type
AuthConfig
Session, credentials, recovery, and custom-strategy policy for an auth collection.
Properties
| Property | Type | Description |
|---|---|---|
SessionDuration | time.Duration | Session lifetime; zero defaults to 24 hours. |
Password | PasswordPolicy | Controls local password validation and hashing. |
MaxLoginAttempts | int | Failures before lockout; zero defaults to 5 and a negative value disables lockout. |
LockDuration | time.Duration | Lockout duration; zero defaults to 10 minutes. |
PasswordReset | PasswordResetConfig | Enables recovery when its Send callback is configured. |
Verify | *VerifyEmailConfig | Requires verified email before local login when non-nil. |
APIKeys | bool | Allows revocable session-independent bearer credentials. |
Access | AuthAccess | Authorizes authentication operations outside CRUD. |
Hooks | AuthHooks | Observes or rejects authentication lifecycle phases. |
Strategies | []AuthStrategy | Adds application-owned request authentication in declaration order. |
Full signature
type AuthConfig struct {
// SessionDuration is how long a login remains valid. Zero defaults to 24 hours.
SessionDuration time.Duration
// Password controls local password validation and hashing. Zero values use
// the secure framework defaults documented on PasswordPolicy.
Password PasswordPolicy
// MaxLoginAttempts is the number of consecutive credential failures allowed
// before the account is temporarily locked. Zero defaults to 5; a negative
// value disables account lockout.
MaxLoginAttempts int
// LockDuration is how long an account remains locked after MaxLoginAttempts.
// Zero defaults to 10 minutes.
LockDuration time.Duration
// PasswordReset enables the forgot/reset-password flow when Send is set.
// The raw single-use token is delivered only to this trusted callback.
PasswordReset PasswordResetConfig
// Verify enables email verification. When non-nil, newly provisioned
// credentials cannot log in until a verification token is consumed.
Verify *VerifyEmailConfig
// APIKeys allows users to mint revocable, session-independent bearer
// credentials. API keys are disabled by default.
APIKeys bool
// Access contains authorization rules for auth operations that are not CRUD.
Access AuthAccess
// Hooks contains authentication lifecycle callbacks.
Hooks AuthHooks
// Strategies adds application-owned request authentication in declaration order.
Strategies []AuthStrategy
}