go-auth

package main

import (
    "context"
    "fmt"

    "github.com/goliatone/go-auth"
)

type AppAuthConfig struct {
    SigningKey            string
    SigningMethod         string
    ContextKey            string
    TokenExpiration       int
    ExtendedTokenDuration int
    TokenLookup           string
    AuthScheme            string
    Issuer                string
    Audience              []string
    RejectedRouteKey      string
    RejectedRouteDefault  string
}

func (c AppAuthConfig) GetSigningKey() string           { return c.SigningKey }
func (c AppAuthConfig) GetSigningMethod() string        { return c.SigningMethod }
func (c AppAuthConfig) GetContextKey() string           { return c.ContextKey }
func (c AppAuthConfig) GetTokenExpiration() int         { return c.TokenExpiration }
func (c AppAuthConfig) GetExtendedTokenDuration() int   { return c.ExtendedTokenDuration }
func (c AppAuthConfig) GetTokenLookup() string          { return c.TokenLookup }
func (c AppAuthConfig) GetAuthScheme() string           { return c.AuthScheme }
func (c AppAuthConfig) GetIssuer() string               { return c.Issuer }
func (c AppAuthConfig) GetAudience() []string           { return c.Audience }
func (c AppAuthConfig) GetRejectedRouteKey() string     { return c.RejectedRouteKey }
func (c AppAuthConfig) GetRejectedRouteDefault() string { return c.RejectedRouteDefault }

func authenticateExample(tracker interface {
    auth.UserTracker
    auth.AtomicLoginAttemptTracker
}) error {
    userProvider := auth.NewUserProvider(tracker)

    // Any struct that satisfies auth.Config works.
    config := AppAuthConfig{
        SigningKey:            "your-secret-key",
        SigningMethod:         "HS256",
        ContextKey:            "auth",
        TokenExpiration:       24, // hours
        ExtendedTokenDuration: 24 * 7,
        TokenLookup:           "header:Authorization",
        AuthScheme:            "Bearer",
        Issuer:                "your-app",
        Audience:              []string{"your-audience"},
        RejectedRouteKey:      "redirect",
        RejectedRouteDefault:  "/",
    }

    authenticator := auth.NewAuthenticator(userProvider, config)

    // Login user
    token, err := authenticator.Login(context.Background(), "user@example.com", "password")
    if err != nil {
        return err
    }

    // Validate token and get session
    session, err := authenticator.SessionFromToken(token)
    if err != nil {
        return err
    }

    fmt.Printf("User ID: %s\n", session.GetUserID())
    return nil
}

// Implement ResourceRoleProvider for fine-grained permissions
type CustomResourceRoleProvider struct {
    repo auth.RepositoryManager
}

func (p *CustomResourceRoleProvider) FindResourceRoles(ctx context.Context, identity auth.Identity) (map[string]string, error) {
    resourceRoles := make(map[string]string)

    switch identity.Role() {
    case "admin":
        resourceRoles["admin:dashboard"] = "owner"
        resourceRoles["project:default"] = "admin"
    case "user":
        resourceRoles["project:default"] = "member"
    }

    return resourceRoles, nil
}

// Use enhanced authenticator
authenticator = authenticator.WithResourceRoleProvider(&CustomResourceRoleProvider{repo: repoManager})

// Generated tokens will include resource-specific permissions
token, err := authenticator.Login(ctx, "admin@example.com", "password")

// Create HTTP authenticator for web applications
httpAuth, err := auth.NewHTTPAuthenticator(authenticator, config)
if err != nil {
    log.Fatal(err)
}

// Register browser authentication routes (login, register, password reset)
// with one stable package-managed CSRF contract.
err = auth.RegisterSecureAuthRoutes(
    router.Group("/auth"),
    auth.AuthRouteSecurityConfig{
        CSRF: csrf.Config{
            SecureKey: auth.DeriveBrowserCSRFSecureKey(config),
        },
    },
    auth.WithControllerLogger(logger),
    func(ac *auth.AuthController) *auth.AuthController {
        ac.Auther = httpAuth
        ac.Repo = repoManager
        return ac
    },
)
if err != nil {
    log.Fatal(err)
}

// Protect routes with middleware
protected := httpAuth.ProtectedBrowserRoute(config, errorHandler)
router.Get("/profile", profileHandler, protected)

protected := httpAuth.ProtectedRoute(config, errorHandler)

// Custom success hook that adds logging, then runs the handler
wrapped := func(ctx router.Context) error {
    return protected(func(c router.Context) error {
        log.Println("auth ok for", c.Path())
        return profileHandler(c) // or c.Next() if chaining
    })(ctx)
}

router.Get("/profile", profileHandler, wrapped)

import (
    "encoding/base64"

    "github.com/goliatone/go-auth/social"
    "github.com/goliatone/go-auth/social/providers/github"
    "github.com/goliatone/go-auth/social/providers/google"
    repo "github.com/goliatone/go-auth/repository"
)

stateEncKey, _ := base64.StdEncoding.DecodeString(cfg.Social.StateEncryptionKey)
stateHMACKey, _ := base64.StdEncoding.DecodeString(cfg.Social.StateHMACKey)

socialRepo := repo.NewSocialAccountRepository(bunDB)

socialAuth := social.NewSocialAuthenticator(
    socialRepo,
    repoManager.Users(),
    authenticator.TokenService(),
    social.SocialAuthConfig{
        DefaultRedirectURL:   "/",
        StateEncryptionKey:   stateEncKey,
        StateHMACKey:         stateHMACKey,
        AllowSignup:          true,
        AllowLinking:         true,
        RequireEmailVerified: true,
    },
    social.WithProvider(github.New(github.Config{
        ClientID:     cfg.Social.GitHubClientID,
        ClientSecret: cfg.Social.GitHubClientSecret,
        CallbackURL:  cfg.BaseURL + "/auth/social/github/callback",
    })),
    social.WithProvider(google.New(google.Config{
        ClientID:     cfg.Social.GoogleClientID,
        ClientSecret: cfg.Social.GoogleClientSecret,
        CallbackURL:  cfg.BaseURL + "/auth/social/google/callback",
    })),
)

socialController := social.NewHTTPController(socialAuth, social.HTTPConfig{
    PathPrefix:        "/auth/social",
    SessionContextKey: cfg.Auth.GetContextKey(),
    CookieName:        cfg.Auth.GetContextKey(),
    SuccessRedirect:   "/dashboard",
    ErrorRedirect:     "/login?error=auth_failed",
    CookieSecure:      true,
    CookieHTTPOnly:    true,
    CookieSameSite:    "Lax",
})
socialController.RegisterRoutes(router.Group("/auth/social"))

import "github.com/goliatone/go-auth/provider/auth0"

auth0Validator, err := auth0.NewTokenValidator(auth0.Config{
    Domain:   "your-tenant.auth0.com",
    Audience: []string{"https://api.yourapp.com"},
})
if err != nil {
    return err
}

authenticator := auth.NewAuthenticator(userProvider, cfg.Auth)

// Accept Auth0 tokens only.
authenticator = authenticator.WithTokenValidator(auth0Validator)

// Or accept Auth0 + local go-auth tokens.
composite := auth.NewMultiTokenValidator(auth0Validator, authenticator.TokenService())
authenticator = authenticator.WithTokenValidator(composite)

// Check permissions in handlers
func profileHandler(c router.Context) error {
    session, err := auth.GetRouterSession(c, "auth")
    if err != nil {
        return err
    }

    // Enhanced session with resource-level permissions
    if roleCapableSession, ok := session.(auth.RoleCapableSession); ok {
        canEditSettings := roleCapableSession.CanEdit("admin:settings")
        canDeleteUsers := roleCapableSession.CanDelete("admin:users")
        hasAdminRole := roleCapableSession.HasRole("admin")
        isAtLeastMember := roleCapableSession.IsAtLeast("member")

        // Use permissions for authorization logic
    }

    return c.JSON(map[string]any{
        "user_id": session.GetUserID(),
        "data": session.GetData(),
    })
}

import (
    csrf "github.com/goliatone/go-auth/middleware/csrf"
    "github.com/goliatone/go-router"
)

func main() {
    server := router.NewFiberAdapter()
    app := server.Router()

    // HMAC-signed tokens; a random key is generated once for this middleware.
    app.Use(csrf.New())

    app.Post("/submit", func(ctx router.Context) error {
        // Token checked automatically
        return ctx.SendStatus(router.StatusNoContent)
    })

    if err := server.Serve(":8080"); err != nil {
        panic(err)
    }
}

type redisStorage struct{ client *redis.Client }

func (r *redisStorage) Get(key string) (string, error) {
    return r.client.Get(context.Background(), key).Result()
}

// Set/Delete omitted for brevity

app.Use(csrf.New(csrf.Config{
    Storage:    &redisStorage{client: redisClient},
    Expiration: 24 * time.Hour,
}))

// Inside your handler
viewCtx := auth.MergeTemplateData(ctx, router.ViewContext{
    "title": "Secure form",
})

// MergeTemplateData copies the latest request scoped helpers so csrf_field,
// csrf_meta, etc. always render the token minted by the middleware.
return ctx.Render("form", viewCtx)

cfg := router.NewSimpleViewConfig("views").
    WithFunctions(auth.TemplateHelpers()).
    WithFiberV3Functions(auth.TemplateHelpersForPongo2V7())

engine, err := router.InitializeFiberV3ViewEngine(cfg)
// Handle err, then use this as the host's Views value:
views := auth.NewTemplateViews(engine)

import csrf "github.com/goliatone/go-auth/middleware/csrf"

csrf.RegisterRoutes(app.Router())

auditSink := auth.ActivitySinkFunc(func(ctx context.Context, event auth.ActivityEvent) error {
    log.Printf(
        "user %s transitioned %s -> %s (reason=%v)",
        event.UserID,
        event.FromStatus,
        event.ToStatus,
        event.Metadata["reason"],
    )
    return nil
})

stateMachine := auth.NewUserStateMachine(
    repoManager.Users(),
    auth.WithStateMachineActivitySink(auditSink),
)

actor := auth.ActorRef{ID: "admin-42", Type: "admin"}
updated, err := stateMachine.Transition(
    ctx,
    actor,
    user,
    auth.UserStatusSuspended,
    auth.WithTransitionReason("manual review"),
    auth.WithTransitionMetadata(map[string]any{"ticket": "SEC-204"}),
)
if err != nil {
    panic(err)
}

fmt.Println("new status:", updated.Status, "suspended at:", updated.SuspendedAt)

handler := func(ctx context.Context, phase auth.TransitionHookPhase, err error, tc auth.TransitionContext) error {
    log.Printf("hook stage=%s user=%s error=%v", phase, tc.User.ID, err)
    return fmt.Errorf("policy hook failed: %w", err)
}

stateMachine := auth.NewUserStateMachine(
    repoManager.Users(),
    auth.WithStateMachineHookErrorHandler(handler),
)

auditSink := auth.ActivitySinkFunc(func(ctx context.Context, event auth.ActivityEvent) error {
    log.Printf("activity event=%s user=%s actor=%s", event.EventType, event.UserID, event.Actor.Type)
    return nil
})

stateMachine := auth.NewUserStateMachine(users,
    auth.WithStateMachineActivitySink(auditSink),
)

auther := auth.NewAuthenticator(provider, cfg).
    WithActivitySink(auditSink)

import (
    "context"
    "time"

    auth "github.com/goliatone/go-auth"
    "github.com/goliatone/go-auth/activitymap"
)

type ExternalRecord struct {
    ActorID    string
    Verb       string
    ObjectType string
    ObjectID   string
    Channel    string
    Metadata   map[string]any
    OccurredAt time.Time
}

sink := auth.ActivitySinkFunc(func(ctx context.Context, event auth.ActivityEvent) error {
    normalized := activitymap.Normalize(
        event,
        activitymap.WithDefaultChannel("auth"),
        activitymap.WithDefaultObjectType("user"),
        activitymap.WithObjectIDResolver(func(e auth.ActivityEvent) string {
            if v, ok := e.Metadata["password_reset_id"].(string); ok {
                return v
            }
            return e.UserID
        }),
    )

    record := ExternalRecord{
        ActorID:    normalized.ActorID,
        Verb:       normalized.Verb,
        ObjectType: normalized.ObjectType,
        ObjectID:   normalized.ObjectID,
        Channel:    normalized.Channel,
        Metadata:   normalized.Metadata,
        OccurredAt: normalized.OccurredAt,
    }
    _ = record
    return nil
})

decorator := auth.ClaimsDecoratorFunc(func(ctx context.Context, identity auth.Identity, claims *auth.JWTClaims) error {
	if claims.Metadata == nil {
		claims.Metadata = map[string]any{}
	}
	claims.Metadata["tenant_id"] = lookupTenant(identity.ID())
	if claims.Resources == nil {
		claims.Resources = map[string]string{}
	}
	claims.Resources["team:"+identity.ID()] = "editor"
	return nil
})

auther := auth.NewAuthenticator(provider, cfg).
	WithClaimsDecorator(decorator)

auther := auth.NewAuthenticator(provider, cfg).
    WithTokenSizeGuardrails(3072, 6144)

tokenService := auth.NewTokenService(
    signingKey,
    tokenExpiration,
    issuer,
    audience,
    logger,
    auth.WithTokenSizeGuardrails(2048, 4096),
)

// Access the token service directly
tokenService := authenticator.TokenService()

// Generate tokens manually with custom resource roles
resourceRoles := map[string]string{
    "project:123": "admin",
    "files:uploads": "owner",
}
token, err := tokenService.Generate(identity, resourceRoles)

// Validate tokens manually
claims, err := tokenService.Validate(tokenString)

tokenService := authenticator.TokenService()

opts := auth.ScopedTokenOptions{
    TTL:    15 * time.Minute,            // overrides default expiration
    Scopes: []string{"debug.view"},       // stored in the "scopes" claim
}

token, expiresAt, err := auth.MintScopedToken(tokenService, identity, nil, opts)

baseResolver := func(ctx context.Context) ([]string, error) {
    // load effective permissions (db, role registry, policy engine, etc.)
    return []string{"admin.translations.export"}, nil
}

resolver := auth.NewCachedPermissionsResolver(auth.CachedPermissionsResolverConfig{
    Resolver: baseResolver,
    KeyFunc:  auth.DefaultPermissionsCacheKeyFromContext,
    TTL:      2 * time.Minute,
    // Store omitted -> defaults to in-memory implementation
    // CacheErrorMode omitted -> defaults to fail_open
})

resolvePermissions := resolver.ResolverFunc()

ctx := auth.WithResolvedPermissionsCache(req.Context())
permissions, err := resolvePermissions(ctx) // repeated calls in this request resolve once

if err := auth.ValidateResolverConfigured(true, resolvePermissions); err != nil {
    return err
}
// or panic-fast for startup wiring:
auth.MustValidateResolverConfigured(true, resolvePermissions)

type PermissionCacheStore interface {
    Get(ctx context.Context, key string) (permissions []string, ok bool, err error)
    Set(ctx context.Context, key string, permissions []string, ttl time.Duration) error
    Delete(ctx context.Context, key string) error
}

type PurgeablePermissionCacheStore interface {
    PurgeExpired(ctx context.Context) (purged int, err error)
}

type PermissionStoreAdapter struct {
    cache cache.Cache[string, []string]
}

func (s *PermissionStoreAdapter) Get(ctx context.Context, key string) ([]string, bool, error) {
    return s.cache.Get(ctx, key)
}

func (s *PermissionStoreAdapter) Set(ctx context.Context, key string, permissions []string, ttl time.Duration) error {
    return s.cache.Set(ctx, key, permissions, ttl)
}

func (s *PermissionStoreAdapter) Delete(ctx context.Context, key string) error {
    return s.cache.Delete(ctx, key)
}

resolver := auth.NewCachedPermissionsResolver(auth.CachedPermissionsResolverConfig{
    Resolver:       baseResolver,
    KeyFunc:        auth.DefaultPermissionsCacheKeyFromContext,
    Store:          &PermissionStoreAdapter{cache: sharedCache},
    TTL:            2 * time.Minute,
    CacheErrorMode: auth.PermissionCacheErrorModeFailOpen, // or FailClosed
})

_ = resolver.Invalidate(ctx, cacheKey)
purged, err := resolver.PurgeExpired(ctx) // returns 0,nil if store is not purgeable
_ = purged
_ = err

// Create TokenServiceAdapter for jwtware middleware
tokenValidator := auth.NewTokenServiceAdapter(authenticator.TokenService())

// Configure JWT middleware
jwtConfig := jwtware.Config{
    SigningKey: jwtware.SigningKey{
        Key:    []byte(config.GetSigningKey()),
        JWTAlg: config.GetSigningMethod(),
    },
    TokenValidator: tokenValidator,
    ContextKey:     "auth",
}

middleware := jwtware.New(jwtConfig)

// Example resource roles map
resourceRoles := map[string]string{
    "project:123":     "admin",      // Admin of project 123
    "admin:dashboard": "member",     // Member access to admin dashboard
    "files:uploads":   "owner",      // Owner of file uploads
}

type Config interface {
    GetSigningKey() string
    GetTokenExpiration() int
    GetExtendedTokenDuration() int
    GetIssuer() string
    GetAudience() []string
    GetContextKey() string
    GetTokenLookup() string
    GetAuthScheme() string
    GetRejectedRouteKey() string
    GetRejectedRouteDefault() string
}

// Protect routes requiring authentication
httpAuth, err := auth.NewHTTPAuthenticator(authenticator, config)
if err != nil {
    log.Fatal(err)
}
protectedRoute := httpAuth.ProtectedRoute(config, errorHandler)
router.Use("/api/", protectedRoute)

// Custom authorization logic
func requireAdminRole(c router.Context) error {
    session, err := auth.GetRouterSession(c, config.GetContextKey())
    if err != nil {
        return c.Status(401).SendString("Unauthorized")
    }
    if !session.IsAtLeast(auth.RoleAdmin) {
        return c.Status(403).SendString("Forbidden")
    }
    return c.Next()
}

func registerChat[T any](routes router.Router[T], authenticator *auth.Auther) {
    protected := authenticator.NewWSAuthMiddleware()
    routes.Get("/chat", router.NewWSHandler(protected(
        func(ctx context.Context, client router.WSClient) error {
            claims, ok := auth.WSAuthClaimsFromContext(ctx)
            if !ok || !claims.CanRead("chat:messages") {
                return client.Close(1008, "Unauthorized")
            }
            return client.SendJSON(map[string]string{"user_id": claims.UserID()})
        },
    )))
}

wsConfig := router.WSAuthConfig{
    TokenExtractor: func(ctx context.Context, client router.WSClient) (string, error) {
        token := client.Conn().Header("X-Auth-Token")
        if token == "" { return "", errors.New("missing auth token") }
        return token, nil
    },
    OnAuthFailure: func(ctx context.Context, client router.WSClient, err error) error {
        return client.Close(1008, "Authentication failed")
    },
}
protected := authenticator.NewWSAuthMiddleware(wsConfig)

// Register user
registerUser := auth.NewRegisterUserHandler(repositoryManager)
err := registerUser.Execute(ctx, auth.RegisterUserMessage{
    FirstName: "John",
    LastName:  "Doe",
    Email:     "john@example.com",
    Password:  "securepassword",
})

// Initialize password reset
initReset := auth.NewInitializePasswordResetHandler(repositoryManager).WithDelivery(resetDelivery)
err := initReset.Execute(ctx, auth.InitializePasswordResetMessage{
    Email: "user@example.com",
    Stage: "show-reset",
})