flame

package
v0.17.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 23, 2019 License: MIT Imports: 16 Imported by: 2

Documentation

Overview

Package flame implements an authenticator that provides OAuth2 compatible authentication with JWT tokens.

Index

Constants

View Source 
const (
	// AccessTokenContextKey is the key used to save the access token in a context.
	AccessTokenContextKey = ctxKey("access-token")

	// ClientContextKey is the key used to save the client in a context.
	ClientContextKey = ctxKey("client")

	// ResourceOwnerContextKey is the key used to save the resource owner in a context.
	ResourceOwnerContextKey = ctxKey("resource-owner")
)

Variables

View Source 
var ErrGrantRejected = errors.New("grant rejected")

ErrGrantRejected should be returned by the GrantStrategy to indicate a rejection of the grant based on the provided conditions.

View Source 
var ErrInvalidFilter = errors.New("invalid filter")

ErrInvalidFilter should be returned by the Filter to indicate that the request includes invalid filter parameters.

View Source 
var ErrInvalidScope = errors.New("invalid scope")

ErrInvalidScope should be returned by the GrantStrategy to indicate that the requested scope exceeds the grantable scope.

Functions

func AddAccessTokenIndexes added in v0.8.8 

func AddAccessTokenIndexes(i *coal.Indexer, autoExpire bool)

AddAccessTokenIndexes will add access token indexes to the specified indexer.

func AddApplicationIndexes added in v0.8.8 

func AddApplicationIndexes(i *coal.Indexer)

AddApplicationIndexes will add application indexes to the specified indexer.

func AddRefreshTokenIndexes added in v0.8.8 

func AddRefreshTokenIndexes(i *coal.Indexer, autoExpire bool)

AddRefreshTokenIndexes will add refresh token indexes to the specified indexer.

func AddUserIndexes added in v0.8.8 

func AddUserIndexes(i *coal.Indexer)

AddUserIndexes will add user indexes to the specified indexer.

func Callback 

func Callback(scope string) *fire.Callback

Callback returns a callback that can be used to protect resources by requiring an access token with the provided scope to be granted.

Note: It requires that the request has already been authorized using the Authorizer middleware from a Authenticator.

func DefaultGrantStrategy 

func DefaultGrantStrategy(scope oauth2.Scope, _ Client, _ ResourceOwner) (oauth2.Scope, error)

DefaultGrantStrategy grants only empty scopes.

func DefaultTokenData added in v0.17.0 

func DefaultTokenData(_ Client, ro ResourceOwner, _ Token) map[string]interface{}

DefaultTokenData adds the user's id to the token data claim.

func EnsureApplication added in v0.8.7 

func EnsureApplication(store *coal.Store, name, key, secret string) (string, error)

EnsureApplication will ensure that an application with the provided name exists and returns its key.

func EnsureFirstUser added in v0.8.7 

func EnsureFirstUser(store *coal.Store, name, email, password string) error

EnsureFirstUser ensures the existence of a first user if no other has been created.

func TokenMigrator 

func TokenMigrator(remove bool) func(http.Handler) http.Handler

TokenMigrator is a middleware that detects access tokens passed via query parameters and migrates them to a Bearer Token header. Additionally it may remove the migrated query parameter from the request.

Note: The TokenMigrator should be added before any logger in the middleware chain to successfully protect the access token from being exposed.

Types

type AccessToken 

type AccessToken struct {
	coal.Base     `json:"-" bson:",inline" coal:"access-tokens:access_tokens"`
	ExpiresAt     time.Time      `json:"expires-at" bson:"expires_at"`
	Scope         []string       `json:"scope" bson:"scope"`
	Client        bson.ObjectId  `json:"client-id" bson:"client_id"`
	ResourceOwner *bson.ObjectId `json:"resource-owner-id" bson:"resource_owner_id"`
}

AccessToken is the built-in model used to store access tokens.

func (*AccessToken) GetTokenData 

func (t *AccessToken) GetTokenData() ([]string, time.Time, bson.ObjectId, *bson.ObjectId)

GetTokenData implements the flame.Token interface.

func (*AccessToken) SetTokenData 

func (t *AccessToken) SetTokenData(scope []string, expiresAt time.Time, client Client, resourceOwner ResourceOwner)

SetTokenData implements the flame.Token interface.

func (*AccessToken) Validate added in v0.15.0 

func (t *AccessToken) Validate() error

Validate implements the fire.ValidatableModel interface.

type Application 

type Application struct {
	coal.Base   `json:"-" bson:",inline" coal:"applications"`
	Name        string `json:"name" bson:"name"`
	Key         string `json:"key" bson:"key"`
	Secret      string `json:"secret,omitempty" bson:"-"`
	SecretHash  []byte `json:"-" bson:"secret"`
	RedirectURL string `json:"redirect-url" bson:"redirect_url"`
}

Application is the built-in model used to store clients.

func (*Application) DescribeClient 

func (a *Application) DescribeClient() string

DescribeClient implements the flame.Client interface.

func (*Application) HashSecret added in v0.8.5 

func (a *Application) HashSecret() error

HashSecret will hash Secret and set SecretHash.

func (*Application) ValidRedirectURL added in v0.8.7 

func (a *Application) ValidRedirectURL(url string) bool

ValidRedirectURL implements the flame.Client interface.

func (*Application) ValidSecret 

func (a *Application) ValidSecret(secret string) bool

ValidSecret implements the flame.Client interface.

func (*Application) Validate added in v0.8.5 

func (a *Application) Validate() error

Validate implements the coal.ValidatableModel interface.

type Authenticator 

type Authenticator struct {

	// The function gets invoked by the authenticator with critical errors.
	Reporter func(error)
	// contains filtered or unexported fields
}

An Authenticator provides OAuth2 based authentication. The implementation currently supports the Resource Owner Credentials Grant, Client Credentials Grant and Implicit Grant.

func NewAuthenticator 

func NewAuthenticator(store *coal.Store, policy *Policy) *Authenticator

NewAuthenticator constructs a new Authenticator from a store and policy.

func (*Authenticator) Authorizer 

func (a *Authenticator) Authorizer(scope string, force, loadClient, loadResourceOwner bool) func(http.Handler) http.Handler

Authorizer returns a middleware that can be used to authorize a request by requiring an access token with the provided scope to be granted.

func (*Authenticator) Endpoint 

func (a *Authenticator) Endpoint(prefix string) http.Handler

Endpoint returns a handler for the common token and authorize endpoint.

type Client 

type Client interface {
	coal.Model

	// DescribeClient should return a the clients identifier field.
	DescribeClient() (identifierField string)

	// ValidRedirectURL should return whether the specified redirect url can be
	// used by this client.
	//
	// Note: In order to increases security the callback should only allow
	// pre-registered redirect urls.
	ValidRedirectURL(string) bool

	// ValidSecret should determine whether the specified plain text secret
	// matches the stored hashed secret.
	ValidSecret(string) bool
}

Client is the interface that must be implemented by clients.

type Policy 

type Policy struct {
	// The secret should be at least 16 characters long.
	Secret []byte

	// The available grants.
	PasswordGrant          bool
	ClientCredentialsGrant bool
	ImplicitGrant          bool

	// The token models.
	AccessToken  Token
	RefreshToken Token

	// The client models.
	Clients []Client

	// ResourceOwners should return a list of resource owner models that are
	// tried in order to resolve grant requests.
	ResourceOwners func(Client) []ResourceOwner

	// Filter should return a filter that should be applied when looking up a
	// resource owner. This callback can be used to select resource owners
	// based on other request parameters. It can return ErrInvalidFilter to
	// cancel the authentication request.
	Filter func(ResourceOwner, *http.Request) (bson.M, error)

	// GrantStrategy is invoked by the authenticator with the grant type, the
	// requested scope, the client and the resource owner before issuing an
	// access token. The callback should return no error and the scope that
	// should be granted. It can return ErrGrantRejected or ErrInvalidScope to
	// cancel the grant request.
	//
	// Note: ResourceOwner is not set for a client credentials grant.
	GrantStrategy func(oauth2.Scope, Client, ResourceOwner) (oauth2.Scope, error)

	// TokenData should return a map of data that should be included in the JWT
	// tokens under the "dat" field.
	TokenData func(Client, ResourceOwner, Token) map[string]interface{}

	// The token used lifespans.
	AccessTokenLifespan  time.Duration
	RefreshTokenLifespan time.Duration
}

A Policy configures the provided authentication schemes.

func DefaultPolicy 

func DefaultPolicy(secret string) *Policy

DefaultPolicy returns a simple policy that uses all built-in models and strategies.

Note: The secret should be at least 16 characters long.

func (*Policy) GenerateToken 

func (p *Policy) GenerateToken(id bson.ObjectId, issuedAt, expiresAt time.Time, client Client, resourceOwner ResourceOwner, token Token) (string, error)

GenerateToken returns a new token for the provided information.

func (*Policy) ParseToken 

func (p *Policy) ParseToken(str string) (*TokenClaims, bool, error)

ParseToken will parse the presented token and return its claims, if it is expired and eventual errors.

type RefreshToken 

type RefreshToken struct {
	coal.Base     `json:"-" bson:",inline" coal:"refresh-tokens:refresh_tokens"`
	ExpiresAt     time.Time      `json:"expires-at" bson:"expires_at"`
	Scope         []string       `json:"scope" bson:"scope"`
	Client        bson.ObjectId  `json:"client-id" bson:"client_id"`
	ResourceOwner *bson.ObjectId `json:"resource-owner-id" bson:"resource_owner_id"`
}

RefreshToken is the built-in model used to store refresh tokens.

func (*RefreshToken) GetTokenData 

func (t *RefreshToken) GetTokenData() ([]string, time.Time, bson.ObjectId, *bson.ObjectId)

GetTokenData implements the flame.Token interface.

func (*RefreshToken) SetTokenData 

func (t *RefreshToken) SetTokenData(scope []string, expiresAt time.Time, client Client, resourceOwner ResourceOwner)

SetTokenData implements the flame.Token interface.

func (*RefreshToken) Validate added in v0.15.0 

func (t *RefreshToken) Validate() error

Validate implements the fire.ValidatableModel interface.

type ResourceOwner 

type ResourceOwner interface {
	coal.Model

	// DescribeResourceOwner should return the resource owners identifier field.
	DescribeResourceOwner() (identifierField string)

	// ValidSecret should determine whether the specified plain text password
	// matches the stored hashed password.
	ValidPassword(string) bool
}

ResourceOwner is the interface that must be implemented resource owners.

type ResourceOwnerDescription 

type ResourceOwnerDescription struct {
	IdentifierField string
}

A ResourceOwnerDescription is returned by a ResourceOwner model to specify details about its implementation.

type Token 

type Token interface {
	coal.Model

	// GetTokenData should collect and return the tokens data.
	GetTokenData() (scope []string, expiresAt time.Time, client bson.ObjectId, resourceOwner *bson.ObjectId)

	// SetTokenData should set the specified token data.
	SetTokenData(scope []string, expiresAt time.Time, client Client, resourceOwner ResourceOwner)
}

Token is the interface that must be implemented by the tokens.

type TokenClaims 

type TokenClaims struct {
	jwt.StandardClaims

	// Data contains user defined key value pairs.
	Data map[string]interface{} `json:"dat"`
}

TokenClaims represents the data included in an access token and refresh token.

type User 

type User struct {
	coal.Base    `json:"-" bson:",inline" coal:"users"`
	Name         string `json:"name" bson:"name"`
	Email        string `json:"email" bson:"email"`
	Password     string `json:"password,omitempty" bson:"-"`
	PasswordHash []byte `json:"-" bson:"password"`
}

User is the built-in model used to store resource owners.

func (*User) DescribeResourceOwner 

func (u *User) DescribeResourceOwner() string

DescribeResourceOwner implements the flame.ResourceOwner interface.

func (*User) HashPassword added in v0.8.5 

func (u *User) HashPassword() error

HashPassword will hash Password and set PasswordHash.

func (*User) ValidPassword 

func (u *User) ValidPassword(password string) bool

ValidPassword implements the flame.ResourceOwner interface.

func (*User) Validate added in v0.8.5 

func (u *User) Validate() error

Validate implements the coal.ValidatableModel interface.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.