

+ var ErrInvalidCode = errors.New("auth: invalid code")

+ var ErrInvalidCredentials = errors.New("auth: invalid credentials")

+ var ErrInvalidToken = errors.New("auth: invalid token")

+ var ErrRoleNotFound = errors.New("auth: role not found")

+ var ErrSessionNotFound = errors.New("auth: session not found")

+ var ErrSessionRevoked = errors.New("auth: session revoked")

+ var ErrTenantNotFound = errors.New("auth: tenant not found")

+ var ErrTwoFactorRequired = errors.New("auth: two-factor authentication required")

+ var ErrUserExists = errors.New("auth: user already exists")

+ var ErrWeakPassword = errors.New("auth: password is too weak")

+ func APIKeyMiddleware(store APIKeyStore, requiredScopes []string) func(http.Handler) http.Handler

+ func CSRFMiddleware(cfg CSRFConfig) func(http.Handler) http.Handler

+ func GenerateOpenAPISpec(info OpenAPIInfo) map[string]any

+ func ServeAdminUI() http.Handler

+ func ServeAuthJS() http.Handler

+ func ServeAuthUI() http.Handler

+ func ServeSSE(hub *SseHub, channel string) http.HandlerFunc

+ func VerifyWebhookSignature(secret string, body []byte, sigHeader string) error

+ type APIKeyRecord struct

+ AllowedIPs []string

+ ExpiresAt *time.Time

+ ID string

+ IsActive bool

+ KeyHash string

+ LastUsedAt *time.Time

+ Name string

+ Prefix string

+ Scopes []string

+ ServiceID string

+ type APIKeyService struct

+ func NewAPIKeyService() *APIKeyService

+ func (s *APIKeyService) Create(ctx context.Context, store APIKeyStore, name, serviceID string, ...) (rawKey string, record APIKeyRecord, err error)

+ func (s *APIKeyService) Verify(ctx context.Context, store APIKeyStore, rawKey string, ip string, ...) (APIKeyRecord, error)

+ type APIKeyStore interface

+ FindByPrefix func(ctx context.Context, prefix string) (APIKeyRecord, error)

+ Revoke func(ctx context.Context, id string) error

+ Save func(ctx context.Context, key APIKeyRecord) error

+ UpdateLastUsed func(ctx context.Context, id string, when time.Time) error

+ type Auth struct

+ func New(opts ...Option) (*Auth, error)

+ func (a *Auth) DeleteAccount(ctx context.Context, in DeleteAccountInput) error

+ func (a *Auth) Login(ctx context.Context, in LoginInput) (User, AuthTokens, error)

+ func (a *Auth) Logout(ctx context.Context, refreshToken string) error

+ func (a *Auth) Me(ctx context.Context, accessToken string) (User, error)

+ func (a *Auth) Refresh(ctx context.Context, refreshToken string) (AuthTokens, error)

+ func (a *Auth) Register(ctx context.Context, in RegisterInput) (User, AuthTokens, error)

+ func (a *Auth) Service() *Service

+ func (a *Auth) UpdateProfile(ctx context.Context, in UpdateProfileInput) (User, error)

+ type AuthTokens struct

+ AccessToken string

+ ExpiresIn time.Duration

+ RefreshToken string

+ type CSRFConfig struct

+ APIPrefix string

+ CookieName string

+ CookieSameSite http.SameSite

+ CookieSecure bool

+ HeaderName string

+ func DefaultCSRFConfig(apiPrefix string) CSRFConfig

+ type ChangeEmailRequestInput struct

+ NewEmail string

+ TenantID string

+ UserID string

+ type ChangePasswordInput struct

+ CurrentPassword string

+ NewPassword string

+ TenantID string

+ UserID string

+ type Config struct

+ AccessTokenTTL time.Duration

+ BuildTokenClaims func(ctx context.Context, user User) (map[string]any, error)

+ ClockSkew time.Duration

+ EmailChangeTTL time.Duration

+ EmailVerificationMode string

+ EmailVerificationTTL time.Duration

+ Issuer string

+ Logger func(format string, args ...any)

+ MagicLinkTTL time.Duration

+ MinPasswordLen int

+ RefreshTokenTTL time.Duration

+ Require2FA bool

+ ResetTokenTTL time.Duration

+ SMSCodeTTL time.Duration

+ Secret string

+ SessionCheckOn string

+ TempTokenTTL time.Duration

+ func DefaultConfig(secret string) Config

+ type ConfirmEmailChangeInput struct

+ Token string

+ type DeleteAccountInput struct

+ TenantID string

+ UserID string

+ type EmailChangeStore interface

+ ApplyEmailChange func(ctx context.Context, userID, tenantID string) error

+ ClearEmailChangeToken func(ctx context.Context, userID, tenantID string) error

+ GetUserByEmailChangeTokenHash func(ctx context.Context, tokenHash string) (User, error)

+ UpdateEmailChangeToken func(ctx context.Context, userID, tenantID, pendingEmail, tokenHash string, ...) error

+ type EmailVerificationInput struct

+ TenantID string

+ UserID string

+ type EmailVerificationStore interface

+ ClearEmailVerificationToken func(ctx context.Context, userID, tenantID string) error

+ GetUserByEmailVerificationTokenHash func(ctx context.Context, tokenHash string) (User, error)

+ MarkEmailVerified func(ctx context.Context, userID, tenantID string, verified bool) error

+ UpdateEmailVerificationToken func(ctx context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ type Event struct

+ Data map[string]any

+ Name string

+ TenantID string

+ Timestamp time.Time

+ UserID string

+ type EventBus struct

+ func NewEventBus() *EventBus

+ func (b *EventBus) Publish(ev Event)

+ func (b *EventBus) Subscribe(event string, handler func(Event))

+ type ForgotPasswordInput struct

+ Email string

+ TenantID string

+ type HTTPMailerTransport struct

+ EndpointURL string

+ Secret string

+ func NewHTTPMailerTransport(endpointURL, secret string) *HTTPMailerTransport

+ func (t *HTTPMailerTransport) Send(ctx context.Context, msg MailMessage) error

+ type IDP struct

+ func NewIDP(cfg IDPConfig, authSvc *Service, clients ...IDPClient) (*IDP, error)

+ func (idp *IDP) RegisterHandlers(mux *http.ServeMux, basePath string)

+ type IDPClient struct

+ ClientID string

+ ClientSecret string

+ Name string

+ RedirectURIs []string

+ type IDPConfig struct

+ AccessTokenTTL time.Duration

+ IDTokenTTL time.Duration

+ Issuer string

+ type LinkedAccountStore interface

+ Delete func(ctx context.Context, id string) error

+ FindByProvider func(ctx context.Context, provider, providerID string) (OAuthLinkedAccount, error)

+ ListForUser func(ctx context.Context, userID string) ([]OAuthLinkedAccount, error)

+ Save func(ctx context.Context, link OAuthLinkedAccount) error

+ type LoginInput struct

+ Email string

+ Password string

+ TenantID string

+ type MCPServer struct

+ func NewMCPServer(authSvc *Service) *MCPServer

+ func (m *MCPServer) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ type MagicLinkSendInput struct

+ Email string

+ TenantID string

+ type MagicLinkStore interface

+ ClearMagicLinkToken func(ctx context.Context, userID, tenantID string) error

+ GetUserByMagicLinkTokenHash func(ctx context.Context, tokenHash string) (User, error)

+ UpdateMagicLinkToken func(ctx context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ type MagicLinkVerifyInput struct

+ Token string

+ type MailMessage struct

+ Body string

+ IsHTML bool

+ Subject string

+ To string

+ type MailTemplateData struct

+ AppName string

+ Code string

+ Extra map[string]any

+ Token string

+ URL string

+ UserName string

+ type MailTemplater struct

+ func NewMailTemplater(appName string) *MailTemplater

+ func (m *MailTemplater) Render(locale, name string, data MailTemplateData) (subject, body string, err error)

+ type MailerTransport interface

+ Send func(ctx context.Context, msg MailMessage) error

+ type MemoryLinkedAccounts struct

+ func NewMemoryLinkedAccounts() *MemoryLinkedAccounts

+ func (m *MemoryLinkedAccounts) Delete(_ context.Context, id string) error

+ func (m *MemoryLinkedAccounts) FindByProvider(_ context.Context, provider, providerID string) (OAuthLinkedAccount, error)

+ func (m *MemoryLinkedAccounts) ListForUser(_ context.Context, userID string) ([]OAuthLinkedAccount, error)

+ func (m *MemoryLinkedAccounts) Save(_ context.Context, link OAuthLinkedAccount) error

+ type MemoryMetadataStore struct

+ func NewMemoryMetadataStore() *MemoryMetadataStore

+ func (s *MemoryMetadataStore) ClearMetadata(_ context.Context, userID string) error

+ func (s *MemoryMetadataStore) GetMetadata(_ context.Context, userID string) (map[string]any, error)

+ func (s *MemoryMetadataStore) UpdateMetadata(_ context.Context, userID string, metadata map[string]any) error

+ type MemoryRolesPermissionsStore struct

+ func NewMemoryRolesPermissionsStore() *MemoryRolesPermissionsStore

+ func (s *MemoryRolesPermissionsStore) AddPermissionToRole(_ context.Context, role, permission string) error

+ func (s *MemoryRolesPermissionsStore) AddRoleToUser(_ context.Context, userID, role string, tenantID string) error

+ func (s *MemoryRolesPermissionsStore) CreateRole(_ context.Context, role string, permissions []string) error

+ func (s *MemoryRolesPermissionsStore) DeleteRole(_ context.Context, role string) error

+ func (s *MemoryRolesPermissionsStore) GetPermissionsForRole(_ context.Context, role string) ([]string, error)

+ func (s *MemoryRolesPermissionsStore) GetPermissionsForUser(ctx context.Context, userID, tenantID string) ([]string, error)

+ func (s *MemoryRolesPermissionsStore) GetRolesForUser(_ context.Context, userID, tenantID string) ([]string, error)

+ func (s *MemoryRolesPermissionsStore) RemovePermissionFromRole(_ context.Context, role, permission string) error

+ func (s *MemoryRolesPermissionsStore) RemoveRoleFromUser(_ context.Context, userID, role string, tenantID string) error

+ func (s *MemoryRolesPermissionsStore) UserHasPermission(ctx context.Context, userID, permission, tenantID string) (bool, error)

+ type MemorySessionStore struct

+ func NewMemorySessionStore() *MemorySessionStore

+ func (s *MemorySessionStore) CreateSession(_ context.Context, session Session) (Session, error)

+ func (s *MemorySessionStore) DeleteExpiredSessions(_ context.Context, now time.Time) (int, error)

+ func (s *MemorySessionStore) GetSessionByID(_ context.Context, sessionID string) (Session, error)

+ func (s *MemorySessionStore) GetSessionByRefreshTokenHash(_ context.Context, tokenHash string) (Session, error)

+ func (s *MemorySessionStore) ListSessionsForUser(_ context.Context, userID, tenantID string) ([]Session, error)

+ func (s *MemorySessionStore) RevokeSessionByID(_ context.Context, sessionID string) error

+ func (s *MemorySessionStore) UpdateSession(_ context.Context, session Session) error

+ type MemoryTelemetryStore struct

+ func NewMemoryTelemetryStore() *MemoryTelemetryStore

+ func (m *MemoryTelemetryStore) Query(_ context.Context, f TelemetryFilter) ([]TelemetryEvent, error)

+ func (m *MemoryTelemetryStore) Record(_ context.Context, event TelemetryEvent) error

+ type MemoryTenantStore struct

+ func NewMemoryTenantStore() *MemoryTenantStore

+ func (s *MemoryTenantStore) AssociateUserWithTenant(_ context.Context, userID, tenantID string) error

+ func (s *MemoryTenantStore) CreateTenant(_ context.Context, tenant Tenant) (Tenant, error)

+ func (s *MemoryTenantStore) DeleteTenant(_ context.Context, id string) error

+ func (s *MemoryTenantStore) DisassociateUserFromTenant(_ context.Context, userID, tenantID string) error

+ func (s *MemoryTenantStore) GetAllTenants(_ context.Context) ([]Tenant, error)

+ func (s *MemoryTenantStore) GetTenantByID(_ context.Context, id string) (Tenant, error)

+ func (s *MemoryTenantStore) GetTenantsForUser(_ context.Context, userID string) ([]Tenant, error)

+ func (s *MemoryTenantStore) GetUsersForTenant(_ context.Context, tenantID string) ([]string, error)

+ func (s *MemoryTenantStore) UpdateTenant(_ context.Context, id string, update Tenant) error

+ type MemoryUserStore struct

+ func NewMemoryUserStore() *MemoryUserStore

+ func (s *MemoryUserStore) ApplyEmailChange(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) ClearEmailChangeToken(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) ClearEmailVerificationToken(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) ClearMagicLinkToken(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) ClearResetToken(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) ClearSMSCode(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) CreateUser(_ context.Context, user User) (User, error)

+ func (s *MemoryUserStore) DeleteUser(_ context.Context, userID, tenantID string) error

+ func (s *MemoryUserStore) GetUserByEmail(_ context.Context, email, tenantID string) (User, error)

+ func (s *MemoryUserStore) GetUserByEmailChangeTokenHash(_ context.Context, tokenHash string) (User, error)

+ func (s *MemoryUserStore) GetUserByEmailVerificationTokenHash(_ context.Context, tokenHash string) (User, error)

+ func (s *MemoryUserStore) GetUserByID(_ context.Context, id, tenantID string) (User, error)

+ func (s *MemoryUserStore) GetUserByMagicLinkTokenHash(_ context.Context, tokenHash string) (User, error)

+ func (s *MemoryUserStore) GetUserByResetTokenHash(_ context.Context, tokenHash string) (User, error)

+ func (s *MemoryUserStore) GetUserBySMSCodeHash(_ context.Context, userID, tenantID, codeHash string) (User, error)

+ func (s *MemoryUserStore) MarkEmailVerified(_ context.Context, userID, tenantID string, verified bool) error

+ func (s *MemoryUserStore) UpdateEmailChangeToken(_ context.Context, userID, tenantID, pendingEmail, tokenHash string, ...) error

+ func (s *MemoryUserStore) UpdateEmailVerificationToken(_ context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ func (s *MemoryUserStore) UpdateMagicLinkToken(_ context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ func (s *MemoryUserStore) UpdatePassword(_ context.Context, userID, tenantID, passwordHash string) error

+ func (s *MemoryUserStore) UpdateProfile(_ context.Context, userID, tenantID, firstName, lastName string) (User, error)

+ func (s *MemoryUserStore) UpdateResetToken(_ context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ func (s *MemoryUserStore) UpdateSMSCode(_ context.Context, userID, tenantID, codeHash string, expiry time.Time) error

+ func (s *MemoryUserStore) UpdateTOTPSecret(_ context.Context, userID, tenantID, secret string, enabled bool) error

+ type OAuthLinkedAccount struct

+ CreatedAt time.Time

+ ID string

+ Provider string

+ ProviderID string

+ UserID string

+ type OAuthPendingMeta struct

+ Provider string

+ RedirectURL string

+ TenantID string

+ UserID string

+ type OAuthProvider struct

+ AuthURL string

+ ClientID string

+ ClientSecret string

+ Name string

+ RedirectURL string

+ Scopes []string

+ TokenURL string

+ UserInfoURL string

+ func GitHubProvider(clientID, clientSecret, redirectURL string) OAuthProvider

+ func GoogleProvider(clientID, clientSecret, redirectURL string) OAuthProvider

+ type OAuthService struct

+ func NewOAuthService(providers ...OAuthProvider) *OAuthService

+ func (s *OAuthService) AuthorizeURL(providerName, state string) (string, error)

+ func (s *OAuthService) ExchangeCode(ctx context.Context, providerName, code string) (OAuthUserInfo, error)

+ func (s *OAuthService) HandleCallback(ctx context.Context, authSvc *Service, linkedAccounts LinkedAccountStore, ...) (User, AuthTokens, error)

+ type OAuthUserInfo struct

+ AvatarURL string

+ Email string

+ Name string

+ Provider string

+ ProviderID string

+ Raw map[string]any

+ type OpenAPIInfo struct

+ Description string

+ ServerURL string

+ Title string

+ Version string

+ type Option func(*authBuilder) error

+ func WithIssuer(issuer string) Option

+ func WithLogger(fn func(format string, args ...any)) Option

+ func WithMetadataProvider(store UserMetadataStore) Option

+ func WithRBACProvider(store RolesPermissionsStore) Option

+ func WithRequire2FA(enabled bool) Option

+ func WithSecret(secret string) Option

+ func WithSessionStore(store SessionStore) Option

+ func WithTenantProvider(store TenantStore) Option

+ func WithTokenClaimsBuilder(fn func(ctx context.Context, user User) (map[string]any, error)) Option

+ func WithTokenTTLs(access, refresh time.Duration) Option

+ func WithUserStore(store UserStore) Option

+ type PendingLinkStore interface

+ Delete func(ctx context.Context, state string) error

+ Get func(ctx context.Context, state string) (OAuthPendingMeta, error)

+ Save func(ctx context.Context, state string, meta OAuthPendingMeta, ttl time.Duration) error

+ type PublicTenant struct

+ CreatedAt time.Time

+ ID string

+ IsActive bool

+ Name string

+ type PublicUser struct

+ CreatedAt time.Time

+ CustomClaims map[string]any

+ Email string

+ FirstName string

+ ID string

+ IsEmailVerified bool

+ IsTOTPEnabled bool

+ LastName string

+ Metadata map[string]any

+ Permissions []string

+ PhoneNumber string

+ Roles []string

+ TenantID string

+ Tenants []PublicTenant

+ func NewPublicUser(user User) PublicUser

+ type RegisterInput struct

+ Email string

+ Password string

+ TenantID string

+ type ResetPasswordInput struct

+ NewPassword string

+ Token string

+ type RolesPermissionsStore interface

+ AddPermissionToRole func(ctx context.Context, role, permission string) error

+ AddRoleToUser func(ctx context.Context, userID, role string, tenantID string) error

+ CreateRole func(ctx context.Context, role string, permissions []string) error

+ DeleteRole func(ctx context.Context, role string) error

+ GetPermissionsForRole func(ctx context.Context, role string) ([]string, error)

+ GetPermissionsForUser func(ctx context.Context, userID, tenantID string) ([]string, error)

+ GetRolesForUser func(ctx context.Context, userID, tenantID string) ([]string, error)

+ RemovePermissionFromRole func(ctx context.Context, role, permission string) error

+ RemoveRoleFromUser func(ctx context.Context, userID, role string, tenantID string) error

+ UserHasPermission func(ctx context.Context, userID, permission, tenantID string) (bool, error)

+ type SMSCodeSendInput struct

+ Email string

+ TenantID string

+ UserID string

+ type SMSCodeVerifyInput struct

+ Code string

+ Email string

+ TenantID string

+ UserID string

+ type SMSStore interface

+ ClearSMSCode func(ctx context.Context, userID, tenantID string) error

+ GetUserBySMSCodeHash func(ctx context.Context, userID, tenantID, codeHash string) (User, error)

+ UpdateSMSCode func(ctx context.Context, userID, tenantID, codeHash string, expiry time.Time) error

+ type Service struct

+ func NewService(cfg Config, users UserStore, sessions SessionStore, opts ...ServiceOption) (*Service, error)

+ func (s *Service) AddUserToTenant(ctx context.Context, userID, tenantID string) error

+ func (s *Service) AssignRole(ctx context.Context, userID, role, tenantID string) error

+ func (s *Service) ChangePassword(ctx context.Context, in ChangePasswordInput) error

+ func (s *Service) CleanupExpiredSessions(ctx context.Context) (int, error)

+ func (s *Service) ConfirmEmailChange(ctx context.Context, in ConfirmEmailChangeInput) error

+ func (s *Service) CreateRole(ctx context.Context, role string, permissions []string) error

+ func (s *Service) CreateTenant(ctx context.Context, name string, config map[string]any) (Tenant, error)

+ func (s *Service) DeleteAccount(ctx context.Context, in DeleteAccountInput) error

+ func (s *Service) DisableTOTP(ctx context.Context, userID, tenantID string) error

+ func (s *Service) ForgotPassword(ctx context.Context, in ForgotPasswordInput) (string, error)

+ func (s *Service) GetMetadata(ctx context.Context, userID string) (map[string]any, error)

+ func (s *Service) ListSessions(ctx context.Context, userID, tenantID string) ([]Session, error)

+ func (s *Service) Login(ctx context.Context, in LoginInput) (User, AuthTokens, error)

+ func (s *Service) Logout(ctx context.Context, refreshToken string) error

+ func (s *Service) Me(ctx context.Context, accessToken string) (User, error)

+ func (s *Service) Refresh(ctx context.Context, refreshToken string) (AuthTokens, error)

+ func (s *Service) Register(ctx context.Context, in RegisterInput) (User, AuthTokens, error)

+ func (s *Service) RequestEmailChange(ctx context.Context, in ChangeEmailRequestInput) (string, error)

+ func (s *Service) ResetPassword(ctx context.Context, in ResetPasswordInput) error

+ func (s *Service) RevokeSessionByID(ctx context.Context, sessionID string) error

+ func (s *Service) SendMagicLink(ctx context.Context, in MagicLinkSendInput) (string, error)

+ func (s *Service) SendSMSCode(ctx context.Context, in SMSCodeSendInput) (string, error)

+ func (s *Service) SendVerificationEmailToken(ctx context.Context, in EmailVerificationInput) (string, error)

+ func (s *Service) SetupTOTP(ctx context.Context, userID, tenantID string) (string, error)

+ func (s *Service) UpdateMetadata(ctx context.Context, userID string, metadata map[string]any) error

+ func (s *Service) UpdateProfile(ctx context.Context, in UpdateProfileInput) (User, error)

+ func (s *Service) UserHasPermission(ctx context.Context, userID, permission, tenantID string) (bool, error)

+ func (s *Service) VerifyEmail(ctx context.Context, in VerifyEmailInput) error

+ func (s *Service) VerifyMagicLink(ctx context.Context, in MagicLinkVerifyInput) (User, AuthTokens, error)

+ func (s *Service) VerifySMSCode(ctx context.Context, in SMSCodeVerifyInput) (User, AuthTokens, error)

+ func (s *Service) VerifyTOTP(ctx context.Context, userID, tenantID, code string) (User, AuthTokens, error)

+ func (s *Service) VerifyTOTPSetup(ctx context.Context, userID, tenantID, secret, code string) error

+ type ServiceOption func(*Service)

+ func WithMetadataStore(store UserMetadataStore) ServiceOption

+ func WithRolesPermissionsStore(store RolesPermissionsStore) ServiceOption

+ func WithTenantStore(store TenantStore) ServiceOption

+ type Session struct

+ CreatedAt time.Time

+ ExpiresAt time.Time

+ ID string

+ RefreshTokenHash string

+ RevokedAt *time.Time

+ TenantID string

+ UserID string

+ type SessionAdminStore interface

+ DeleteExpiredSessions func(ctx context.Context, now time.Time) (int, error)

+ ListSessionsForUser func(ctx context.Context, userID, tenantID string) ([]Session, error)

+ RevokeSessionByID func(ctx context.Context, sessionID string) error

+ type SessionLookupStore interface

+ GetSessionByID func(ctx context.Context, sessionID string) (Session, error)

+ type SessionStore interface

+ CreateSession func(ctx context.Context, session Session) (Session, error)

+ GetSessionByRefreshTokenHash func(ctx context.Context, tokenHash string) (Session, error)

+ UpdateSession func(ctx context.Context, session Session) error

+ type SseDistributor interface

+ Publish func(ctx context.Context, channel string, msg SseMessage) error

+ Subscribe func(ctx context.Context, channel string) (<-chan SseMessage, error)

+ type SseHub struct

+ func NewSseHub() *SseHub

+ func (h *SseHub) Publish(_ context.Context, channel string, msg SseMessage) error

+ func (h *SseHub) Subscribe(_ context.Context, channel string) (<-chan SseMessage, error)

+ func (h *SseHub) Unsubscribe(channel string, ch <-chan SseMessage)

+ type SseMessage struct

+ Data map[string]any

+ Event string

+ ID string

+ type TOTPStore interface

+ UpdateTOTPSecret func(ctx context.Context, userID, tenantID, secret string, enabled bool) error

+ type TelemetryEvent struct

+ Error string

+ EventName string

+ ID string

+ IP string

+ Meta map[string]any

+ Success bool

+ TenantID string

+ Timestamp time.Time

+ UserAgent string

+ UserID string

+ type TelemetryFilter struct

+ EventName string

+ Limit int

+ Since time.Time

+ TenantID string

+ Until time.Time

+ UserID string

+ type TelemetryStore interface

+ Query func(ctx context.Context, filter TelemetryFilter) ([]TelemetryEvent, error)

+ Record func(ctx context.Context, event TelemetryEvent) error

+ type Tenant struct

+ Config map[string]any

+ CreatedAt time.Time

+ ID string

+ IsActive bool

+ Name string

+ type TenantStore interface

+ AssociateUserWithTenant func(ctx context.Context, userID, tenantID string) error

+ CreateTenant func(ctx context.Context, tenant Tenant) (Tenant, error)

+ DeleteTenant func(ctx context.Context, id string) error

+ DisassociateUserFromTenant func(ctx context.Context, userID, tenantID string) error

+ GetAllTenants func(ctx context.Context) ([]Tenant, error)

+ GetTenantByID func(ctx context.Context, id string) (Tenant, error)

+ GetTenantsForUser func(ctx context.Context, userID string) ([]Tenant, error)

+ GetUsersForTenant func(ctx context.Context, tenantID string) ([]string, error)

+ UpdateTenant func(ctx context.Context, id string, update Tenant) error

+ type UpdateProfileInput struct

+ FirstName string

+ LastName string

+ TenantID string

+ UserID string

+ type User struct

+ CreatedAt time.Time

+ CustomClaims map[string]any

+ Email string

+ EmailChangeTokenExpiry *time.Time

+ EmailChangeTokenHash string

+ EmailVerificationTokenExpiry *time.Time

+ EmailVerificationTokenHash string

+ FirstName string

+ ID string

+ IsEmailVerified bool

+ IsTOTPEnabled bool

+ LastName string

+ MagicLinkTokenExpiresAt *time.Time

+ MagicLinkTokenHash string

+ Metadata map[string]any

+ PasswordHash string

+ PendingEmail string

+ Permissions []string

+ PhoneNumber string

+ Require2FA bool

+ ResetTokenExpiresAt *time.Time

+ ResetTokenHash string

+ Role string

+ Roles []string

+ SMSCodeExpiresAt *time.Time

+ SMSCodeHash string

+ TOTPSecret string

+ TenantID string

+ Tenants []Tenant

+ UpdatedAt time.Time

+ type UserAccountStore interface

+ DeleteUser func(ctx context.Context, userID, tenantID string) error

+ UpdateProfile func(ctx context.Context, userID, tenantID, firstName, lastName string) (User, error)

+ type UserMetadataStore interface

+ ClearMetadata func(ctx context.Context, userID string) error

+ GetMetadata func(ctx context.Context, userID string) (map[string]any, error)

+ UpdateMetadata func(ctx context.Context, userID string, metadata map[string]any) error

+ type UserPasswordStore interface

+ ClearResetToken func(ctx context.Context, userID, tenantID string) error

+ GetUserByResetTokenHash func(ctx context.Context, tokenHash string) (User, error)

+ UpdatePassword func(ctx context.Context, userID, tenantID, passwordHash string) error

+ UpdateResetToken func(ctx context.Context, userID, tenantID, tokenHash string, expiry time.Time) error

+ type UserStore interface

+ CreateUser func(ctx context.Context, user User) (User, error)

+ GetUserByEmail func(ctx context.Context, email, tenantID string) (User, error)

+ GetUserByID func(ctx context.Context, id, tenantID string) (User, error)

+ type VerifyEmailInput struct

+ Token string

+ type WebhookDispatcher struct

+ func NewWebhookDispatcher(endpoints ...WebhookEndpoint) *WebhookDispatcher

+ func (d *WebhookDispatcher) Dispatch(ctx context.Context, event Event)

+ type WebhookEndpoint struct

+ Events []string

+ ID string

+ Secret string

+ URL string

+ type WebhookPayload struct

+ Data map[string]any

+ Event string

+ ID string

+ Timestamp time.Time

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL