Documentation
¶
Index ¶
- func GenerateAuthKey() string
- func GenerateEncryptionKey() string
- func IDFromContext[ID comparable](ctx context.Context) (id ID)
- func IdentFromContext[Ident any](ctx context.Context) (auth *Ident)
- func NewBasicAuthHandler[Ident any](config *BasicAuthConfig[Ident]) http.Handler
- func NewCookieStore(authKey, encryptKey string) *sessions.CookieStore
- func NewGothHandler[Ident any, ID comparable](config *GothConfig[Ident, ID]) http.Handler
- func OverrideContextAuth[Ident any, ID comparable](ctx context.Context, id ID, ident *Ident) context.Context
- func UseAuthContext[Ident any, ID comparable, Service ServiceReader[Ident, ID]](auth Service) func(next http.Handler) http.Handler
- func UseAuthRequired[Ident any]() func(next http.Handler) http.Handler
- type BasicAuthConfig
- type BasicAuthService
- type GothConfig
- type Service
- type ServiceReader
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateAuthKey ¶
func GenerateAuthKey() string
GenerateAuthKey generates a random authentication key. Will panic if the random number generator fails, which should generally only happen on systems with an insecure random number generator (which means you probably shouldn't be using that system for anything security related).
The same could be done using bash (on linux), for example:
head -c 64 /dev/urandom | xxd -p -c 64
func GenerateEncryptionKey ¶
func GenerateEncryptionKey() string
GenerateEncryptionKey generates a random encryption key. Will panic if the random number generator fails, which should generally only happen on systems with an insecure random number generator (which means you probably shouldn't be using that system for anything security related).
The same could be done using bash (on linux), for example:
head -c 32 /dev/urandom | xxd -p -c 32
func IDFromContext ¶
func IDFromContext[ID comparable](ctx context.Context) (id ID)
IDFromContext returns the user ID from the request context, if any. Note that this will only work if the UseAuthContext middleware has been loaded, and the user is authenticated.
Returns 0 if the user is not authenticated or the ID was not found in the context.
func IdentFromContext ¶
IdentFromContext returns the ident from the request context, if any. Note that this will only work if the UseAuthContext middleware has been loaded, and the user is authenticated. Provided Ident type MUST match what is used in AuthHandler.
Returns nil if the user is not authenticated or the ident was not found in the context.
func NewBasicAuthHandler ¶
func NewBasicAuthHandler[Ident any](config *BasicAuthConfig[Ident]) http.Handler
NewBasicAuthHandler creates a new AuthHandler. The following endpoints are implemented:
- GET: <mount>/self - returns the current user authentication info (if enabled).
- GET: <mount>/login - initiates the provider authentication, using basic auth.
- GET: <mount>/logout - logs the user out.
func NewCookieStore ¶
func NewCookieStore(authKey, encryptKey string) *sessions.CookieStore
NewCookieStore creates a new session storage that uses encrypted cookies. authKey is used to validate the session cookie, and encryptKey is used to encrypt the session cookie.
It is recommended to use an authentication key with 32 or 64 bytes. The encryption key, if set, must be either 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256 modes. Provide the keys in hexadecimal string format. The following link can be used to generate a random key:
The same could be done using bash (on linux), for example:
head -c 64 /dev/urandom | xxd -p -c 64 # 64 bytes, auth key head -c 32 /dev/urandom | xxd -p -c 32 # 32 bytes, encryption key
func NewGothHandler ¶
func NewGothHandler[Ident any, ID comparable](config *GothConfig[Ident, ID]) http.Handler
NewGothHandler creates a new auth handler using markbates/goth.
The following endpoints are implemented:
- GET: <mount>/self - returns the current user authentication info (if enabled).
- GET: <mount>/providers - returns a list of all available providers.
- GET: <mount>/providers/{provider} - initiates the provider authentication.
- GET: <mount>/providers/{provider}/callback - redirect target from the provider.
- GET: <mount>/logout - logs the user out.
func OverrideContextAuth ¶
func OverrideContextAuth[Ident any, ID comparable](ctx context.Context, id ID, ident *Ident) context.Context
OverrideContextAuth overrides the authentication information in the request, and returns a new context with the updated information. This is useful for when you want to temporarily override the authentication information in the request, such as when you want to impersonate another user, or for mocking in tests.
func UseAuthContext ¶
func UseAuthContext[Ident any, ID comparable, Service ServiceReader[Ident, ID]](auth Service) func(next http.Handler) http.Handler
UseAuthContext adds the user authentication info to the request context, using the cookie session information. If used more than once in the same request middleware chain, it will be a no-op. This will also add logging attributes through github.com/lrstanley/chix/v2/chix.AppendLogAttrs for the user.
func UseAuthRequired ¶
UseAuthRequired is a middleware that requires the user to be authenticated. Note that this requires the UseAuthContext middleware to be loaded prior to this middleware.
Types ¶
type BasicAuthConfig ¶
type BasicAuthConfig[Ident any] struct { // Service is the authentication service to use. Service BasicAuthService[Ident] // SessionStorage is the session storage to use. Take a look at [NewCookieStore] for a // convenient way to create a session storage, which doesn't require any server-side // state management. Note that this must be the same session storage across all auth // handlers, as markbates/goth currently only supports a global session store. SessionStorage sessions.Store // DisableSelfEndpoint disables the self endpoint. DisableSelfEndpoint bool }
func (*BasicAuthConfig[Ident]) Validate ¶
func (c *BasicAuthConfig[Ident]) Validate() error
Validate validates the basic auth config. Use this to validate the config before using it, otherwise NewBasicAuthHandler will panic if an invalid config is provided.
type BasicAuthService ¶
type BasicAuthService[Ident any] interface { BasicAuth(ctx context.Context, username, password string) (*Ident, error) Get(ctx context.Context, username string) (*Ident, error) }
BasicAuthService is the interface for the basic authentication service.
type GothConfig ¶
type GothConfig[Ident any, ID comparable] struct { // Service is the authentication service to use. Service Service[Ident, ID] // SessionStorage is the session storage to use. Take a look at [NewCookieStore] for a // convenient way to create a session storage, which doesn't require any server-side // state management. Note that this must be the same session storage across all auth // handlers, as markbates/goth currently only supports a global session store. SessionStorage sessions.Store // DisableSelfEndpoint disables the self endpoint. DisableSelfEndpoint bool }
func (*GothConfig[Ident, ID]) Validate ¶
func (c *GothConfig[Ident, ID]) Validate() error
Validate validates the Goth config. Use this to validate the config before using it, otherwise NewGothHandler will panic if an invalid config is provided.
type Service ¶
type Service[Ident any, ID comparable] interface { Get(context.Context, ID) (*Ident, error) Set(context.Context, *goth.User) (ID, error) }
Service is the interface for the authentication service.
type ServiceReader ¶
type ServiceReader[Ident any, ID comparable] interface { Get(context.Context, ID) (*Ident, error) }
ServiceReader is the read-only variant of the Service interface.
Source Files