Versions in this module Expand all Collapse all v0 v0.3.0 Aug 24, 2026 Changes in this version + const CookieName + const LoginStateCookie + const LoginStateTTL + const ScopeAdmin + const ScopeRead + const ScopeSubmit + const TokenPrefix + var ErrExternalRejected = errors.New("auth: external login rejected") + var ErrInvalidCredentials = errors.New("auth: invalid credentials") + var ErrInvalidHash = errors.New("auth: invalid password hash") + var ErrInvalidToken = errors.New("auth: invalid token") + var ErrNoLoginState = errors.New("auth: no such login state") + var ErrNoSession = errors.New("auth: no such session") + var ErrTokenExpired = errors.New("auth: token expired") + var ErrTokenScope = errors.New("auth: token carries an unrecognized scope") + var ErrUserBanned = errors.New("auth: token owner is banned") + func BurnHash(ctx context.Context, password string) error + func ConfigureHashGate(n int, maxWait time.Duration) + func DefaultHashConcurrency() int + func GenerateToken() (plaintext, hash, prefix string, err error) + func HashPassword(ctx context.Context, password string) (string, error) + func IsCommonPassword(pw string) bool + func NeedsRehash(encoded string) bool + func ValidateScopes(scopes []string) error + func VerifyPassword(ctx context.Context, password, encoded string) (bool, error) + func WithIdentity(ctx context.Context, id Identity) context.Context + type AuthMethod string + const AuthSession + const AuthToken + type AuthProvider interface + Authenticate func(ctx context.Context, identifier, secret string) (userID uuid.UUID, err error) + Name func() string + type EmailPasswordProvider struct + func NewEmailPasswordProvider(q *gen.Queries, ...) *EmailPasswordProvider + func (p *EmailPasswordProvider) Authenticate(ctx context.Context, email, password string) (uuid.UUID, error) + func (p *EmailPasswordProvider) Name() string + type ExternalIdentity struct + Claims map[string]string + Email string + EmailVerified bool + Subject string + Username string + type ExternalResolver struct + func NewExternalResolver(q *gen.Queries, policy ProvisionPolicy, log *slog.Logger) *ExternalResolver + func (r *ExternalResolver) Policy() ProvisionPolicy + func (r *ExternalResolver) Resolve(ctx context.Context, provider string, id ExternalIdentity) (gen.User, error) + type Identity struct + Method AuthMethod + Role string + Scopes []string + SessionToken string + TokenID uuid.UUID + UserID uuid.UUID + func IdentityFrom(ctx context.Context) (Identity, bool) + func (id Identity) IsAdmin() bool + type LoginState struct + Provider string + ProviderState string + type LoginStateStore struct + func NewLoginStateStore(rdb *redis.Client, ttl time.Duration) *LoginStateStore + func (s *LoginStateStore) Consume(ctx context.Context, token string) (LoginState, error) + func (s *LoginStateStore) Mint() (string, error) + func (s *LoginStateStore) Store(ctx context.Context, token, provider, providerState string) error + type ProvisionPolicy string + const ProvisionInviteOnly + const ProvisionOff + const ProvisionOpen + func ParseProvisionPolicy(s string) (ProvisionPolicy, error) + type RedirectProvider interface + Begin func(ctx context.Context, hostState, redirectURI string) (authorizeURL, providerState string, err error) + Complete func(ctx context.Context, state string, params map[string]string) (ExternalIdentity, error) + type Registry struct + func NewRegistry(def AuthProvider) *Registry + func (r *Registry) Default() AuthProvider + func (r *Registry) Deregister(name string) + func (r *Registry) Get(name string) (AuthProvider, bool) + func (r *Registry) HasUsableLogin(emailEnabled bool) bool + func (r *Registry) Names() []string + func (r *Registry) Register(name string, p AuthProvider, override bool) error + type RejectionError struct + Reason string + func (e *RejectionError) Error() string + func (e *RejectionError) Is(target error) bool + type Session struct + CreatedAt time.Time + IP string + Role string + Token string + UA string + UserID uuid.UUID + type SessionStore struct + func NewSessionStore(rdb *redis.Client, ttl time.Duration) *SessionStore + func (s *SessionStore) Create(ctx context.Context, userID uuid.UUID, role, ip, ua string) (Session, error) + func (s *SessionStore) Delete(ctx context.Context, token string) error + func (s *SessionStore) DeleteAllForUser(ctx context.Context, userID uuid.UUID, keepToken string) error + func (s *SessionStore) Get(ctx context.Context, token string) (Session, error) + type TokenAdminMeta struct + UserID uuid.UUID + Username string + type TokenMeta struct + CreatedAt time.Time + ExpiresAt *time.Time + ID uuid.UUID + LastUsedAt *time.Time + Name string + Prefix string + Scopes []string + type TokenService struct + func NewTokenService(q *gen.Queries) *TokenService + func (s *TokenService) Authenticate(ctx context.Context, raw string, now time.Time) (Identity, error) + func (s *TokenService) Create(ctx context.Context, userID uuid.UUID, name string, scopes []string, ...) (plaintext string, meta TokenMeta, err error) + func (s *TokenService) DeleteForUser(ctx context.Context, userID uuid.UUID) error + func (s *TokenService) List(ctx context.Context, userID uuid.UUID) ([]TokenMeta, error) + func (s *TokenService) ListAll(ctx context.Context, limit, offset int32) ([]TokenAdminMeta, int64, error) + func (s *TokenService) Revoke(ctx context.Context, userID, tokenID uuid.UUID) (bool, error) + func (s *TokenService) RevokeAny(ctx context.Context, tokenID uuid.UUID) (bool, error) + func (s *TokenService) Touch(ctx context.Context, id uuid.UUID) error v0.3.0-rc.1 Aug 23, 2026
Go to main page