auth

Documentation

Index

• Constants
• func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) error
• func LegacyOAuth(bearer string, hash [64]byte, w http.ResponseWriter, r *http.Request, ...)
• func LookupTokenRevocation(ctx context.Context, username string, hash [64]byte, clientID string) (bool, error)
• func LookupUser(ctx context.Context, username string, user *AuthContext) error
• func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler
• func OAuth2(token string, hash [64]byte, w http.ResponseWriter, r *http.Request, ...)
• func WebhookAuth(ctx context.Context, auth *AuthContext, tokenHash [64]byte, rawGrants string, ...) (context.Context, error)
• type AuthContext
  • func ForContext(ctx context.Context) *AuthContext
  • func (authctx *AuthContext) Access(scope, kind string) error
• type AuthCookie
• type BearerToken
  • func DecodeBearerToken(token string) *BearerToken
  • func (bt *BearerToken) Encode() string
• type Grants
  • func DecodeGrants(ctx context.Context, grants string) (Grants, error)
  • func (g *Grants) Encode() string
  • func (g *Grants) Has(grant string, mode string) bool
  • func (g *Grants) HasAll() bool
  • func (g *Grants) IsSubset(other *Grants) bool
• type InternalAuth
• type Timestamp
  • func ToTimestamp(t time.Time) Timestamp
  • func (t Timestamp) Time() time.Time

Constants

const (
	RO = "RO"
	RW = "RW"
)

const (
	USER_UNCONFIRMED       = "UNCONFIRMED"
	USER_ACTIVE_NON_PAYING = "ACTIVE_NON_PAYING"
	USER_ACTIVE_FREE       = "ACTIVE_FREE"
	USER_ACTIVE_PAYING     = "ACTIVE_PAYING"
	USER_ACTIVE_DELINQUENT = "ACTIVE_DELINQUENT"
	USER_ADMIN             = "ADMIN"
	USER_UNKNOWN           = "UNKNOWN"
	USER_SUSPENDED         = "SUSPENDED"
)

const (
	AUTH_OAUTH_LEGACY  = "OAUTH_LEGACY"
	AUTH_OAUTH2        = "OAUTH2"
	AUTH_COOKIE        = "COOKIE"
	AUTH_INTERNAL      = "INTERNAL"
	AUTH_ANON_INTERNAL = "ANON_INTERNAL"
	AUTH_WEBHOOK       = "WEBHOOK"
)

const TokenVersion uint = 0

Functions

func FetchMetaProfile

func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) error

func LegacyOAuth

func LegacyOAuth(bearer string, hash [64]byte, w http.ResponseWriter,
	r *http.Request, next http.Handler)

TODO: Remove legacy OAuth support

func LookupTokenRevocation

func LookupTokenRevocation(ctx context.Context,
	username string, hash [64]byte, clientID string) (bool, error)

Returns true if this token or client ID has been revoked (and therefore should not be trusted)

func LookupUser

func LookupUser(ctx context.Context, username string, user *AuthContext) error

func Middleware

func Middleware(conf ini.File, apiconf string) func(http.Handler) http.Handler

func OAuth2

func OAuth2(token string, hash [64]byte, w http.ResponseWriter,
	r *http.Request, next http.Handler)

func WebhookAuth

func WebhookAuth(ctx context.Context, auth *AuthContext,
	tokenHash [64]byte, rawGrants string, clientID *string,
	expires time.Time) (context.Context, error)

Returns an auth context configured for webhook delivery. This auth configuration is not possible during a normal GraphQL query, and is only used during webhook execution.

The "ctx" parameter should be a webhook context, and the "auth" parameter should be the authentication context from the request which caused the webhook to be fired.

Types

type AuthContext

type AuthContext struct {
	AuthMethod string
	IPAddress  string

	// Only filled out for non-anonymous authentication
	UserID           int
	Created          time.Time
	Updated          time.Time
	Username         string
	Email            string
	UserType         string
	URL              *string
	Location         *string
	Bio              *string
	SuspensionNotice *string

	// Only set for meta.sr.ht-api
	PGPKey *string

	// Only filled out if AuthMethod == AUTH_INTERNAL
	InternalAuth InternalAuth

	// Only filled out if AuthMethod == AUTH_OAUTH2 or AUTH_WEBHOOK
	BearerToken *BearerToken
	Grants      Grants
	TokenHash   [64]byte
}

func ForContext

func ForContext(ctx context.Context) *AuthContext

func (*AuthContext) Access

func (authctx *AuthContext) Access(scope, kind string) error

type AuthCookie

type AuthCookie struct {
	// The username of the authenticated user
	Name string `json:"name"`
}

type BearerToken

type BearerToken struct {
	Version  uint
	Expires  Timestamp
	Grants   string
	ClientID string
	Username string
}

func DecodeBearerToken

func DecodeBearerToken(token string) *BearerToken

func (*BearerToken) Encode

func (bt *BearerToken) Encode() string

type Grants

type Grants struct {
	ReadOnly bool
	// contains filtered or unexported fields
}

func DecodeGrants

func DecodeGrants(ctx context.Context, grants string) (Grants, error)

func (*Grants) Encode

func (g *Grants) Encode() string

func (*Grants) Has

func (g *Grants) Has(grant string, mode string) bool

Returns true if these grants include access to a specific OAuth grant.

func (*Grants) HasAll

func (g *Grants) HasAll() bool

Returns true if this is a universal grant.

func (*Grants) IsSubset

func (g *Grants) IsSubset(other *Grants) bool

Returns true of this grant object contains a subset of the permissions of another.

type InternalAuth

type InternalAuth struct {
	// The username of the authenticated user
	Name string `json:"name"`

	// An arbitrary identifier for this internal user, e.g. "git.sr.ht"
	ClientID string `json:"client_id"`

	// An arbitrary identifier for this internal node, e.g. "us-east-3.git.sr.ht"
	NodeID string `json:"node_id"`

	// Only used by specific meta.sr.ht routes
	OAuthClientUUID string `json:"oauth_client_id,omitempty"`
}

type Timestamp

type Timestamp int64

func ToTimestamp

func ToTimestamp(t time.Time) Timestamp

func (Timestamp) Time

func (t Timestamp) Time() time.Time