vikingowl
50c5811e22
Auth Package (internal/auth/): - Service: main auth orchestrator with multi-provider support - LocalProvider: username/password auth with bcrypt hashing - LDAPProvider: LDAP/Active Directory authentication with: - Service account bind for user search - User bind for password verification - Automatic user provisioning on first login - Group membership to role synchronization - SessionManager: token-based session lifecycle - Middleware: Gin middleware for route protection - API: REST endpoints for login/logout/register Security Features: - bcrypt with cost factor 12 for password hashing - Secure random 32-byte session tokens - HTTP-only session cookies with SameSite=Lax - Bearer token support for API clients - Session expiration and cleanup - Account disable with session invalidation API Endpoints: - POST /auth/login - Authenticate and get session - POST /auth/logout - Invalidate current session - POST /auth/logout/all - Invalidate all user sessions - POST /auth/register - Create account (if enabled) - GET /auth/me - Get current user info - PUT /auth/me - Update profile - PUT /auth/me/password - Change password 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
41 lines
1001 B
Go
41 lines
1001 B
Go
package auth
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
const (
|
|
// bcryptCost is the computational cost for bcrypt hashing.
|
|
// Higher values are more secure but slower.
|
|
// 12 is a good balance for 2024+ hardware.
|
|
bcryptCost = 12
|
|
)
|
|
|
|
// HashPassword creates a bcrypt hash of the password.
|
|
func HashPassword(password string) ([]byte, error) {
|
|
return bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
|
|
}
|
|
|
|
// CheckPassword verifies a password against a bcrypt hash.
|
|
func CheckPassword(password string, hash []byte) bool {
|
|
err := bcrypt.CompareHashAndPassword(hash, []byte(password))
|
|
return err == nil
|
|
}
|
|
|
|
// generateID creates a random ID for users, sessions, etc.
|
|
func generateID() string {
|
|
b := make([]byte, 16)
|
|
rand.Read(b)
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
|
}
|
|
|
|
// generateToken creates a secure random token for sessions.
|
|
func generateToken() string {
|
|
b := make([]byte, 32)
|
|
rand.Read(b)
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
|
}
|