public

import "github.com/prescriptoo/prescriptoo-api/services/identity/public"

Package public defines the deliberately small API other services may use to interact with identity. It contains contracts only; identity internals are never exposed across the service boundary.

Index

• Variables
• type Account
• type AccountReader
• type AccountStatusManager
• type ActiveAccountLocker
• type AdminIdentityService
• type AuthenticationService
• type ChangeAccountStatusInput
• type CreateAccountInput
• type LoginAuthorizer
• type LoginInput
• type RegistrationInput
• type TokenPair
• type TransactionalRegistration

Variables

var (
    // ErrUnavailable indicates that an identity service capability is unavailable.
    ErrUnavailable = errors.New("identity service unavailable")
    // ErrAccountNotFound indicates that an identity account does not exist.
    ErrAccountNotFound = errors.New("identity account not found")
    // ErrAccountAlreadyExists indicates that the identity account already exists.
    ErrAccountAlreadyExists = errors.New("identity account already exists")
    // ErrInvalidAccessToken indicates that an access token could not be validated.
    ErrInvalidAccessToken = errors.New("invalid access token")
)

var (
    // ErrInvalidCredentials indicates an incorrect email or password.
    ErrInvalidCredentials = errors.New("invalid email or password")
    // ErrAccountDisabled indicates an account that cannot sign in.
    ErrAccountDisabled = errors.New("account is not permitted to sign in")
    // ErrRateLimited indicates that the authentication request limit was reached.
    ErrRateLimited = errors.New("too many authentication requests")
)

ErrAccountInactive indicates a current account cannot receive a new affiliation.

var ErrAccountInactive = errors.New("account is not active")

ErrInvalidRegistration indicates invalid account registration details.

var ErrInvalidRegistration = errors.New("invalid account registration details")

type Account

Account is the safe cross-service representation of an identity account.

type Account struct {
    ID            string    `json:"id"`
    Email         string    `json:"email"`
    Name          string    `json:"name"`
    Status        string    `json:"status"`
    EmailVerified bool      `json:"email_verified"`
    CreatedAt     time.Time `json:"created_at"`
    UpdatedAt     time.Time `json:"updated_at"`
}

type AccountReader

AccountReader is the identity directory capability.

type AccountReader interface {
    GetAccount(context.Context, string) (*Account, error)
    GetAccounts(context.Context, []string) ([]Account, error)
}

type AccountStatusManager

AccountStatusManager changes account eligibility and invalidates disabled sessions atomically.

type AccountStatusManager interface {
    ChangeAccountStatus(context.Context, ChangeAccountStatusInput) (*Account, error)
}

type ActiveAccountLocker

ActiveAccountLocker serializes account eligibility with a caller-owned business transaction. The capability must be supplied by Identity; consumers never query account tables.

type ActiveAccountLocker interface {
    // LockActiveAccounts checks current states and keeps row locks until the supplied
    // transaction completes; the caller is responsible for committing or rolling back.
    LockActiveAccounts(context.Context, pgx.Tx, []string) error
}

type AdminIdentityService

AdminIdentityService exposes identity account provisioning and lookups used by Admin. Credential verification remains a separate authentication contract.

type AdminIdentityService interface {
    AccountReader
    CreateAccount(context.Context, CreateAccountInput) (*Account, error)
}

type AuthenticationService

AuthenticationService exposes credential authentication with a caller-owned eligibility check. Login preserves the authorizer's errors.

type AuthenticationService interface {
    Login(context.Context, LoginInput, LoginAuthorizer) (*TokenPair, error)
}

type ChangeAccountStatusInput

ChangeAccountStatusInput contains a trusted initiating actor and target state.

type ChangeAccountStatusInput struct {
    Audit  audit.OperationContext
    UserID string
    Status string
}

type CreateAccountInput

CreateAccountInput creates an immediately active identity account.

type CreateAccountInput struct {
    Audit             audit.OperationContext `json:"-"`
    Name              string
    Email             string
    TemporaryPassword string
}

type LoginAuthorizer

LoginAuthorizer checks a verified, active user before any credentials or session are created. Returning an error rejects login without creating a session.

type LoginAuthorizer func(ctx context.Context, userID string) error

type LoginInput

LoginInput carries credentials and session metadata for authentication.

type LoginInput struct{ Email, Password, IPAddress, UserAgent string }

type RegistrationInput

RegistrationInput contains credentials for a new self-registered account.

type RegistrationInput struct{ Name, Email, Password string }

type TokenPair

TokenPair contains the credentials issued for a persistent identity session.

type TokenPair struct {
    AccessToken  string `json:"access_token" example:"access-token-example" doc:"Bearer access token. Keep secret."`
    RefreshToken string `json:"refresh_token" example:"refresh-token-example" doc:"Secret refresh token; replace the stored token after every refresh."`
    TokenType    string `json:"token_type" enum:"Bearer" example:"Bearer" doc:"Authorization scheme used with the access token."`
    ExpiresIn    int64  `json:"expires_in" minimum:"1" example:"3600" doc:"Access token lifetime in seconds."`
}

type TransactionalRegistration

TransactionalRegistration creates an account in a caller-owned transaction. The caller must commit only after all onboarding writes succeed. This capability issues no credentials and publishes no events before the transaction commits.

type TransactionalRegistration interface {
    RegisterInTransaction(context.Context, pgx.Tx, RegistrationInput) (*Account, error)
}

Generated by gomarkdoc