Versions in this module Expand all Collapse all v0 v0.1.0 Oct 14, 2026 Changes in this version + const AnnotationOrganization + const AppName + const AttrCount + const AttrCountry + const AttrDistanceKm + const AttrElapsed + const AttrError + const AttrFailures + const AttrLimit + const AttrPreviousCountry + const AttrProvider + const AttrReason + const AttrReauthStep + const AttrRuleKey + const AttrScope + const AttrSessionID + const AttrSpeedKmh + const AttrWindow + const CodeDigits + const ColIdentityCreatedAt + const ColIdentityID + const ColIdentityIsPrimary + const ColIdentityKind + const ColIdentityScopeID + const ColIdentityUserID + const ColIdentityValue + const ColIdentityValueRaw + const ColIdentityVerifiedAt + const ColSessionCreatedAt + const ColSessionData + const ColSessionExpiresAt + const ColSessionFactorPending + const ColSessionID + const ColSessionIP + const ColSessionIdleSeconds + const ColSessionImpersonator + const ColSessionLastSeenAt + const ColSessionMaxExpiresAt + const ColSessionPreviousTokenHash + const ColSessionPreviousValidUntil + const ColSessionReauthenticatedAt + const ColSessionRefreshSeconds + const ColSessionRevokedAt + const ColSessionTasks + const ColSessionTokenHash + const ColSessionTransient + const ColSessionUserAgent + const ColSessionUserID + const ColUserCreatedAt + const ColUserID + const ColUserImage + const ColUserName + const ColUserSessionsValidAfter + const ColUserUpdatedAt + const ColVerificationConsumedAt + const ColVerificationCreatedAt + const ColVerificationExpiresAt + const ColVerificationID + const ColVerificationIdentifier + const ColVerificationMeta + const ColVerificationPurpose + const ColVerificationTokenHash + const CorePluginName + const DefaultCodeLength + const DefaultCodeMaxAttempts + const DefaultDeleteAccountPage + const DefaultDeleteAccountTTL + const DefaultFreshWindow + const DefaultMaxDeviceSessions + const DefaultOutboxBatch + const DefaultSecurityBatch + const DefaultSecurityBuffer + const DefaultSecurityFlush + const DefaultSessionCacheTTL + const DefaultStatelessReadInterval + const DefaultSweepRetention + const DefaultTokenRotationGrace + const DefaultTransientIdleTimeout + const DefaultTravelMinDistanceKm + const DefaultTravelSpeedKmh + const DeliveryRetryBase + const DeliveryRetryMax + const DeliveryTimeout + const DetectTimeout + const EngineMySQL + const EnginePostgres + const EngineSQLite + const EnvBaseURL + const EnvFreshWindow + const EnvSecret + const EnvSessionIdle + const EnvSessionMax + const EnvSessionRefresh + const EnvTrustedOrigins + const FetchSiteCrossSite + const HookSourceApp + const IDPrefixDelivery + const IDPrefixIdentity + const IDPrefixSession + const IDPrefixUser + const IDPrefixVerification + const IPv6PrefixBits + const KeyLabelAuthGate + const KeyLabelCodes + const KeyLabelCompactCache + const KeyLabelCookies + const KeyLabelDeliveryOutbox + const KeyLabelOAuthState + const KeyLabelOAuthTokens + const KeyLabelSnapshotCache + const KeyLabelStatelessSessions + const KeyLabelTwoFactor + const MaxCodeLength + const MaxDeliveryAttempts + const MaxGeneratedCodeLength + const MaxImageLength + const MaxImpersonationTTL + const MaxNameLength + const MaxRiskReasonLen + const MaxSessionCacheTTL + const MaxSessionDataSize + const MaxSessionLifetime + const MaxStatelessReadInterval + const MaxTokenRotationGrace + const MinCodeLength + const MinPatternSuffixLabels + const MinSecretSize + const MinVerificationCutoffTTL + const NoSessionRefresh + const PendingSessionTTL + const ReauthStepFailed + const ReauthStepFresh + const ReauthStepSecondFactor + const ScopeGlobal + const ScopePassword + const SealKeySize + const SecurityWriteTimeout + const TableAliasCode + const TableAliasIdentity + const TableAliasSession + const TableAliasUser + const TableAliasVerification + const TableNameCode + const TableNameDeliveryOutbox + const TableNameIdentity + const TableNameMigrations + const TableNameRateLimit + const TableNameSession + const TableNameUser + const TableNameVerification + const WarnCSRFCheckOff + const WarnOriginCheckOff + const WarnServerCallLimitsOff + const WildcardAny + const WildcardHost + const WildcardOne + var ColumnTypeValues = []ColumnType + var CookieNamePattern = regexp.MustCompile(`^[a-z][a-z0-9_]{0,31}$`) + var CoreUserColumns = []string + var DefaultSessionConfig = SessionConfig + var EffectKindValues = []EffectKind + var EnvVars = []string + var ErrAPIKeyRefused = NewError("auth.api_key_refused", http.StatusForbidden, ...) + var ErrAccountDeletionOff = errors.New("auth: account deletion is off; pass auth.WithAccountDeletion") + var ErrAliasConflict = errors.New("auth: table alias conflicts with a registered alias") + var ErrBadCookieName = errors.New("auth: bad cookie name") + var ErrBadHost = fmt.Errorf("auth: allowed host is not a host name") + var ErrBadIdentifier = errors.New("auth: identifier kind is not valid") + var ErrBadOperation = errors.New("auth: operation description is not valid") + var ErrBadOrigin = errors.New("auth: origin is not an absolute URL") + var ErrBadRequest = NewError("auth.bad_request", http.StatusBadRequest, "The request is not valid.") + var ErrBadSchema = errors.New("auth: table schema is not valid") + var ErrBadSessionCheck = errors.New("auth: a session check can use only auth_session and auth_user") + var ErrBadSessionConfig = errors.New("auth: a session duration is negative") + var ErrBadTableName = errors.New("auth: table name is not a valid SQL identifier") + var ErrBadUserTable = errors.New("auth: user table is not valid") + var ErrBotDetected = NewError("auth.bot_blocked", http.StatusForbidden, ...) + var ErrChallengeRequired = NewError("auth.challenge_required", http.StatusPreconditionRequired, ...) + var ErrChecksumMismatch = errors.New("auth: a migration changed after it was applied") + var ErrCodeInvalid = NewError("auth.code_invalid", http.StatusBadRequest, ...) + var ErrColumnConflict = errors.New("auth: two owners for one column") + var ErrDeleteAccountNeedsLink = errors.New(...) + var ErrDeviceSessionNotFound = NewError("auth.device_session_not_found", http.StatusNotFound, ...) + var ErrDuplicateKind = errors.New("auth: two plugins register one identifier kind") + var ErrDuplicateOperation = errors.New("auth: two operations share an id or a route") + var ErrDuplicatePlugin = errors.New("auth: duplicate plugin name") + var ErrEngineNotSupported = errors.New("auth: engine not supported") + var ErrFieldInvalid = NewError("auth.field_invalid", http.StatusBadRequest, ...) + var ErrFreshSessionRequired = NewError("auth.fresh_session_required", http.StatusForbidden, ...) + var ErrGeoBlocked = NewError("auth.geo_blocked", http.StatusForbidden, ...) + var ErrIdentifierInvalid = NewError("auth.identifier_invalid", http.StatusBadRequest, ...) + var ErrIdentityNotFound = NewError("auth.identity_not_found", http.StatusNotFound, "Not found.") + var ErrIdentityTaken = NewError("auth.identity_taken", http.StatusConflict, ...) + var ErrImpersonationRefused = NewError("auth.impersonation_refused", http.StatusForbidden, ...) + var ErrImportFailed = errors.New("auth: some users were not imported") + var ErrImpossibleTravel = NewError("auth.impossible_travel", http.StatusForbidden, ...) + var ErrInternal = NewError("auth.internal", http.StatusInternalServerError, ...) + var ErrLastSignInMethod = NewError("auth.last_sign_in_method", http.StatusConflict, ...) + var ErrMessageDataUndecodable = errors.New("auth: message data cannot be queued: no plugin decodes it for its purpose") + var ErrMissingDependency = errors.New("auth: plugin dependency not registered") + var ErrNilOption = errors.New("auth: an option was given nil; leave the option out to keep its default") + var ErrNoDatabase = errors.New("auth: no database configured; pass auth.WithDB") + var ErrNoDeliverer = errors.New("auth: the identifier kind's plugin cannot deliver messages") + var ErrNoKeys = errors.New("auth: no sealing key given") + var ErrNoNormalizer = errors.New("auth: identifier kind has no normalizer") + var ErrNoRecoveryChannel = NewError("auth.no_recovery_channel", http.StatusConflict, ...) + var ErrNoScope = NewError("auth.no_scope", http.StatusBadRequest, ...) + var ErrNoSecret = errors.New("auth: no secret configured; pass auth.WithSecret or an explicit key") + var ErrNoSignInMethod = errors.New("auth: no sign-in method; add a plugin such as password or oauth") + var ErrNoVerificationSender = errors.New("auth: the identifier's plugin cannot send a verification") + var ErrNonUniqueLogin = errors.New("auth: a sign-in or recovery identifier must be unique") + var ErrNotColumnOwner = errors.New("auth: plugin writes a column it does not own") + var ErrNotVerified = NewError("auth.not_verified", http.StatusConflict, "Verify this first.") + var ErrOperationNotWired = errors.New("auth: operation called before auth.New registered its plugin") + var ErrOriginNotTrusted = NewError("auth.origin_not_trusted", http.StatusForbidden, ...) + var ErrPluginNotRegistered = errors.New("auth: plugin not registered") + var ErrProfileInvalid = NewError("auth.profile_invalid", http.StatusBadRequest, ...) + var ErrRateLimited = NewError("auth.rate_limited", http.StatusTooManyRequests, ...) + var ErrRatePeekUnsupported = errors.New(...) + var ErrRateWindow = errors.New("auth: a rate window must be positive") + var ErrRatesNotReady = errors.New(...) + var ErrReauthTicketInvalid = NewError("auth.reauthentication_ticket_invalid", http.StatusBadRequest, ...) + var ErrReauthUnsupported = NewError("auth.reauthentication_unsupported", http.StatusNotImplemented, ...) + var ErrResourceForbidden = NewError("auth.resource_forbidden", http.StatusForbidden, ...) + var ErrResourceNotFound = NewError("auth.resource_not_found", http.StatusNotFound, "Not found.") + var ErrRiskCheckFailed = NewError("auth.risk_check_unavailable", http.StatusServiceUnavailable, ...) + var ErrSchemaBehind = errors.New("auth: schema is behind the code") + var ErrSealedCorrupt = errors.New("auth: sealed value does not open; was the key changed?") + var ErrSecretTooShort = errors.New("auth: the secret must be at least 32 bytes") + var ErrSessionDataInvalid = errors.New("auth: session data is not JSON") + var ErrSessionDataTooLarge = errors.New("auth: session data exceeds MaxSessionDataSize") + var ErrSessionDataUnavailable = NewError("auth.session_data_unavailable", http.StatusConflict, ...) + var ErrSessionNotFound = errors.New("auth: session not found") + var ErrSessionTaskPending = NewError("auth.session_task_pending", http.StatusForbidden, ...) + var ErrSessionsUnavailable = NewError("auth.sessions_unavailable", http.StatusConflict, ...) + var ErrSignedOut = NewError("auth.signed_out", http.StatusUnauthorized, "Sign in to continue.") + var ErrSuspiciousIP = NewError("auth.ip_blocked", http.StatusForbidden, ...) + var ErrTableNameConflict = errors.New("auth: two tables would share one real name") + var ErrTokenExists = errors.New("auth: verification token already stored") + var ErrTokenInvalid = NewError("auth.token_invalid", http.StatusBadRequest, ...) + var ErrTooManyDeviceSessions = NewError("auth.too_many_device_sessions", http.StatusConflict, ...) + var ErrTrialAbuse = NewError("auth.signup_blocked", http.StatusForbidden, ...) + var ErrUnboundSessionStore = errors.New(...) + var ErrUnknownDialect = errors.New(...) + var ErrUnknownHookTarget = errors.New("auth: hook names an operation that is not registered") + var ErrUnknownOperation = NewError("auth.unknown_operation", http.StatusNotFound, "Not found.") + var ErrUnknownTable = errors.New(...) + var ErrUserExists = errors.New("auth: a user with this id exists") + var ErrUserNotFound = NewError("auth.user_not_found", http.StatusNotFound, "Not found.") + var IdentityCreatedAt = sqlb.Col[time.Time](TableIdentity, ColIdentityCreatedAt) + var IdentityID = sqlb.Col[string](TableIdentity, ColIdentityID) + var IdentityIsPrimary = sqlb.Col[bool](TableIdentity, ColIdentityIsPrimary) + var IdentityKind = sqlb.Col[IdentifierKindName](TableIdentity, ColIdentityKind) + var IdentityScopeID = sqlb.Col[*string](TableIdentity, ColIdentityScopeID) + var IdentityUserID = sqlb.Col[string](TableIdentity, ColIdentityUserID) + var IdentityValue = sqlb.Col[string](TableIdentity, ColIdentityValue) + var IdentityValueRaw = sqlb.Col[string](TableIdentity, ColIdentityValueRaw) + var IdentityVerifiedAt = sqlb.Col[*time.Time](TableIdentity, ColIdentityVerifiedAt) + var KindNamePattern = regexp.MustCompile(`^[a-z][a-z0-9_]{0,30}$`) + var OrphanKindValues = []OrphanKind + var RateActionValues = []RateAction + var RateOutcomeValues = []RateOutcome + var ReauthStepValues = []string + var RequirementValues = []Requirement + var ReservedAliases = []string + var RiskErrorModeValues = []RiskErrorMode + var SecurityKindValues = []SecurityKind + var SecuritySeverityValues = []SecuritySeverity + var SessionAppData = sqlb.Col[AppData](TableSession, ColSessionData) + var SessionCreatedAt = sqlb.Col[time.Time](TableSession, ColSessionCreatedAt) + var SessionEndReasonValues = []SessionEndReason + var SessionExpiresAt = sqlb.Col[time.Time](TableSession, ColSessionExpiresAt) + var SessionFactorPending = sqlb.Col[bool](TableSession, ColSessionFactorPending) + var SessionID = sqlb.Col[string](TableSession, ColSessionID) + var SessionIP = sqlb.Col[string](TableSession, ColSessionIP) + var SessionIdleSeconds = sqlb.Col[int64](TableSession, ColSessionIdleSeconds) + var SessionImpersonator = sqlb.Col[*string](TableSession, ColSessionImpersonator) + var SessionLastSeenAt = sqlb.Col[time.Time](TableSession, ColSessionLastSeenAt) + var SessionMaxExpiresAt = sqlb.Col[*time.Time](TableSession, ColSessionMaxExpiresAt) + var SessionPendingTasks = sqlb.Col[SessionTasks](TableSession, ColSessionTasks) + var SessionPreviousTokenHash = sqlb.Col[[]byte](TableSession, ColSessionPreviousTokenHash) + var SessionPreviousValidUntil = sqlb.Col[*time.Time](TableSession, ColSessionPreviousValidUntil) + var SessionReauthenticatedAt = sqlb.Col[*time.Time](TableSession, ColSessionReauthenticatedAt) + var SessionRefreshSeconds = sqlb.Col[int64](TableSession, ColSessionRefreshSeconds) + var SessionRevokedAt = sqlb.Col[*time.Time](TableSession, ColSessionRevokedAt) + var SessionTokenHash = sqlb.Col[[]byte](TableSession, ColSessionTokenHash) + var SessionTransient = sqlb.Col[bool](TableSession, ColSessionTransient) + var SessionUserAgent = sqlb.Col[string](TableSession, ColSessionUserAgent) + var SessionUserID = sqlb.Col[string](TableSession, ColSessionUserID) + var TableCode = sqlb.Table + var TableDeliveryOutbox = sqlb.Table + var TableIdentity = sqlb.Table + var TableMigrations = sqlb.Table + var TableRateLimit = sqlb.Table + var TableSession = sqlb.Table + var TableUser = sqlb.Table + var TableVerification = sqlb.Table + var TokenDeliveryValues = []TokenDelivery + var UserCreatedAt = sqlb.Col[time.Time](TableUser, ColUserCreatedAt) + var UserID = sqlb.Col[string](TableUser, ColUserID) + var UserImage = sqlb.Col[string](TableUser, ColUserImage) + var UserName = sqlb.Col[string](TableUser, ColUserName) + var UserSessionsValidAfter = sqlb.Col[*time.Time](TableUser, ColUserSessionsValidAfter) + var UserUpdatedAt = sqlb.Col[time.Time](TableUser, ColUserUpdatedAt) + var VerificationConsumedAt = sqlb.Col[*time.Time](TableVerification, ColVerificationConsumedAt) + var VerificationCreatedAt = sqlb.Col[time.Time](TableVerification, ColVerificationCreatedAt) + var VerificationExpiresAt = sqlb.Col[time.Time](TableVerification, ColVerificationExpiresAt) + var VerificationID = sqlb.Col[string](TableVerification, ColVerificationID) + var VerificationIdentifier = sqlb.Col[string](TableVerification, ColVerificationIdentifier) + var VerificationMeta = sqlb.Col[string](TableVerification, ColVerificationMeta) + var VerificationPurpose = sqlb.Col[Purpose](TableVerification, ColVerificationPurpose) + var VerificationTokenHash = sqlb.Col[[]byte](TableVerification, ColVerificationTokenHash) + func BaseURLFor(ctx context.Context) string + func CheckCookieName(name string) error + func CheckEngine(engine string) error + func CurrentScopes(ctx context.Context) (scopes []string, ok bool) + func DecodeSessionData[T any](d AppData) (v T, ok bool, err error) + func DeriveSecretKeys(label string, secrets ...[]byte) ([][]byte, error) + func DetectDialect(ctx context.Context, db *sql.DB) (sqlb.Dialect, error) + func DeviceKey(userAgent string) string + func ErrorCodeConflicts() []string + func ExpectedSchema(ms []Migration) map[string][]string + func HasScope(ctx context.Context, scope string) bool + func HashToken(t Token) []byte + func IdentityBindings(dst *Identity) []sqlb.Binding + func IsUniqueViolation(err error) bool + func NewID(prefix string) (string, error) + func Open(key []byte, sealed, aad string) ([]byte, error) + func OriginOf(raw string) string + func PickLocale[T any](byLocale map[string]T, locale string) (T, bool) + func PluginOf[T Plugin](a *Auth) (T, error) + func Quiet(ctx context.Context) context.Context + func RateLimitedFor(retry time.Duration) error + func RefuseNilEach[T any](o *OptionErrors, name string, vs []T) bool + func RequestCookie(ctx context.Context, name string) (string, bool) + func RequestHeader(ctx context.Context, name string) string + func RequestHost(ctx context.Context) string + func RequestTokenRejected(ctx context.Context) bool + func RetryAfter(err error) (time.Duration, bool) + func ScopeFrom(ctx context.Context) (string, bool) + func Seal(key, plain []byte, aad string) (string, error) + func SessionBindings(dst *Session) []sqlb.Binding + func SessionData[T any](ctx context.Context) (v T, ok bool, err error) + func SetSessionData(ctx context.Context, a *Auth, v any) error + func SetUserColumn[T any](ctx context.Context, a *Auth, plugin, userID string, col sqlb.Expr[T], v T) error + func TruncateRunes(s string, n int) string + func UserBindings(dst *User) []sqlb.Binding + func UserRateKey(_ context.Context, c *Call) (string, error) + func VerificationBindings(dst *Verification) []sqlb.Binding + func VerifiedIdentity() sqlb.Predicate + func WithScope(ctx context.Context, tenantID string) context.Context + type AccountDeletion struct + ConfirmByLink bool + Link func(t Token) string + LinkTTL time.Duration + type AppData []byte + func EncodeSessionData(v any) (AppData, error) + func (d *AppData) Scan(src any) error + func (d *AppData) UnmarshalJSON(b []byte) error + func (d AppData) MarshalJSON() ([]byte, error) + func (d AppData) Value() (driver.Value, error) + type Auth struct + func New(opts ...Option) (*Auth, error) + func (a *Auth) AfterCommit(ctx context.Context, fn func(context.Context)) + func (a *Auth) AfterTx(ctx context.Context, fn func(context.Context)) + func (a *Auth) BaseURL(ctx context.Context) string + func (a *Auth) CanPeekRates() bool + func (a *Auth) CanReauthenticate(c *Call) error + func (a *Auth) CheckCode(ctx context.Context, purpose Purpose, subject, code string, maxAttempts int) error + func (a *Auth) CheckFields(f Fields) error + func (a *Auth) CheckRemovable(ctx context.Context, userID, exceptIdentity, exceptCredential string) error + func (a *Auth) CheckSchema(ctx context.Context) (SchemaReport, error) + func (a *Auth) Close() error + func (a *Auth) CompleteReauthentication(ctx context.Context, c *Call, ticket Token) (Reauthentication, error) + func (a *Auth) CompleteSessionTask(ctx context.Context, c *Call, task SessionTaskID) (Session, error) + func (a *Auth) Config() Config + func (a *Auth) ConfirmDeleteAccount(ctx context.Context, t Token) error + func (a *Auth) Conn(ctx context.Context) (sqlb.DBTX, error) + func (a *Auth) ConsumeAllVerifications(ctx context.Context, purpose Purpose, identifier string) error + func (a *Auth) ConsumeVerification(ctx context.Context, purpose Purpose, tok Token) (Verification, error) + func (a *Auth) CreateIdentity(ctx context.Context, in NewIdentity) (Identity, error) + func (a *Auth) CreateImpersonationSession(ctx context.Context, userID, adminID string, client Client, ttl time.Duration) (Session, Token, error) + func (a *Auth) CreateMultiFactorSession(ctx context.Context, userID string, client Client) (Session, Token, error) + func (a *Auth) CreateSession(ctx context.Context, userID string, client Client) (Session, Token, error) + func (a *Auth) CreateSessionWithOptions(ctx context.Context, userID string, client Client, o SessionOptions) (Session, Token, error) + func (a *Auth) CreateUser(ctx context.Context, in NewUser) (User, error) + func (a *Auth) CredentialChanged(ctx context.Context, userID string) error + func (a *Auth) DB() *sql.DB + func (a *Auth) DeleteAccount(ctx context.Context) (DeleteAccountResult, error) + func (a *Auth) DeleteIdentity(ctx context.Context, userID, id string) error + func (a *Auth) DeleteSession(ctx context.Context, userID, id string) error + func (a *Auth) DeleteUser(ctx context.Context, id string) error + func (a *Auth) DeleteUserSessions(ctx context.Context, userID, exceptID string) error + func (a *Auth) Deliver(ctx context.Context, to Identity, m Message) error + func (a *Auth) DeliverRecovery(ctx context.Context, userID string, m Message) error + func (a *Auth) DeliveryOutbox() bool + func (a *Auth) DetectKind(raw string) (IdentifierKindName, string, error) + func (a *Auth) DeviceSessions(ctx context.Context) (DeviceSessionsResult, error) + func (a *Auth) Dialect() sqlb.Dialect + func (a *Auth) DisabledOperations() []EndpointID + func (a *Auth) Each(ctx context.Context, s Statement, fn func() error) error + func (a *Auth) EmitSecurity(e SecurityEvent) + func (a *Auth) EmitSecurityOf(c *Call, e SecurityEvent) + func (a *Auth) EndSession(ctx context.Context, userID, id string, reason SessionEndReason) error + func (a *Auth) EndUserSessions(ctx context.Context, userID, exceptID string, reason SessionEndReason) error + func (a *Auth) Engine() string + func (a *Auth) ErrorInfo(ctx context.Context, err error) ErrorInfo + func (a *Auth) EvictCachedSessions(ctx context.Context, userID string) bool + func (a *Auth) Exec(ctx context.Context, s Statement) (int64, error) + func (a *Auth) FindIdentity(ctx context.Context, kind IdentifierKindName, raw string, verifiedOnly bool) (Identity, error) + func (a *Auth) FindSignInIdentity(ctx context.Context, raw string) (Identity, IdentifierKind, error) + func (a *Auth) FlushSecurity(ctx context.Context) error + func (a *Auth) Identities(ctx context.Context, userID string) ([]Identity, error) + func (a *Auth) IdentityByID(ctx context.Context, id string) (Identity, error) + func (a *Auth) ImportUsers(ctx context.Context, users []ImportUser) ([]ImportResult, error) + func (a *Auth) IssueCode(ctx context.Context, purpose Purpose, subject string, ttl time.Duration) (string, error) + func (a *Auth) IssueCodeWith(ctx context.Context, purpose Purpose, subject string, ttl time.Duration, ...) (string, error) + func (a *Auth) IssueVerification(ctx context.Context, purpose Purpose, identifier string, ttl time.Duration, ...) (Token, error) + func (a *Auth) IssueVerificationToken(ctx context.Context, purpose Purpose, identifier string, tok Token, ...) error + func (a *Auth) ListSessions(ctx context.Context) (SessionsResult, error) + func (a *Auth) LoadUser(ctx context.Context, id string, dst Scannable) error + func (a *Auth) LoadUserColumns(ctx context.Context, id string, bs ...sqlb.Binding) error + func (a *Auth) Locale(ctx context.Context) string + func (a *Auth) Logger() *slog.Logger + func (a *Auth) Maintain(ctx context.Context, o MaintainOptions) (SweepResult, error) + func (a *Auth) MergeFields(nested, top Fields) (Fields, error) + func (a *Auth) Migrate(ctx context.Context) ([]string, error) + func (a *Auth) MigrationSQL() (string, error) + func (a *Auth) MigrationStatus(ctx context.Context) ([]MigrationState, error) + func (a *Auth) Migrations() ([]Migration, error) + func (a *Auth) NewID(prefix string) (string, error) + func (a *Auth) Normalize(kind IdentifierKindName, raw string) (string, error) + func (a *Auth) Now() time.Time + func (a *Auth) One(ctx context.Context, s Statement) error + func (a *Auth) Operation(id EndpointID) (Operation, bool) + func (a *Auth) Operations() []Operation + func (a *Auth) Orphans(ctx context.Context) ([]Orphan, error) + func (a *Auth) PeekCode(ctx context.Context, purpose Purpose, subject, code string, maxAttempts int) error + func (a *Auth) Plugins() []Plugin + func (a *Auth) PromoteSession(ctx context.Context, c *Call) (Session, error) + func (a *Auth) RateHit(ctx context.Context, key string, window time.Duration) (int, error) + func (a *Auth) RatePeek(ctx context.Context, key string, window time.Duration) (int, error) + func (a *Auth) Reauthenticate(ctx context.Context, c *Call, in ReauthAttempt) (Reauthentication, error) + func (a *Auth) RefreshSession(ctx context.Context) (SessionResult, error) + func (a *Auth) ReportReauthFailure(c *Call) + func (a *Auth) RequireSchema(ctx context.Context) error + func (a *Auth) Resolve(ctx context.Context) error + func (a *Auth) ResolveSession(ctx context.Context, t Token) (sess *Session, user *User, refreshed bool, err error) + func (a *Auth) RevokeDeviceSession(ctx context.Context, id string) error + func (a *Auth) RevokeSession(ctx context.Context, id string) error + func (a *Auth) RevokedSessions(ctx context.Context, userID string) ([]Session, error) + func (a *Auth) RotateSessionToken(ctx context.Context, c *Call) (Token, error) + func (a *Auth) RunInBackground(ctx context.Context, task func(context.Context)) + func (a *Auth) SQLTypes() SQLTypes + func (a *Auth) SchemaMigration(engine, owner, name string, s TableSchema) (Migration, error) + func (a *Auth) SecurityStats() []SinkStats + func (a *Auth) Select() *sqlb.AnySelect + func (a *Auth) SendOutbox(ctx context.Context) (OutboxResult, error) + func (a *Auth) SendVerification(ctx context.Context, to Identity) error + func (a *Auth) Session(ctx context.Context) (SessionResult, error) + func (a *Auth) SessionStore() SessionStore + func (a *Auth) Sessions(ctx context.Context, userID string) ([]Session, error) + func (a *Auth) SetFields(ctx context.Context, userID string, f Fields) error + func (a *Auth) SetPrimaryIdentity(ctx context.Context, userID, id string) (Identity, error) + func (a *Auth) SignOut(ctx context.Context) error + func (a *Auth) SignOutAll(ctx context.Context) error + func (a *Auth) StartSpan(ctx context.Context, s SpanInfo) (context.Context, func(error)) + func (a *Auth) Sweep(ctx context.Context, retention time.Duration) (SweepResult, error) + func (a *Auth) SwitchDeviceSession(ctx context.Context, id string) error + func (a *Auth) TableName(t sqlb.Table) string + func (a *Auth) TracksIP() bool + func (a *Auth) Translate(ctx context.Context, code string) (string, bool) + func (a *Auth) TrustsOrigin(origin string) bool + func (a *Auth) TrustsReturnURL(target string) bool + func (a *Auth) Tx(ctx context.Context, fn func(ctx context.Context, tx *sql.Tx) error) error + func (a *Auth) UpdateProfile(ctx context.Context, in ProfileRequest) (UserView, error) + func (a *Auth) UpdateUser(ctx context.Context, id string, in UserUpdate) (User, error) + func (a *Auth) User(ctx context.Context, id string) (User, error) + func (a *Auth) UserTables() []UserTable + func (a *Auth) VerificationStore() VerificationStore + func (a *Auth) VerifiedIdentities(ctx context.Context, userID string, kind IdentifierKindName) ([]Identity, error) + func (a *Auth) VerifyIdentity(ctx context.Context, id string) (Identity, error) + func (a *Auth) WaitDeliveries() + func (a *Auth) WithRequest(ctx context.Context, r Request) context.Context + type BackgroundFunc func(ctx context.Context, task func(context.Context)) + type BotChecker interface + CheckBot func(ctx context.Context, s BotSignals) (RiskVerdict, error) + type BotCheckerFunc func(ctx context.Context, s BotSignals) (RiskVerdict, error) + func (f BotCheckerFunc) CheckBot(ctx context.Context, s BotSignals) (RiskVerdict, error) + type BotSignals struct + Client Client + Op OpInfo + Transport Transport + func (s BotSignals) Header(name string) string + type CacheKey struct + Client string + TokenHash []byte + type Call struct + Auth *Auth + Client Client + Credential Credential + Effects *Effects + Flow Token + Input any + Op OpInfo + Plugin string + Session *Session + Transport Transport + User *User + func (c *Call) Annotate(key, value string) + func (c *Call) Annotation(key string) string + func (c *Call) Cookie(name string) (string, bool) + func (c *Call) Header(name string) string + func (c *Call) RedirectOnError(url string) + func (c *Call) RequireOwner(ctx context.Context, o Ownership, id string) error + func (c *Call) RequireOwnerRow(ctx context.Context, o Ownership, id string, cols ...sqlb.Binding) error + func (c *Call) Respond(out any) + func (c *Call) SetInput(v any) + func (c *Call) SetSignedCookie(name, value string, expiresAt time.Time) error + func (c *Call) SignInProven(ctx context.Context, kind IdentifierKindName, raw string, create bool) (ProvenSignIn, error) + func (c *Call) SignInProvenAs(ctx context.Context, kind IdentifierKindName, raw string, newUser *NewUser) (ProvenSignIn, error) + func (c *Call) SignedCookie(name string) (string, bool) + type Client struct + FetchSite string + IP string + Locale string + Origin string + UserAgent string + type Closer interface + Close func() error + type CodeOptions struct + Generate func(ctx context.Context) (string, error) + MaxAttempts int + Reuse bool + type ColumnExtender interface + Columns func() []ColumnExtension + type ColumnExtension struct + Default string + Name string + Nullable bool + Table string + Type ColumnType + Unique bool + type ColumnType string + const ColumnBool + const ColumnInt + const ColumnText + const ColumnTimestamp + type Config struct + BaseURL string + CodeLength int + DefaultPageSize int + DeliveryOutbox bool + Dialect sqlb.Dialect + ErrorURL string + FreshWindow time.Duration + Identifiers []IdentifierKind + MultiSession MultiSessionConfig + PendingSessionTTL time.Duration + Session SessionConfig + TrustedOrigins []string + func (c Config) CanDeliver(name IdentifierKindName) bool + func (c Config) DeriveKey(label string) ([]byte, error) + func (c Config) DeriveKeys(label string) ([][]byte, error) + func (c Config) HasIdentifier(name IdentifierKindName) bool + func (c Config) HasSecret() bool + func (c Config) Identifier(name IdentifierKindName) (IdentifierKind, bool) + func (c Config) LoginKinds() []IdentifierKind + func (c Config) PageSize(requested, fallback, limit int) int + func (c Config) RecoveryKinds() []IdentifierKind + func (c Config) Sealer() Sealer + type ConfirmDeleteAccountRequest struct + Token WireToken + type Credential string + const CredentialBearer + const CredentialCookie + const CredentialNone + func RequestCredential(ctx context.Context) Credential + type CredentialCounter interface + SignInCredentials func(ctx context.Context, userID, exceptID string) (int, error) + type CredentialListener interface + CredentialChanged func(ctx context.Context, userID string) error + type DataHooker interface + DataHooks func() DataHooks + type DataHooks struct + Identity TableHooks[Identity] + Session TableHooks[Session] + SessionEnded func(ctx context.Context, tx sqlb.DBTX, e SessionEnd) error + User TableHooks[User] + Verification TableHooks[Verification] + type DeleteAccountResult struct + ConfirmationSent bool + Deleted bool + type Deliverer interface + Deliver func(ctx context.Context, to Identity, m Message) error + type Dependent interface + Requires func() []string + type DeviceRecognizer interface + KnownDevice func(ctx context.Context, in DeviceSignIn) (bool, error) + func SessionDevices() DeviceRecognizer + type DeviceRecognizerFunc func(ctx context.Context, in DeviceSignIn) (bool, error) + func (f DeviceRecognizerFunc) KnownDevice(ctx context.Context, in DeviceSignIn) (bool, error) + type DeviceSessionRequest struct + ID string + type DeviceSessionView struct + Active bool + ExpiresAt time.Time + Extras any + ID string + User UserView + type DeviceSessionsResult struct + Sessions []DeviceSessionView + type DeviceSignIn struct + Auth *Auth + Client Client + Method string + Operation EndpointID + Session Session + UserID string + type Done struct + OK bool + type Effect struct + ExpiresAt time.Time + Kind EffectKind + Name string + Replaces bool + SessionID string + Token Token + Transient bool + URL string + UserID string + Value string + func RequestEffects(ctx context.Context) []Effect + type EffectKind string + const EffectBindFlow + const EffectCacheSession + const EffectClearCache + const EffectClearSession + const EffectCookie + const EffectForgetDeviceSession + const EffectHeader + const EffectIssueSession + const EffectRedirect + const EffectRememberDevice + type Effects struct + func (e *Effects) BindFlow(t Token, expiresAt time.Time) + func (e *Effects) CacheSession(v string, expiresAt time.Time) + func (e *Effects) ClearCache() + func (e *Effects) ClearSession() + func (e *Effects) ForgetDeviceSession(t Token) + func (e *Effects) Header(name, value string) + func (e *Effects) IssueSession(t Token, expiresAt time.Time) + func (e *Effects) IssueSessionOf(s Session, t Token) + func (e *Effects) List() []Effect + func (e *Effects) Redirect(url string) + func (e *Effects) RememberDevice(t Token, expiresAt time.Time) + func (e *Effects) ReplaceSessionOf(s Session, t Token) + func (e *Effects) SetCookie(name, value string, expiresAt time.Time) error + type EndpointID string + const EndpointConfirmDeleteAccount + const EndpointDeleteAccount + const EndpointDeviceSessions + const EndpointProfile + const EndpointRefreshSession + const EndpointRevokeDeviceSession + const EndpointRevokeSession + const EndpointSession + const EndpointSessions + const EndpointSignOut + const EndpointSignOutAll + const EndpointSwitchDeviceSession + type Error struct + Code string + Message string + Status int + func Errors() []*Error + func NewError(code string, status int, message string) *Error + func (e *Error) Error() string + func (e *Error) Is(target error) bool + type ErrorInfo struct + Code string + Message string + OriginalMessage string + Status int + func ErrorInfoFor(ctx context.Context, err error) ErrorInfo + func ErrorOf(err error) ErrorInfo + type ExclusiveVerificationStore interface + RefusesDuplicateTokens func() bool + type Fields map[string]json.RawMessage + func SplitBody(data []byte, dst any) (Fields, error) + type GeoLocation struct + Country string + HasCoordinates bool + Latitude float64 + Longitude float64 + type GeoLocator interface + Locate func(ctx context.Context, ip netip.Addr) (loc GeoLocation, found bool, err error) + type GeoLocatorFunc func(ctx context.Context, ip netip.Addr) (GeoLocation, bool, error) + func (f GeoLocatorFunc) Locate(ctx context.Context, ip netip.Addr) (GeoLocation, bool, error) + type GeoRules struct + Action RateAction + Allow []string + Deny []string + DenyUnknown bool + type GetAndDeleter interface + GetAndDelete func(ctx context.Context, key string) (string, bool, error) + type HookStage string + const HookAfter + const HookBefore + type IPReputation interface + CheckIP func(ctx context.Context, ip netip.Addr) (RiskVerdict, error) + type IPReputationFunc func(ctx context.Context, ip netip.Addr) (RiskVerdict, error) + func (f IPReputationFunc) CheckIP(ctx context.Context, ip netip.Addr) (RiskVerdict, error) + type Identified interface + RateIdentifier func() string + type IdentifierKind struct + CanLogin bool + CanRecover bool + Name IdentifierKindName + Normalize func(raw string) (string, error) + RequireVerified bool + ScopedByTenant bool + Unique bool + UniqueOnlyVerified bool + Validate func(normalized string) error + Verifiable bool + func ApplyKind(k IdentifierKind, opts ...KindOption) IdentifierKind + type IdentifierKindName string + type IdentifierProvider interface + Identifiers func() []IdentifierKind + type Identity struct + CreatedAt time.Time + ID string + IsPrimary bool + Kind IdentifierKindName + ScopeID *string + UserID string + Value string + ValueRaw string + VerifiedAt *time.Time + func (i Identity) Verified() bool + type ImportIdentity struct + Kind IdentifierKindName + Primary bool + Value string + Verified bool + type ImportResult struct + Err error + Index int + User User + type ImportUser struct + CreatedAt time.Time + ID string + Identities []ImportIdentity + Image string + Name string + type ImpossibleTravelRule struct + Action RateAction + MaxSpeedKmh float64 + MinDistanceKm float64 + type Initializer interface + Init func(*Auth) error + type Joiner interface + Joins func() []sqlb.Join + type KeyRing struct + func NewKeyRing(current []byte, previous ...[]byte) (*KeyRing, error) + func (r *KeyRing) Len() int + func (r *KeyRing) Open(sealed, aad string) ([]byte, error) + func (r *KeyRing) Seal(plain []byte, aad string) string + type KindOption func(*IdentifierKind) + func Contact() KindOption + func Login() KindOption + func Recover() KindOption + func ScopedByTenant() KindOption + func Unique() KindOption + type MaintainOptions struct + DryRun bool + type Maintainer interface + Maintain func(ctx context.Context, o MaintainOptions) (map[string]int64, error) + type MemorySecuritySink struct + func (m *MemorySecuritySink) Events() []SecurityEvent + func (m *MemorySecuritySink) OfKind(k SecurityKind) []SecurityEvent + func (m *MemorySecuritySink) Reset() + func (m *MemorySecuritySink) WriteSecurity(_ context.Context, batch []SecurityEvent) error + type Message struct + Code string + Data any + DefaultSubject string + DefaultText string + Link string + Locale string + Metadata map[string]string + Purpose Purpose + type MessageCatalog interface + Message func(locale, code string) (string, bool) + type MessageDataDecoder interface + DecodeMessageData func(p Purpose, raw json.RawMessage) (any, error) + type Messages map[string]map[string]string + func (m Messages) Message(locale, code string) (string, bool) + type Migration struct + Name string + Owner string + Statements []string + func (m Migration) Checksum() string + type MigrationState struct + Applied bool + Changed bool + Name string + Owner string + type Migrator interface + Migrations func(engine string) ([]Migration, error) + type MultiSessionConfig struct + Enabled bool + Max int + type NewIdentity struct + Kind IdentifierKindName + Primary bool + Raw string + ScopeID *string + UserID string + Verified bool + type NewUser struct + CreatedAt time.Time + ID string + Image string + Name string + type Observer interface + Operation func(ctx context.Context, e OperationEvent) + type ObserverFunc func(ctx context.Context, e OperationEvent) + func (f ObserverFunc) Operation(ctx context.Context, e OperationEvent) + type Op struct + func Define[In, Out any](info OpInfo, run func(ctx context.Context, c *Call, in In) (Out, error)) *Op[In, Out] + func (o *Op[In, Out]) Call(ctx context.Context, in In) (Out, error) + func (o *Op[In, Out]) Info() OpInfo + func (o *Op[In, Out]) InputType() reflect.Type + func (o *Op[In, Out]) Invoke(ctx context.Context, decode func(dst any) error) (any, error) + func (o *Op[In, Out]) OutputType() reflect.Type + func (o *Op[In, Out]) Plugin() string + func (o *Op[In, Out]) Route() string + type OpInfo struct + CrossSiteForm bool + ID EndpointID + Kind OpKind + Path string + Require Requirement + SelfServed bool + SignIn bool + func OperationOf(ctx context.Context) (OpInfo, bool) + type OpKind string + const Mutation + const Query + type Operation interface + Info func() OpInfo + InputType func() reflect.Type + Invoke func(ctx context.Context, decode func(dst any) error) (any, error) + OutputType func() reflect.Type + Plugin func() string + Route func() string + type OperationEvent struct + Duration time.Duration + Err error + Op OpInfo + Plugin string + Transport Transport + type OperationHook struct + After func(ctx context.Context, c *Call, result any) error + Before func(ctx context.Context, c *Call) error + Finally func(ctx context.Context, c *Call, err error) + Match []EndpointID + type OperationHooker interface + OperationHooks func() []OperationHook + type OperationProvider interface + Operations func() []Operation + type Option func(*settings) + func EnvOptions(lookup func(string) (string, bool)) ([]Option, error) + func Options(opts ...Option) Option + func RenameTable(t sqlb.Table, realName string) Option + func WithAccountDeletion(d AccountDeletion) Option + func WithAllowedHosts(hosts ...string) Option + func WithBackground(run BackgroundFunc) Option + func WithBaseURL(u string) Option + func WithBotCheck(c BotChecker, p RiskPolicy) Option + func WithClock(now func() time.Time) Option + func WithCodeLength(digits int) Option + func WithDB(db *sql.DB, d sqlb.Dialect) Option + func WithDBAuto(db *sql.DB) Option + func WithDBRateStore() Option + func WithDataHooks(h ...DataHooks) Option + func WithDefaultLocale(tag string) Option + func WithDefaultPageSize(n int) Option + func WithDeferredSessionRefresh() Option + func WithDeliveryOutbox(keys ...[]byte) Option + func WithDeviceRecognizer(r DeviceRecognizer) Option + func WithDeviceSessionExtras() Option + func WithDialect(d sqlb.Dialect) Option + func WithDisabledOperations(ids ...EndpointID) Option + func WithErrorURL(url string) Option + func WithFetchMetadata() Option + func WithFreshWindow(d time.Duration) Option + func WithGeoLocator(l GeoLocator) Option + func WithGeoRules(r GeoRules) Option + func WithIDs(gen func(prefix string) (string, error)) Option + func WithIPReputation(c IPReputation, p RiskPolicy) Option + func WithIPv6Prefix(bits int) Option + func WithImpossibleTravel(r ImpossibleTravelRule) Option + func WithLogger(l *slog.Logger) Option + func WithLoopbackReturn() Option + func WithMessages(c MessageCatalog) Option + func WithMultiSession(max int) Option + func WithObserver(o Observer) Option + func WithOperationHooks(h ...OperationHook) Option + func WithPendingSessionTTL(d time.Duration) Option + func WithPlugins(ps ...Plugin) Option + func WithProfileFields(cols ...string) Option + func WithRateChallenger(ch RateChallenger) Option + func WithRateExempt(fn RateExemptFunc) Option + func WithRateLimit(limit int, window time.Duration) Option + func WithRateRules(rules ...RateRule) Option + func WithRateStore(r RateStore) Option + func WithSQLTypes(engine string, t SQLTypes) Option + func WithSealer(s Sealer) Option + func WithSecondaryStorage(kv SecondaryStorage) Option + func WithSecret(current []byte, previous ...[]byte) Option + func WithSecurityLog(q SecurityQueue) Option + func WithSecuritySink(sink SecuritySink, q SecurityQueue) Option + func WithSession(c SessionConfig) Option + func WithSessionArchive() Option + func WithSessionCache(c SessionCache, ttl time.Duration) Option + func WithSessionExtras(fn SessionExtras) Option + func WithSessionPolicy(p SessionPolicy) Option + func WithSessionRevocations(r SessionRevocations) Option + func WithSessionStore(s SessionStore) Option + func WithSignUpFields(cols ...string) Option + func WithStatelessRefreshWithoutRead(interval time.Duration) Option + func WithStatelessSessions(keys ...[]byte) Option + func WithStatelessVersion(n int) Option + func WithTablePrefix(prefix string) Option + func WithTokenRotation(r TokenRotation) Option + func WithTracer(t Tracer) Option + func WithTravelHistory(h SignInHistory) Option + func WithTrialAbuseCheck(c TrialAbuseChecker, p RiskPolicy) Option + func WithTrustedOriginFunc(fn OriginFunc) Option + func WithTrustedOrigins(origins ...string) Option + func WithUnknownDeviceNotification() Option + func WithUserColumns(cols ...ColumnExtension) Option + func WithUserLocale(column string) Option + func WithVerificationStore(s VerificationStore) Option + func WithoutCSRFCheck() Option + func WithoutIPTracking() Option + func WithoutOriginCheck() Option + func WithoutServerCallRateLimits() Option + type OptionChecker interface + OptionErr func() error + type OptionErrors struct + func (o *OptionErrors) JoinOptionErr(err error) + func (o *OptionErrors) OptionErr() error + func (o *OptionErrors) RefuseNil(name string, v any) bool + type OriginFunc func(origin string) bool + type OriginTruster interface + TrustedOrigins func() []string + type Orphan struct + Kind OrphanKind + Name string + type OrphanKind string + const OrphanColumn + const OrphanOwner + const OrphanTable + type OutboxResult struct + Failed int + Sent int + type OwnerRefusalReporter interface + OwnerRefused func() error + type Ownership struct + Forbidden error + ID sqlb.Expr[string] + NotFound error + Owner sqlb.Expr[string] + Table sqlb.Table + type Plugin interface + Name func() string + type Principal struct + KeyID string + Scopes []string + UserID string + type PriorSignIn struct + At time.Time + IP string + type ProfileRequest struct + Fields Fields + Image *string + Name *string + type ProvenSignIn struct + Created bool + Session Session + Token Token + User User + type Purpose string + const PurposeChanged + const PurposeDeleteAccount + const PurposeReauth + const PurposeReset + const PurposeSignInCode + const PurposeSignInLink + const PurposeSignUpAttempt + const PurposeUnknownDevice + const PurposeVerify + const PurposeWelcome + type RateAction string + const RateBlock + const RateChallenge + const RateLog + type RateChallenger interface + PassChallenge func(ctx context.Context, c *Call) error + type RateChallengerFunc func(ctx context.Context, c *Call) error + func (f RateChallengerFunc) PassChallenge(ctx context.Context, c *Call) error + type RateDecider interface + Allow func(ctx context.Context, key string, rule RateRule) (ok bool, retryAfter time.Duration, err error) + type RateEvent struct + Count int + Err error + Op OpInfo + Outcome RateOutcome + Plugin string + Rule RateRule + Transport Transport + func (e RateEvent) FirstInWindow() bool + type RateEventListener interface + RateEvent func(ctx context.Context, c *Call, e RateEvent) + type RateExemptFunc func(ctx context.Context, c *Call) bool + type RateKey string + const ByFunc + const ByIP + const ByIdentifier + type RateKeyFunc func(ctx context.Context, c *Call) (string, error) + type RateLimiter interface + RateLimits func() []RateRule + type RateObserver interface + RateLimit func(ctx context.Context, e RateEvent) + type RateOutcome string + const RateOutcomeBlocked + const RateOutcomeChallenged + const RateOutcomeLogged + const RateOutcomePassed + type RatePeeker interface + Peek func(ctx context.Context, key string, window time.Duration) (int, error) + type RateRule struct + Action RateAction + Derive func(value string) string + Key RateKey + KeyFunc RateKeyFunc + Limit int + Match EndpointID + Window time.Duration + type RateStore interface + Hit func(ctx context.Context, key string, window time.Duration) (int, error) + func NewMemoryRateStore(now func() time.Time) RateStore + func NewStorageRateStore(kv SecondaryStorage) RateStore + type ReauthAttempt struct + MultiFactor bool + SingleFactor bool + type Reauthentication struct + Fresh bool + FreshUntil *time.Time + SecondFactorRequired bool + Ticket WireToken + type Request struct + CachedSession string + Client Client + Cookie func(name string) (string, bool) + Credential Credential + Delivery TokenDelivery + Device Token + DeviceTokens []Token + Flow Token + Header func(name string) string + Host string + Token Token + Transport Transport + type Requirement string + const FreshSignIn + const PendingSecondFactor + const Public + const SignedIn + const SignedInOrPending + type RevokeSessionRequest struct + ID string + type RiskErrorMode string + const RiskFailClosed + const RiskFailOpen + type RiskPolicy struct + Action RateAction + OnError RiskErrorMode + type RiskVerdict struct + Flagged bool + Reason string + type SQLTypes struct + Bool string + Bytes string + Doc string + Hash string + ID string + Int string + Key string + Long string + TableSuffix string + Text string + Timestamp string + Value string + func TypesFor(engine string) SQLTypes + type Scannable interface + Bindings func() []sqlb.Binding + type SchemaColumn struct + Default string + Name string + Nullable bool + Type ColumnType + Unique bool + type SchemaIndex struct + Columns []string + Name string + Unique bool + type SchemaReport struct + ChangedMigrations []string + MissingColumns []string + MissingTables []string + PendingMigrations []string + func (r SchemaReport) Error() string + func (r SchemaReport) OK() bool + type Sealer interface + Open func(ctx context.Context, sealed, aad string) ([]byte, error) + Seal func(ctx context.Context, plain []byte, aad string) (string, error) + func RingSealer(r *KeyRing) Sealer + type SecondFactor interface + SecondFactorRequired func(ctx context.Context, userID string) (bool, error) + type SecondFactorForSignIn interface + SecondFactorRequiredForSignIn func(ctx context.Context, in SignInAttempt) (bool, error) + type SecondaryStorage interface + Delete func(ctx context.Context, key string) error + Get func(ctx context.Context, key string) (string, bool, error) + Increment func(ctx context.Context, key string, ttl time.Duration) (int64, error) + Set func(ctx context.Context, key, value string, ttl time.Duration) error + func NewMemoryStorage(now func() time.Time) SecondaryStorage + type SecurityEvent struct + At time.Time + Attrs map[string]string + ID string + IP string + Kind SecurityKind + Op EndpointID + Outcome RateOutcome + Plugin string + Severity SecuritySeverity + Transport Transport + UserID string + type SecurityKind string + const SecurityBot + const SecurityCompromisedPassword + const SecurityCredentialStuffing + const SecurityGeoCountry + const SecurityImpossibleTravel + const SecurityLockout + const SecurityRateLimit + const SecurityReauthentication + const SecuritySessionEndHookFailed + const SecuritySessionTokenReuse + const SecurityStaleAccount + const SecuritySuspiciousIP + const SecurityTokenReplay + const SecurityTrialAbuse + type SecurityQueue struct + BatchSize int + Buffer int + FlushEvery time.Duration + Name string + type SecuritySeverity string + const SeverityAlert + const SeverityInfo + const SeverityWarn + type SecuritySink interface + WriteSecurity func(ctx context.Context, batch []SecurityEvent) error + type SecuritySinkFunc func(ctx context.Context, batch []SecurityEvent) error + func (f SecuritySinkFunc) WriteSecurity(ctx context.Context, batch []SecurityEvent) error + type Session struct + APIKeyID string + CreatedAt time.Time + Data AppData + ExpiresAt time.Time + ID string + IP string + IdleSeconds int64 + ImpersonatedBy *string + LastSeenAt time.Time + MaxExpiresAt *time.Time + ReauthenticatedAt *time.Time + RefreshSeconds int64 + RevokedAt *time.Time + SecondFactorPending bool + Tasks SessionTasks + Transient bool + UserAgent string + UserID string + func CurrentSession(ctx context.Context) (Session, bool) + func (s Session) FreshAt() time.Time + func (s Session) Lifetime(c SessionConfig) SessionLifetime + type SessionCache interface + Drop func(ctx context.Context, k CacheKey) error + Get func(ctx context.Context, k CacheKey, now time.Time) (s Session, u User, ok bool, err error) + Put func(ctx context.Context, k CacheKey, s Session, u User, until time.Time) (clientValue string, err error) + func NewCompactSessionCache(keys ...[]byte) SessionCache + func NewMemorySessionCache(maxEntries int) SessionCache + func NewSnapshotCache(keys ...[]byte) SessionCache + type SessionCacheUserDropper interface + DropUser func(ctx context.Context, userID string) error + type SessionChecker interface + SessionPredicates func() []sqlb.Predicate + type SessionConfig struct + IdleTimeout time.Duration + MaxLifetime time.Duration + RefreshAfter time.Duration + TransientIdleTimeout time.Duration + type SessionEnd struct + Reason SessionEndReason + Session Session + type SessionEndReason string + const SessionEndAdmin + const SessionEndBanned + const SessionEndCredentialChanged + const SessionEndExpired + const SessionEndImpersonationStopped + const SessionEndPasswordChanged + const SessionEndPasswordReset + const SessionEndPasswordSet + const SessionEndProviderLogout + const SessionEndRevoked + const SessionEndRevokedAll + const SessionEndRevokedOthers + const SessionEndSignOut + const SessionEndTokenReuse + const SessionEndUnspecified + const SessionEndUserDeleted + type SessionExtras func(ctx context.Context, c *Call) (any, error) + type SessionLifecycle interface + SessionEnded func(ctx context.Context, userID, id string) error + SessionReplaced func(ctx context.Context, old, new Session) error + UserSessionsEnded func(ctx context.Context, userID, exceptID string) error + type SessionLifetime struct + Idle time.Duration + Max time.Duration + RefreshAfter time.Duration + type SessionOptions struct + SingleFactor bool + Transient bool + type SessionPolicy func(ctx context.Context, in SessionPolicyInput) SessionLifetime + func ByCredential(cookie, bearer SessionLifetime) SessionPolicy + type SessionPolicyInput struct + Client Client + Credential Credential + Transient bool + UserID string + type SessionReauthStore interface + SetReauthenticatedAt func(ctx context.Context, id string, at time.Time) error + type SessionResult struct + ExpiresAt time.Time + Extras any + NeedsRefresh bool + Tasks SessionTasks + User UserView + type SessionRevocations interface + Revoke func(ctx context.Context, id string, until time.Time) error + Revoked func(ctx context.Context, id string, now time.Time) (bool, error) + func NewMemorySessionRevocations() SessionRevocations + type SessionStore interface + Delete func(ctx context.Context, userID, id string) error + DeleteUser func(ctx context.Context, userID, exceptID string) error + Find func(ctx context.Context, tokenHash []byte, now time.Time) (Session, error) + Insert func(ctx context.Context, s Session, tokenHash []byte) error + List func(ctx context.Context, userID string, now time.Time) ([]Session, error) + SetData func(ctx context.Context, id string, data AppData) error + Sweep func(ctx context.Context, now time.Time) (int64, error) + Touch func(ctx context.Context, id string, expiresAt, lastSeenAt time.Time) (bool, error) + func MirrorSessionStore(primary, secondary SessionStore) SessionStore + func NewMemorySessionStore() SessionStore + func NewStorageSessionStore(kv SecondaryStorage) SessionStore + func SQLSessionStore() SessionStore + type SessionTask struct + Allow []EndpointID + ID SessionTaskID + type SessionTaskError struct + Tasks SessionTasks + func (e *SessionTaskError) Error() string + func (e *SessionTaskError) Unwrap() error + type SessionTaskID string + const TaskSetupMFA + type SessionTasker interface + SessionTasks func() []SessionTask + SessionTasksFor func(ctx context.Context, in SignInAttempt) ([]SessionTaskID, error) + type SessionTasks []SessionTaskID + func CurrentSessionTasks(ctx context.Context) SessionTasks + func (t *SessionTasks) Scan(src any) error + func (t SessionTasks) String() string + func (t SessionTasks) Value() (driver.Value, error) + type SessionTokenRotator interface + FindRotated func(ctx context.Context, tokenHash []byte, now time.Time) (Session, time.Time, error) + RotateToken func(ctx context.Context, id string, oldHash, newHash []byte, ...) (bool, error) + type SessionUserFinder interface + FindWithUser func(ctx context.Context, tokenHash []byte, now time.Time, checks []sqlb.Predicate) (Session, User, error) + type SessionView struct + CreatedAt time.Time + Current bool + ID string + IP string + Impersonated bool + LastSeenAt time.Time + UserAgent string + type SessionsResult struct + Sessions []SessionView + type SetIfAbsenter interface + SetIfAbsent func(ctx context.Context, key, value string, ttl time.Duration) (bool, error) + type SignInAttempt struct + Client Client + Method string + Operation EndpointID + Reauthentication bool + SingleFactor bool + UserID string + type SignInHistory interface + PreviousSignIn func(ctx context.Context, a *Auth, userID string) (prior PriorSignIn, found bool, err error) + func SessionSignInHistory() SignInHistory + type SignInHistoryFunc func(ctx context.Context, a *Auth, userID string) (PriorSignIn, bool, error) + func (f SignInHistoryFunc) PreviousSignIn(ctx context.Context, a *Auth, userID string) (PriorSignIn, bool, error) + type SignInMethod interface + SignsIn func() bool + type SignUpIdentifier struct + Kind IdentifierKindName + Value string + type SignUpInfo struct + Client Client + Identifiers []SignUpIdentifier + UserID string + type SinkStats struct + Delivered uint64 + Dropped uint64 + Failed uint64 + Name string + Queued uint64 + type Span interface + End func(err error) + type SpanInfo struct + DBOperation string + Kind SpanKind + Name string + Op OpInfo + Plugin string + Route string + Source string + Stage HookStage + Table string + Transport Transport + func MiddlewareSpan(plugin string, transport Transport, route string) SpanInfo + type SpanKind string + const SpanDataHook + const SpanDatabase + const SpanHook + const SpanMiddleware + const SpanOperation + type Statement interface + Build func() (sqlb.Query, error) + type SweepResult map[string]int64 + type Sweeper interface + Sweep func(ctx context.Context, cutoff time.Time) (int64, error) + type TableHooks struct + AfterCreate func(ctx context.Context, tx sqlb.DBTX, row *T) error + AfterUpdate func(ctx context.Context, tx sqlb.DBTX, old, new *T) error + BeforeCreate func(ctx context.Context, tx sqlb.DBTX, row *T) error + BeforeDelete func(ctx context.Context, tx sqlb.DBTX, row *T) error + BeforeUpdate func(ctx context.Context, tx sqlb.DBTX, old, new *T) error + type TableOwner interface + Tables func() []sqlb.Table + type TableSchema struct + Columns []SchemaColumn + ID string + Indexes []SchemaIndex + Table sqlb.Table + type Token string + func NewToken() Token + func RequestDevice(ctx context.Context) Token + func (Token) Format(f fmt.State, _ rune) + func (Token) GoString() string + func (Token) LogValue() slog.Value + func (Token) MarshalJSON() ([]byte, error) + func (Token) String() string + func (t Token) Reveal() string + func (t Token) Wire() WireToken + type TokenDelivery string + const DeliveryBearer + const DeliveryCookie + type TokenPrefixLister interface + TokenPrefixes func() []string + type TokenResolver interface + ResolveToken func(ctx context.Context, t Token) (Principal, error) + TokenPrefix func() string + type TokenRotation struct + Grace time.Duration + type Tracer interface + Start func(ctx context.Context, s SpanInfo) (context.Context, Span) + type Transport string + const TransportGo + const TransportHTTP + type TrialAbuseChecker interface + CheckSignUp func(ctx context.Context, s SignUpInfo) (RiskVerdict, error) + type TrialAbuseCheckerFunc func(ctx context.Context, s SignUpInfo) (RiskVerdict, error) + func (f TrialAbuseCheckerFunc) CheckSignUp(ctx context.Context, s SignUpInfo) (RiskVerdict, error) + type TypedMigrator interface + TypedMigrations func(engine string, t SQLTypes) ([]Migration, error) + type UnknownDeviceData struct + At time.Time + IP string + Method string + SessionID string + UserAgent string + type User struct + CreatedAt time.Time + ID string + Image string + Name string + SessionsValidAfter *time.Time + UpdatedAt time.Time + func CurrentUser(ctx context.Context) (User, bool) + type UserTable struct + Column string + Table sqlb.Table + type UserTableOwner interface + UserTables func() []UserTable + type UserUpdate struct + Image *string + Name *string + type UserView struct + ID string + Image string + Name string + func ViewOf(u User) UserView + type Validator interface + Validate func(*Config) error + type Verification struct + ConsumedAt *time.Time + CreatedAt time.Time + ExpiresAt time.Time + ID string + Identifier string + Meta string + Purpose Purpose + type VerificationSender interface + SendVerification func(ctx context.Context, to Identity) error + type VerificationStore interface + Consume func(ctx context.Context, purpose Purpose, tokenHash []byte, now time.Time) (Verification, error) + ConsumeAll func(ctx context.Context, purpose Purpose, identifier string, now time.Time) error + DeleteIdentifiers func(ctx context.Context, identifiers []string, now time.Time) error + Insert func(ctx context.Context, v Verification, tokenHash []byte) error + Sweep func(ctx context.Context, cutoff time.Time) (int64, error) + func NewMemoryVerificationStore(now func() time.Time) VerificationStore + func NewStorageVerificationStore(kv GetAndDeleter) VerificationStore + type WireToken string + func (WireToken) Format(f fmt.State, _ rune) + func (WireToken) GoString() string + func (WireToken) LogValue() slog.Value + func (WireToken) String() string + func (t WireToken) Reveal() string + func (t WireToken) Token() Token
Go to main page