Documentation
¶
Index ¶
- Variables
- func GenerateAPIToken() (string, error)
- func GetSessionFromRequest(r *http.Request) string
- func HashPassword(password string) (string, error)
- func VerifyPasswordHash(password, encodedHash string) bool
- type Config
- type FailedLoginTracker
- type Service
- func (s *Service) CleanupExpiredSessions() error
- func (s *Service) ClearSessionCookie(w http.ResponseWriter)
- func (s *Service) CreateSession() (string, error)
- func (s *Service) InvalidateSession(token string) error
- func (s *Service) IsAuthDisabled() bool
- func (s *Service) SetSessionCookie(w http.ResponseWriter, token string)
- func (s *Service) UpdatePassword(newPassword string) error
- func (s *Service) ValidateSession(token string) bool
- func (s *Service) VerifyPassword(password string) bool
- func (s *Service) VerifyPasswordWithDelay(password, clientIP string) (bool, time.Duration)
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidCredentials = errors.New("invalid credentials") ErrSessionExpired = errors.New("session expired") ErrInvalidToken = errors.New("invalid token") )
Common errors
Functions ¶
func GenerateAPIToken ¶
GenerateAPIToken creates a secure random API token
func GetSessionFromRequest ¶
GetSessionFromRequest extracts the session token from the request
func HashPassword ¶
HashPassword creates an Argon2id hash of a password
func VerifyPasswordHash ¶
VerifyPasswordHash checks password against an Argon2id hash
Types ¶
type FailedLoginTracker ¶ added in v1.1.3
type FailedLoginTracker struct {
// contains filtered or unexported fields
}
FailedLoginTracker tracks failed login attempts per IP for progressive delays
func NewFailedLoginTracker ¶ added in v1.1.3
func NewFailedLoginTracker() *FailedLoginTracker
NewFailedLoginTracker creates a new tracker
func (*FailedLoginTracker) GetDelay ¶ added in v1.1.3
func (t *FailedLoginTracker) GetDelay(ip string) time.Duration
GetDelay returns the delay duration before next login attempt is allowed Progressive delays: 0s, 1s, 2s, 4s, 8s, 16s, 30s (max)
func (*FailedLoginTracker) RecordFailure ¶ added in v1.1.3
func (t *FailedLoginTracker) RecordFailure(ip string)
RecordFailure records a failed login attempt
func (*FailedLoginTracker) RecordSuccess ¶ added in v1.1.3
func (t *FailedLoginTracker) RecordSuccess(ip string)
RecordSuccess clears failed attempts for an IP
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service handles authentication
func NewService ¶
func NewService(db *sql.DB, masterPassword, sessionSecret string, sessionDuration time.Duration, logger *slog.Logger, authDisabled bool) *Service
NewService creates a new authentication service The master password is hashed at startup using Argon2id for secure storage in memory If a pre-hashed password is provided, it's used directly without re-hashing If authDisabled is true, authentication is completely bypassed (use with external auth)
func (*Service) CleanupExpiredSessions ¶
CleanupExpiredSessions removes all expired sessions
func (*Service) ClearSessionCookie ¶
func (s *Service) ClearSessionCookie(w http.ResponseWriter)
ClearSessionCookie clears the session cookie
func (*Service) CreateSession ¶
CreateSession creates a new session and returns the session token
func (*Service) InvalidateSession ¶
InvalidateSession removes a session MIGRATION STRATEGY: Supports both hash formats to ensure old sessions can be properly invalidated
func (*Service) IsAuthDisabled ¶ added in v1.2.2
IsAuthDisabled returns whether authentication is disabled
func (*Service) SetSessionCookie ¶
func (s *Service) SetSessionCookie(w http.ResponseWriter, token string)
SetSessionCookie sets the session cookie on the response
func (*Service) UpdatePassword ¶
UpdatePassword updates the master password (in-memory only, resets on restart) For persistent password storage, this would need to be stored in the database
func (*Service) ValidateSession ¶
ValidateSession checks if a session token is valid MIGRATION STRATEGY: Supports both HMAC-SHA256 (new) and SHA256 (legacy) for backward compatibility - Tries HMAC-SHA256 first (all new sessions) - Falls back to SHA256 only for old sessions - Automatically upgrades old sessions to HMAC-SHA256 on first use
func (*Service) VerifyPassword ¶
VerifyPassword checks if the provided password matches the master password
Source Files