Documentation
¶
Index ¶
- Constants
- Variables
- func CheckPassword(encodedHash, password string) (bool, error)
- func CreateSession(db *sql.DB, userID int) (string, error)
- func Decrypt(encoded string) (string, error)
- func EnableMFA(db *sql.DB, userID int, secret string) error
- func Encrypt(plaintext string) (string, error)
- func GenerateTOTPCode(secret string) (string, error)
- func GenerateTOTPSecret() (string, error)
- func GenerateWireGuardKeys() (privateKey, publicKey string, err error)
- func GetMasterKey() ([]byte, error)
- func GetPublicKeyFromPrivate(privateKeyB64 string) (string, error)
- func GetTOTPProvisioningURI(username, secret, issuer string) string
- func GetUserMFAStatus(db *sql.DB, userID int) (bool, string, error)
- func HashPassword(password string) (string, error)
- func HashToken(token string) string
- func InvalidateAllSessions(db *sql.DB, userID int) error
- func VerifyPassword(encodedHash, password string) (bool, error)
- func VerifyPasswordConstantTime(encodedHash, password string, userExists bool) (bool, error)
- func VerifyTOTP(secret, code string) bool
Constants ¶
const MaxSessionsPerUser = 5
MaxSessionsPerUser limits concurrent sessions to prevent credential stuffing
const SessionTokenBytes = 48
SessionTokenBytes is the entropy for session tokens (384 bits = quantum resistant)
Variables ¶
var DummyHash string
DummyHash is used for constant-time auth to prevent username enumeration
Functions ¶
func CheckPassword ¶
CheckPassword is an alias for VerifyPassword for API compatibility
func GenerateTOTPCode ¶
GenerateTOTPCode generates the current TOTP code for a secret
func GenerateTOTPSecret ¶
TOTPSecret generates a new TOTP secret for a user
func GenerateWireGuardKeys ¶
GenerateWireGuardKeys generates a Curve25519 key pair for WireGuard
func GetMasterKey ¶
GetMasterKey loads or generates the master key with file locking to prevent race conditions. Uses atomic write pattern: write to temp file, then rename.
func GetPublicKeyFromPrivate ¶
GetPublicKeyFromPrivate derives the WireGuard public key from a base64 encoded private key
func GetTOTPProvisioningURI ¶
GetTOTPProvisioningURI generates an otpauth:// URI for QR code generation
func GetUserMFAStatus ¶
GetUserMFAStatus checks if user has MFA enabled and returns the secret
func HashPassword ¶
func InvalidateAllSessions ¶
InvalidateAllSessions clears all sessions for a user (for password change, logout everywhere)
func VerifyPassword ¶
func VerifyPasswordConstantTime ¶
VerifyPasswordConstantTime always runs Argon2id verification to prevent timing attacks. Call this even when user doesn't exist to prevent username enumeration.
func VerifyTOTP ¶
VerifyTOTP checks if the provided code matches the current or adjacent windows
Types ¶
This section is empty.
Source Files