user

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Dec 21, 2015 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source
const (
	MaxEmailLength = 200

	// ClaimPasswordResetPassword represents the hash of the password to be
	// reset; in other words, the old password
	ClaimPasswordResetPassword = "http://coreos.com/password/old-hash"

	// ClaimEmailVerificationEmail represents the email to be verified. Note
	// that we are intentionally not using the "email" claim for this purpose.
	ClaimEmailVerificationEmail = "http://coreos.com/email/verificationEmail"

	// ClaimPasswordResetCallback represents where a user should be sent after
	// resetting their password.
	ClaimPasswordResetCallback = "http://coreos.com/password/reset-callback"

	// Claim representing where a user should be sent after verifying their email address.
	ClaimEmailVerificationCallback = "http://coreos.com/email/verification-callback"

	// Claim representing where a user should be sent after responding to an invitation
	ClaimInvitationCallback = "http://coreos.com/invitation/callback"
)

Variables

View Source
var (
	PasswordHasher = DefaultPasswordHasher

	ErrorInvalidPassword     = errors.New("invalid Password")
	ErrorPasswordHashNoMatch = errors.New("password and hash don't match")
	ErrorPasswordExpired     = errors.New("password has expired")
)
View Source
var (
	ErrorDuplicateID    = errors.New("ID not available")
	ErrorDuplicateEmail = errors.New("email not available")

	ErrorDuplicateRemoteIdentity = errors.New("remote identity already in use for another user")
	ErrorInvalidEmail            = errors.New("invalid Email")
	ErrorInvalidID               = errors.New("invalid ID")
	ErrorNotFound                = errors.New("user not found in repository")
)

Functions

func DefaultPasswordHasher

func DefaultPasswordHasher(s string) ([]byte, error)

func DefaultUserIDGenerator

func DefaultUserIDGenerator() (string, error)

func EncodeNextPageToken

func EncodeNextPageToken(filter UserFilter, maxResults int, offset int) (string, error)

func LoadPasswordInfos

func LoadPasswordInfos(repo PasswordInfoRepo, pws []PasswordInfo) error

func ValidEmail

func ValidEmail(email string) bool

func ValidPassword

func ValidPassword(plaintext string) bool

Types

type EmailVerification

type EmailVerification struct {
	Claims jose.Claims
}

func NewEmailVerification

func NewEmailVerification(user User, clientID string, issuer url.URL, callback url.URL, expires time.Duration) EmailVerification

NewEmailVerification creates an object which can be sent to a user in serialized form to verify that they control an email address. The clientID is the ID of the registering user. The callback is where a user should land after verifying their email.

func ParseAndVerifyEmailVerificationToken

func ParseAndVerifyEmailVerificationToken(token string, issuer url.URL, keys []key.PublicKey) (EmailVerification, error)

ParseAndVerifyEmailVerificationToken parses a string into a an EmailVerification, verifies the signature, and ensures that required claims are present. In addition to the usual claims required by the OIDC spec, "aud" and "sub" must be present as well as ClaimEmailVerificationCallback and ClaimEmailVerificationEmail.

func (EmailVerification) Callback

func (e EmailVerification) Callback() *url.URL

func (EmailVerification) Email

func (e EmailVerification) Email() string

func (EmailVerification) UserID

func (e EmailVerification) UserID() string

type Hasher

type Hasher func(string) ([]byte, error)

type Invitation added in v0.2.0

type Invitation struct {
	Claims jose.Claims
}

An Invitation is a token that can be used for verifying an email address and resetting a password in a single stroke. It will be sent as part of a link in an email automatically to newly created users if email is configured.

func NewInvitation added in v0.2.0

func NewInvitation(user User, password Password, issuer url.URL, clientID string, callback url.URL, expires time.Duration) Invitation

func ParseAndVerifyInvitationToken added in v0.2.0

func ParseAndVerifyInvitationToken(token string, issuer url.URL, keys []key.PublicKey) (Invitation, error)

func (Invitation) Callback added in v0.2.0

func (iv Invitation) Callback() *url.URL

func (Invitation) ClientID added in v0.2.0

func (iv Invitation) ClientID() string

func (Invitation) Email added in v0.2.0

func (iv Invitation) Email() string

func (Invitation) Password added in v0.2.0

func (iv Invitation) Password() Password

func (Invitation) PasswordReset added in v0.2.0

func (iv Invitation) PasswordReset(issuer url.URL, expires time.Duration) PasswordReset

func (Invitation) UserID added in v0.2.0

func (iv Invitation) UserID() string

type Password

type Password []byte

func NewPasswordFromPlaintext

func NewPasswordFromPlaintext(plaintext string) (Password, error)

type PasswordInfo

type PasswordInfo struct {
	UserID string

	Password Password

	PasswordExpires time.Time
}

func (PasswordInfo) Authenticate

func (p PasswordInfo) Authenticate(plaintext string) (*oidc.Identity, error)

func (PasswordInfo) Identity

func (p PasswordInfo) Identity() oidc.Identity

func (*PasswordInfo) UnmarshalJSON

func (u *PasswordInfo) UnmarshalJSON(data []byte) error

type PasswordInfoRepo

type PasswordInfoRepo interface {
	Get(tx repo.Transaction, id string) (PasswordInfo, error)
	Update(repo.Transaction, PasswordInfo) error
	Create(repo.Transaction, PasswordInfo) error
}

func NewPasswordInfoRepo

func NewPasswordInfoRepo() PasswordInfoRepo

func NewPasswordInfoRepoFromFile

func NewPasswordInfoRepoFromFile(loc string) (PasswordInfoRepo, error)

func NewPasswordInfoRepoFromPasswordInfos

func NewPasswordInfoRepoFromPasswordInfos(pws []PasswordInfo) PasswordInfoRepo

type PasswordReset

type PasswordReset struct {
	Claims jose.Claims
}

func NewPasswordReset

func NewPasswordReset(userID string, password Password, issuer url.URL, clientID string, callback url.URL, expires time.Duration) PasswordReset

func ParseAndVerifyPasswordResetToken

func ParseAndVerifyPasswordResetToken(token string, issuer url.URL, keys []key.PublicKey) (PasswordReset, error)

ParseAndVerifyPasswordResetToken parses a string into a an PasswordReset, verifies the signature, and ensures that required claims are present. In addition to the usual claims required by the OIDC spec, "aud" and "sub" must be present as well as ClaimPasswordResetCallback and ClaimPasswordResetPassword.

func (PasswordReset) Callback

func (e PasswordReset) Callback() *url.URL

func (PasswordReset) Password

func (e PasswordReset) Password() Password

func (PasswordReset) UserID

func (e PasswordReset) UserID() string

type RemoteIdentity

type RemoteIdentity struct {
	// IDPCID is the identifier of the IDP which hosts this identity.
	ConnectorID string

	// ID is the identifier of this User at the IDP.
	ID string
}

RemoteIdentity represents a User's identity at an IDP.

func (*RemoteIdentity) UnmarshalJSON

func (u *RemoteIdentity) UnmarshalJSON(data []byte) error

type TokenClaims added in v0.2.0

type TokenClaims struct {
	Claims jose.Claims
}

type User

type User struct {
	// ID is the machine-generated, stable, unique identifier for this User.
	ID string

	// DisplayName is human readable name meant for display purposes.
	// DisplayName is not neccesarily unique with a UserRepo.
	DisplayName string

	Email string

	EmailVerified bool

	Admin bool

	Disabled bool

	CreatedAt time.Time
}

func (*User) AddToClaims

func (u *User) AddToClaims(claims jose.Claims)

AddToClaims adds basic information about the user to the given Claims. http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

func (*User) UnmarshalJSON

func (u *User) UnmarshalJSON(data []byte) error

type UserFilter

type UserFilter struct {
}

func DecodeNextPageToken

func DecodeNextPageToken(tok string) (UserFilter, int, int, error)

type UserIDGenerator

type UserIDGenerator func() (string, error)

type UserRepo

type UserRepo interface {
	Get(tx repo.Transaction, id string) (User, error)

	// List returns a list of users meeting the given conditions.
	// A nextPageToken is returned when there are further results to be had,
	// with the expectation that it will be passed into a subsequent List
	// call. When nextPageToken is non-empty filter and maxResults are ignored.
	List(tx repo.Transaction, filter UserFilter, maxResults int, nextPageToken string) ([]User, string, error)

	Create(repo.Transaction, User) error

	GetByEmail(tx repo.Transaction, email string) (User, error)

	Disable(tx repo.Transaction, id string, disabled bool) error

	Update(repo.Transaction, User) error

	GetByRemoteIdentity(repo.Transaction, RemoteIdentity) (User, error)

	AddRemoteIdentity(tx repo.Transaction, userID string, remoteID RemoteIdentity) error

	RemoveRemoteIdentity(tx repo.Transaction, userID string, remoteID RemoteIdentity) error

	GetRemoteIdentities(tx repo.Transaction, userID string) ([]RemoteIdentity, error)

	GetAdminCount(repo.Transaction) (int, error)
}

UserRepo implementations maintain a persistent set of users. The following invariants must be maintained:

  • Users must have a unique Email and ID
  • No other Users may have the same RemoteIdentity as one of the users. (This constraint may be relaxed in the future)

func NewUserRepo

func NewUserRepo() UserRepo

NewUserRepo returns an in-memory UserRepo useful for development.

func NewUserRepoFromFile

func NewUserRepoFromFile(loc string) (UserRepo, error)

NewUserRepoFromFile returns an in-memory UserRepo useful for development given a JSON serialized file of Users.

func NewUserRepoFromUsers

func NewUserRepoFromUsers(us []UserWithRemoteIdentities) UserRepo

type UserWithRemoteIdentities

type UserWithRemoteIdentities struct {
	User             User             `json:"user"`
	RemoteIdentities []RemoteIdentity `json:"remoteIdentities"`
}

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL