hostauth

Documentation

Overview

Package hostauth verifies the host OS's own credentials. The application stores no passwords — every authentication goes through the OS subsystem (Open Directory on macOS, PAM on Linux, SAM on Windows) so the same password that unlocks the machine is what unlocks remote superadmin.

Index

• Variables
• func CurrentDisplayName() string
• func CurrentUser() (string, error)
• type Authenticator
  • func DefaultAuthenticator() Authenticator
• type StubAuth
  • func (s StubAuth) Authenticate(user, pass string) error

Variables

var ErrInvalidCredentials = errors.New("invalid credentials")

ErrInvalidCredentials is returned when the OS rejects the supplied username/password pair.

var ErrNotImplemented = errors.New("host auth not implemented on this OS")

ErrNotImplemented is returned by the stub OS implementations until real per-platform authenticators land (Linux PAM and Windows LogonUserW are follow-up tasks; v1 ships macOS only).

Functions

func CurrentDisplayName

func CurrentDisplayName() string

CurrentDisplayName returns the GECOS / "full name" of the agent's OS user (e.g. "Alice Smith"). May be empty on stripped-down systems; the portal falls back to the username in that case.

func CurrentUser

func CurrentUser() (string, error)

CurrentUser returns the agent process's own username — used as the canonical "this host's account". The matrix-agent runs as a user-level service, so this is the account the in-process shell will inherit.

Types

type Authenticator

type Authenticator interface {
	Authenticate(username, password string) error
}

Authenticator verifies a username/password pair against the host OS. Implementations live in per-OS files (hostauth_<goos>.go).

func DefaultAuthenticator

func DefaultAuthenticator() Authenticator

DefaultAuthenticator on Linux uses PAM. The service name defaults to "login" but is overridable with MATRIX_PAM_SERVICE for distros that expose a more specific auth-only stack (e.g. "common-auth", "system-auth"). Build with CGO_ENABLED=1 and libpam-dev installed.

type StubAuth

type StubAuth struct {
	Want map[string]string // username → expected password
}

StubAuth always returns the configured result. Tests inject this so we don't shell out to dscl during unit/integration tests.

func (StubAuth) Authenticate

func (s StubAuth) Authenticate(user, pass string) error