type
AuthConfig
Policy for an auth-enabled collection.
Properties
| Property | Type | Description |
|---|---|---|
SessionDuration | time.Duration | Session lifetime; zero defaults to 24 hours. |
Password | PasswordPolicy | Controls local password validation and hashing. |
MaxLoginAttempts | int | Failures before lockout; zero defaults to 5 and a negative value disables lockout. |
LockDuration | time.Duration | Lockout duration; zero defaults to 10 minutes. |
PasswordReset | PasswordResetConfig | Enables recovery when its Send callback is configured. |
Verify | *VerifyEmailConfig | Requires verified email before local login when non-nil. |
APIKeys | bool | Allows revocable session-independent bearer credentials. |
Access | AuthAccess | Authorizes authentication operations outside CRUD. |
Hooks | AuthHooks | Observes or rejects authentication lifecycle phases. |
Strategies | []AuthStrategy | Adds application-owned request authentication in declaration order. |
How it works
Local password auth is built in. Recovery/email flows require trusted Send callbacks. External strategies are compiled Go integrations, not dynamically loaded providers. Private hashes and tokens never enter content fields or hooks.