auth

Documentation

Overview

Package auth ensures that a user has sufficient permissions to access content.

Index

• func Admin() echo.HandlerFunc
• func CSRF(db *sqlx.DB) echo.HandlerFunc
• func LoggedIn() echo.HandlerFunc
• type Header

Functions

func Admin

func Admin() echo.HandlerFunc

Admin ensures that the current user is an admin. We trust the scopes presented by the client because they're validated through HMAC in LoggedIn().

func CSRF

func CSRF(db *sqlx.DB) echo.HandlerFunc

CSRF ensures that any forms posted to Abot are protected against Cross-Site Request Forgery. Without this function, Abot would be vulnerable to the attack because tokens are stored client-side in cookies.

func LoggedIn

func LoggedIn() echo.HandlerFunc

LoggedIn determines if the user is currently logged in.

Types

type Header

type Header struct {
	ID       uint64
	Email    string
	Scopes   []string
	IssuedAt int64
}

Header represents an HTTP request's header from the front-end JS client. This is used to identify the logged in user in each web request and the permissions of that user.