authkit

package module

Go to main page

Versions in this module

v1

v1.0.10

Jul 19, 2026

Changes in this version

type Auth

+ func (a *Auth) ChangeFirstPassword(w http.ResponseWriter, r *http.Request)

type PasswordUser

+ MustChangePassword bool

v1.0.9

Jul 13, 2026

v1.0.8

Jul 13, 2026

Changes in this version

type Auth

+ func (a *Auth) IssueAccessTokenOnly(w http.ResponseWriter, u *User, ttl time.Duration) error

v1.0.7

Jul 8, 2026

Changes in this version

+ type AuthCodeStore interface

+ ClaimAuthCode func(ctx context.Context, jti string, expiresAt time.Time) (ok bool, err error)

type Config

+ AuthCodeStore AuthCodeStore

+ type PlatformTOTPReplayGuard interface

+ ClaimPlatformTOTPTimestep func(ctx context.Context, email string, timestep int64) (ok bool, err error)

type RefreshTokenStore

+ RevokeAllForUser func(ctx context.Context, tenantID, email string) error

+ type TOTPReplayGuard interface

+ ClaimTOTPTimestep func(ctx context.Context, tenantID, email string, timestep int64) (ok bool, err error)

v1.0.6

Jul 8, 2026

v1.0.5

Jul 4, 2026

v1.0.4

Jul 4, 2026

Changes in this version

type Auth

+ func (a *Auth) IssuePasswordToken(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) IssuePasswordToken2FA(w http.ResponseWriter, r *http.Request)

v1.0.3

Jul 1, 2026

Changes in this version

+ const Audit2FADisable

+ const Audit2FARecoveryRegen

+ const AuditPasswordChange

+ const AuditPasswordReset

+ const AuditPasswordResetRequest

+ const CapPrintJobReceive

+ const CapPrintStatusReport

+ const ResetKindPlatform

+ const ResetKindUser

+ var ErrDeviceTokenInvalid = errors.New("authkit: invalid device token")

+ var ErrImpersonationDisabled = errors.New("authkit: impersonation is disabled")

+ var ErrImpersonationForbidden = errors.New("authkit: platform:impersonate capability required")

+ func IsDeviceCapability(perm string) bool

+ func WithDevice(ctx context.Context, d *Device) context.Context

type Auth

+ func (a *Auth) AuthenticateDevice(ctx context.Context, rawToken string) (*Device, error)

+ func (a *Auth) Authorize(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) CSRF(next http.Handler) http.Handler

+ func (a *Auth) CSRFToken(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) ChangePassword(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) ConfirmTwoFactor(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) DisableTwoFactor(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Enroll2FA(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) ForgotPassword(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) ImpersonationContext(ctx context.Context, admin *PlatformAdmin, tenantID string) (context.Context, error)

+ func (a *Auth) IssueResetToken(ctx context.Context, email, name, kind string) (string, error)

+ func (a *Auth) IssueToken(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) JWKS(w http.ResponseWriter, _ *http.Request)

+ func (a *Auth) LogoutEverywhere(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformEnroll2FA(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformForgotPassword(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformLogin(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformLogout(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformMe(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformResetPassword(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) PlatformVerify2FA(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) RefreshAccessToken(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) RegenerateRecoveryCodes(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) RequireDevice(perm string) func(http.Handler) http.Handler

+ func (a *Auth) RequirePlatformAdmin(perm string) func(http.Handler) http.Handler

+ func (a *Auth) ResetPassword(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) RevokeUserSessions(ctx context.Context, tenantID, email string) error

+ func (a *Auth) TwoFactorStatus(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Verify2FA(w http.ResponseWriter, r *http.Request)

type Config

+ AbsoluteTimeout time.Duration

+ AccessTokenTTL time.Duration

+ AppName string

+ DeviceTokenValidator DeviceTokenValidator

+ EnableCSRF bool

+ EnableImpersonation bool

+ EnableTokens bool

+ IdleTimeout time.Duration

+ PasswordResetStore PasswordResetStore

+ PasswordResetTTL time.Duration

+ PlatformAdminStore PlatformAdminStore

+ PlatformPolicy PlatformPolicy

+ RefreshTokenStore RefreshTokenStore

+ RefreshTokenTTL time.Duration

+ Require2FAForRoles []string

+ ResetDelivery ResetDelivery

+ SessionStore SessionStore

+ SigningKeys []SigningKey

+ TOTPStore TOTPStore

+ Throttler LoginThrottler

+ TokenClientID string

+ TokenIssuer string

+ TokenRedirectURIs []string

+ TrustedDeviceStore TrustedDeviceStore

+ TrustedDeviceTTL time.Duration

+ type Device struct

+ AgentID string

+ BranchID string

+ Name string

+ TenantID string

+ func DeviceFromCtx(ctx context.Context) *Device

+ func (d *Device) Can(perm string) bool

+ type DeviceRecord struct

+ AgentID string

+ BranchID string

+ Name string

+ TenantID string

+ type DeviceTokenValidator interface

+ ValidateDeviceToken func(ctx context.Context, rawToken string) (*DeviceRecord, error)

+ type LoginThrottler interface

+ Allow func(ctx context.Context, key string) (retryAfter time.Duration, ok bool)

+ RecordFailure func(ctx context.Context, key string) error

+ Reset func(ctx context.Context, key string) error

+ type PasswordResetStore interface

+ ConsumeResetToken func(ctx context.Context, tokenHash, kind string) (email string, ok bool, err error)

+ CreateResetToken func(ctx context.Context, tokenHash, email, kind string, expiresAt time.Time) error

+ type PlatformAdmin struct

+ Email string

+ Name string

+ Role string

+ func PlatformAdminFromCtx(ctx context.Context) *PlatformAdmin

+ func (p *PlatformAdmin) Can(perm string) bool

+ type PlatformAdminRecord struct

+ Email string

+ HashedPassword string

+ Name string

+ Role string

+ TOTPConfirmed bool

+ TOTPSecret string

+ type PlatformAdminStore interface

+ ConfirmPlatformTOTP func(ctx context.Context, email string) error

+ ConsumePlatformRecovery func(ctx context.Context, email, codeHash string) (bool, error)

+ EnrollPlatformTOTP func(ctx context.Context, email, secret string, recoveryCodeHashes []string) error

+ GetPlatformAdmin func(ctx context.Context, email string) (*PlatformAdminRecord, error)

+ UpdatePassword func(ctx context.Context, email, hashedPassword string) error

+ type PlatformPolicy interface

+ PermissionsForPlatformRole func(role string) []string

+ type RefreshToken struct

+ ChainID string

+ ExpiresAt time.Time

+ ID string

+ IssuedAt time.Time

+ ParentID string

+ RevokedAt *time.Time

+ TenantID string

+ UsedAt *time.Time

+ UserEmail string

+ type RefreshTokenStore interface

+ Create func(ctx context.Context, t *RefreshToken) error

+ Get func(ctx context.Context, rawToken string) (*RefreshToken, error)

+ RevokeChain func(ctx context.Context, chainID string) error

+ Rotate func(ctx context.Context, rawOld string, next *RefreshToken) error

+ type ResetDelivery interface

+ SendPasswordReset func(ctx context.Context, req ResetRequest) error

+ type ResetRequest struct

+ Email string

+ Kind string

+ Name string

+ TTL time.Duration

+ Token string

+ type ResetToken struct

+ Email string

+ ExpiresAt time.Time

+ Kind string

+ TokenHash string

+ UsedAt *time.Time

+ type Session struct

+ BranchID string

+ CreatedAt time.Time

+ Email string

+ ID string

+ LastSeenAt time.Time

+ Name string

+ Permissions []string

+ Platform bool

+ Provider string

+ Role string

+ TenantID string

+ type SessionStore interface

+ Create func(ctx context.Context, s *Session) error

+ Get func(ctx context.Context, id string) (*Session, error)

+ Revoke func(ctx context.Context, id string) error

+ RevokeAllForUser func(ctx context.Context, tenantID, email string) error

+ Touch func(ctx context.Context, id string, lastSeen time.Time) error

+ type SigningKey struct

+ KID string

+ Private ed25519.PrivateKey

+ func NewSigningKey(kid string, seed []byte) (SigningKey, error)

+ type TOTPManager interface

+ Disable func(ctx context.Context, tenantID, email string) error

+ ReplaceRecoveryCodes func(ctx context.Context, tenantID, email string, recoveryCodeHashes []string) error

+ type TOTPStore interface

+ Confirm func(ctx context.Context, tenantID, email string) error

+ ConsumeRecovery func(ctx context.Context, tenantID, email, codeHash string) (bool, error)

+ Enroll func(ctx context.Context, tenantID, email, secret string, ...) error

+ Secret func(ctx context.Context, tenantID, email string) (secret string, confirmed bool, err error)

+ type TrustedDeviceStore interface

+ IsTrusted func(ctx context.Context, tenantID, email, token string) (bool, error)

+ RevokeAllForUser func(ctx context.Context, tenantID, email string) error

+ Trust func(ctx context.Context, tenantID, email string, ttl time.Duration) (token string, err error)

type UserStore

+ UpdatePassword func(ctx context.Context, email, hashedPassword string) error

v1.0.2

Jun 28, 2026

Changes in this version

+ const Audit2FAEnroll

+ const Audit2FAVerify

+ const AuditImpersonate

+ const AuditLogin

+ const AuditLogout

+ const AuditPermissionChange

+ const AuditRefresh

+ const AuditRevoke

+ const AuditRoleChange

+ func TenantIDFromCtx(ctx context.Context) (id string, ok bool)

+ func WithTenant(ctx context.Context, tenantID string) context.Context

+ type AuditEvent struct

+ Actor string

+ At time.Time

+ IP string

+ Meta map[string]any

+ Subject string

+ TenantID string

+ Type string

+ type AuditSink interface

+ Emit func(ctx context.Context, ev AuditEvent)

type Config

+ AuditSink AuditSink

+ LivePermissionResolution bool

+ PermissionCacheTTL time.Duration

+ type NopAuditSink struct

+ func (NopAuditSink) Emit(context.Context, AuditEvent)

type PasswordUser

+ BranchID string

+ TenantID string

type User

+ BranchID string

+ TenantID string

v1.0.1

Apr 14, 2026

Changes in this version

type Config

+ GothProviders []goth.Provider

v1.0.0

Mar 23, 2026

v0

v0.0.4

Mar 23, 2026

Changes in this version

+ func WithLogger(l Logger) func(*LayeredPolicyProvider)

+ type LayeredPolicyProvider struct

+ func NewLayeredProvider(filePath string, store UserRoleStore, opts ...func(*LayeredPolicyProvider)) (*LayeredPolicyProvider, error)

+ func (l *LayeredPolicyProvider) DeleteOverride(ctx context.Context, email string) error

+ func (l *LayeredPolicyProvider) PermissionsForRole(role string) []string

+ func (l *LayeredPolicyProvider) Reload() error

+ func (l *LayeredPolicyProvider) RoleFor(ctx context.Context, email string) (string, []string)

+ func (l *LayeredPolicyProvider) SetOverride(ctx context.Context, email, role string, permissions []string) error

+ func (l *LayeredPolicyProvider) Store() UserRoleStore

+ type PolicyProvider interface

+ PermissionsForRole func(role string) []string

+ RoleFor func(ctx context.Context, email string) (role string, permissions []string)

+ type PolicyReloader interface

+ Reload func() error

type RBACConfig

+ Provider PolicyProvider

+ type UserRoleStore interface

+ DeleteOverride func(ctx context.Context, email string) error

+ GetOverride func(ctx context.Context, email string) (role string, permissions []string, found bool, err error)

+ SetOverride func(ctx context.Context, email, role string, permissions []string) error

v0.0.3

Mar 22, 2026

Changes in this version

+ type APIKeyValidator interface

+ ValidateKey func(ctx context.Context, rawKey string) (*User, error)

type Auth

+ func (a *Auth) RequireSession(permission string) func(http.Handler) http.Handler

+ func (a *Auth) RequireSessionAuth(next http.Handler) http.Handler

type Config

+ APIKeyValidator APIKeyValidator

v0.0.2

Mar 22, 2026

v0.0.1

Mar 22, 2026

Changes in this version

+ const PermAll

+ const PermManage

+ const PermUpload

+ const PermView

+ var ErrUserExists = errors.New("authkit: user already exists")

+ var ErrUserNotFound = errors.New("authkit: user not found")

+ func CheckPassword(hashedPassword, password string) bool

+ func HashPassword(password string) (string, error)

+ type Auth struct

+ func New(cfg Config) (*Auth, error)

+ func (a *Auth) BeginAuth(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Callback(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Login(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Logout(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Me(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Register(w http.ResponseWriter, r *http.Request)

+ func (a *Auth) Require(permission string) func(http.Handler) http.Handler

+ func (a *Auth) RequireAuth(next http.Handler) http.Handler

+ func (a *Auth) WatchRBAC(ctx context.Context, interval time.Duration)

+ type AuthMode string

+ const AuthModeBoth

+ const AuthModeOAuth

+ const AuthModePassword

+ type Config struct

+ AfterLoginURL string

+ AfterLogoutURL string

+ CallbackBaseURL string

+ Logger Logger

+ Mode AuthMode

+ PasswordPolicy *PasswordPolicy

+ Providers []ProviderConfig

+ RBAC RBACConfig

+ SecureCookie bool

+ SessionSecret string

+ UserStore UserStore

+ type Logger interface

+ Error func(msg string, args ...any)

+ Info func(msg string, args ...any)

+ type PasswordPolicy struct

+ MinLength int

+ type PasswordUser struct

+ Email string

+ HashedPassword string

+ Name string

+ type Policy struct

+ DefaultRole string

+ Roles map[string]RolePolicy

+ type ProviderConfig struct

+ ClientID string

+ ClientSecret string

+ Name string

+ Scopes []string

+ type RBACConfig struct

+ FilePath string

+ type RolePolicy struct

+ Members []string

+ Permissions []string

+ type User struct

+ AvatarURL string

+ Email string

+ Name string

+ Provider string

+ Role string

+ func UserFromCtx(ctx context.Context) *User

+ func (u *User) Can(permission string) bool

+ type UserStore interface

+ CreateUser func(ctx context.Context, email, name, hashedPassword string) error

+ GetUserByEmail func(ctx context.Context, email string) (*PasswordUser, error)

Other modules containing this package

github.com/tlmanz/authkit/v2

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL