Documentation
¶
Index ¶
- Variables
- type GoogleProvider
- type MicrosoftProvider
- func (p *MicrosoftProvider) AuthCodeURL(state string) string
- func (p *MicrosoftProvider) ExchangeCode(ctx context.Context, code string) (*oauth2.Token, error)
- func (p *MicrosoftProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
- func (p *MicrosoftProvider) Name() string
- type Module
- func (m *Module) Add() []any
- func (m *Module) AssignLANIP(userID, ip, label string) error
- func (m *Module) AssignPermission(roleID, permissionID string) error
- func (m *Module) AssignRole(userID, roleID string) error
- func (m *Module) Authenticate() router.Middleware
- func (m *Module) BeginOAuth(providerName string) (string, error)
- func (m *Module) Bootstrap(s Seed) error
- func (m *Module) Can(userID string, resource model.Resource, action model.Action) bool
- func (m *Module) CompleteOAuth(providerName string, ctx router.Context, ip, ua string) (user.User, bool, error)
- func (m *Module) CreatePermission(id, name string, resource model.Resource, action model.Action) error
- func (m *Module) CreateRole(id string, code model.RoleCode, name, description string) error
- func (m *Module) CreateSession(userID, ip, userAgent string) (user.Session, error)
- func (m *Module) DeletePermission(id string) error
- func (m *Module) DeleteRole(id string) error
- func (m *Module) DeleteSession(id string) error
- func (m *Module) GenerateAPIToken(userID string, ttl int) (string, error)
- func (m *Module) GetLANIPs(userID string) ([]user.LANIP, error)
- func (m *Module) GetPermission(id string) (*user.Permission, error)
- func (m *Module) GetRole(id string) (*user.Role, error)
- func (m *Module) GetRoleByCode(code model.RoleCode) (*user.Role, error)
- func (m *Module) GetSession(id string) (user.Session, error)
- func (m *Module) GetUser(id string) (user.User, error)
- func (m *Module) GetUserByEmail(email string) (user.User, error)
- func (m *Module) GetUserIdentities(userID string) ([]user.Identity, error)
- func (m *Module) GetUserRoles(userID string) ([]user.Role, error)
- func (m *Module) HasPermission(userID string, resource model.Resource, action model.Action) (bool, error)
- func (m *Module) Login(email, password string) (user.User, error)
- func (m *Module) LoginLAN(rut string, ctx router.Context) (user.User, error)
- func (m *Module) ModelName() string
- func (m *Module) MountAPI(r router.Router)
- func (m *Module) PurgeExpiredOAuthStates() error
- func (m *Module) PurgeExpiredSessions() error
- func (m *Module) PurgeSessionsByUser(userID string) error
- func (m *Module) ReactivateUser(id string) error
- func (m *Module) Register(handlers ...RBACObject) error
- func (m *Module) RegisterLAN(userID, rut string) error
- func (m *Module) RevokeLANIP(userID, ip string) error
- func (m *Module) RevokeRole(userID, roleID string) error
- func (m *Module) RotateSession(oldID, ip, userAgent string) (user.Session, error)
- func (m *Module) SetLog(fn func(...any))
- func (m *Module) SetPassword(userID, password string) error
- func (m *Module) SuspendUser(id string) error
- func (m *Module) Tools() []mcp.Tool
- func (m *Module) UnlinkIdentity(userID, provider string) error
- func (m *Module) UnregisterLAN(userID string) error
- func (m *Module) VerifyPassword(userID, password string) error
- type RBACObject
- type Seed
Constants ¶
This section is empty.
Variables ¶
var ErrJWTSecretRequired = fmt.Err("JWTSecret", "is", "required")
ErrJWTSecretRequired is returned by any token operation attempted without a secret.
var PasswordHashCost = bcrypt.DefaultCost
Functions ¶
This section is empty.
Types ¶
type GoogleProvider ¶
type GoogleProvider struct {
ClientID string
ClientSecret string
RedirectURL string
// contains filtered or unexported fields
}
func (*GoogleProvider) AuthCodeURL ¶
func (p *GoogleProvider) AuthCodeURL(state string) string
func (*GoogleProvider) ExchangeCode ¶
func (*GoogleProvider) GetUserInfo ¶
func (p *GoogleProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
func (*GoogleProvider) Name ¶
func (p *GoogleProvider) Name() string
type MicrosoftProvider ¶
type MicrosoftProvider struct {
ClientID string
ClientSecret string
RedirectURL string
// contains filtered or unexported fields
}
func (*MicrosoftProvider) AuthCodeURL ¶
func (p *MicrosoftProvider) AuthCodeURL(state string) string
func (*MicrosoftProvider) ExchangeCode ¶
func (*MicrosoftProvider) GetUserInfo ¶
func (p *MicrosoftProvider) GetUserInfo(ctx context.Context, token *oauth2.Token) (user.OAuthUserInfo, error)
func (*MicrosoftProvider) Name ¶
func (p *MicrosoftProvider) Name() string
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the user/auth/rbac handle. All backend operations are methods on this type. Created exclusively via New().
func New ¶
New initializes the user/rbac schema, warms the cache, and returns a Module handle. This is the ONLY entry point for this package on the backend.
func (*Module) Add ¶
Add returns all admin-managed CRUDP handlers for registration. The concrete types are private — pass directly to crudp.RegisterHandlers.
Usage: cp.RegisterHandlers(m.Add()...)
func (*Module) AssignLANIP ¶
func (*Module) AssignPermission ¶
func (*Module) AssignRole ¶
func (*Module) Authenticate ¶
func (m *Module) Authenticate() router.Middleware
Authenticate returns a router.Middleware that validates the session (Cookie or Bearer). If valid, it sets the UserId in the context via ctx.SetUserID(id). If invalid, the UserId remains empty ("") indicating an anonymous user.
func (*Module) Bootstrap ¶ added in v0.0.32
Bootstrap seeds the first user and their initial permissions. NO-OP if the users table is already populated. It does not invent roles or wildcards: it only persists what the Seed declares.
func (*Module) Can ¶
Can checks if the userID has permission for the resource/action. It also handles security event notification on failure.
func (*Module) CompleteOAuth ¶
func (*Module) CreatePermission ¶
func (*Module) CreateRole ¶
func (*Module) CreateSession ¶
func (*Module) DeletePermission ¶
func (*Module) DeleteRole ¶
func (*Module) DeleteSession ¶
func (*Module) GenerateAPIToken ¶
GenerateAPIToken creates a signed JWT for API access (MCP clients, IDEs, LLMs). Requires Config.JWTSecret — independent of the configured AuthMode. ttl=0 → 100 years (effectively no expiry). The returned token is used as a Bearer token in Authorization headers.
func (*Module) GetPermission ¶
func (m *Module) GetPermission(id string) (*user.Permission, error)
func (*Module) GetRoleByCode ¶
func (*Module) GetUserByEmail ¶ added in v0.0.32
func (*Module) GetUserIdentities ¶
func (*Module) HasPermission ¶
func (*Module) ModelName ¶ added in v0.0.32
ModelName is the module's identity (model.ModuleNaming), used as the RBAC resource and as the key by which a host registers it.
func (*Module) MountAPI ¶ added in v0.0.32
MountAPI publishes the authentication flows on the host router. The module owns its routes; consumers just Mount it like any other APIModule.
func (*Module) PurgeExpiredOAuthStates ¶
func (*Module) PurgeExpiredSessions ¶
func (*Module) PurgeSessionsByUser ¶
PurgeSessionsByUser deletes all sessions belonging to userID from cache and DB.
func (*Module) ReactivateUser ¶
ReactivateUser sets Status = "active". Evicts user from cache.
func (*Module) Register ¶
func (m *Module) Register(handlers ...RBACObject) error
func (*Module) RegisterLAN ¶
func (*Module) RevokeLANIP ¶
func (*Module) RevokeRole ¶
func (*Module) RotateSession ¶
RotateSession atomically deletes the old session and creates a new one with the same userID, updated IP/UserAgent, and a fresh TTL. Prevents session fixation attacks when called post-login.
func (*Module) SetLog ¶
SetLog configures optional logging. Call immediately after New(). Default: no-op. Follows the tinywasm ecosystem SetLog convention (same as rbac).
Example:
m.SetLog(func(msg ...any) { log.Println(msg...) })
func (*Module) SetPassword ¶
func (*Module) SuspendUser ¶
SuspendUser sets Status = "suspended". Evicts user from cache.
Source Files