server

Documentation

Overview

Package server provides the authentication server implementation.

Index

• Variables
• type Issuer
• type ParsedToken
• type UUIDIssuer
  • func NewRandomUUIDIssuer() (*UUIDIssuer, error)
  • func NewUUIDIssuer(secret string) (*UUIDIssuer, error)
  • func (u *UUIDIssuer) Issue(ctx context.Context, subject string, ttl time.Duration) (string, error)
  • func (u *UUIDIssuer) Parse(token string) (*ParsedToken, error)

Variables

var ErrTokenExpired = errors.New("token expired")

ErrTokenExpired is returned when a token's TTL has elapsed.

var ErrTokenInvalid = errors.New("token invalid")

ErrTokenInvalid is returned when a token cannot be parsed.

Types

type Issuer

type Issuer interface {
	Issue(ctx context.Context, subject string, ttl time.Duration) (string, error)
}

Issuer issues tokens for subjects.

type ParsedToken

type ParsedToken struct {
	ID      string
	Subject string
}

ParsedToken holds the verified fields of a token issued by UUIDIssuer.

type UUIDIssuer

type UUIDIssuer struct {
	// contains filtered or unexported fields
}

UUIDIssuer issues HMAC-signed tokens that include a UUID, an optional expiry, and the subject. Token format: "tok:<uuid>:<expiry_unix_ns>:<subject_b64url>:<signature_b64url>" expiry_unix_ns is 0 when ttl is zero (meaning no expiry).

func NewRandomUUIDIssuer

func NewRandomUUIDIssuer() (*UUIDIssuer, error)

NewRandomUUIDIssuer constructs a UUIDIssuer with a random process-local secret.

func NewUUIDIssuer

func NewUUIDIssuer(secret string) (*UUIDIssuer, error)

NewUUIDIssuer constructs a UUIDIssuer with the provided signing secret.

func (*UUIDIssuer) Issue

func (u *UUIDIssuer) Issue(ctx context.Context, subject string, ttl time.Duration) (string, error)

Issue issues a token. It returns early if ctx is canceled. When ttl > 0 the expiry time is embedded in the token and enforced by Parse.

func (*UUIDIssuer) Parse

func (u *UUIDIssuer) Parse(token string) (*ParsedToken, error)

Parse validates the token format and signature and, when an expiry was embedded, checks that it has not elapsed. It returns ErrTokenInvalid for malformed or tampered tokens and ErrTokenExpired when the TTL has passed.