greenpau/go-authcrunch

ملف greenpau

آخر نشاط مصدر مسجل: ١١ أكتوبر ٢٠٢٦ في ١٠:٥٥

آخر تحديث لفهرس SkillsMP: ١٧ أكتوبر ٢٠٢٦ في ٠٠:٠٩

skills مجمعة: ٤٤

نجوم GitHub: ٦٠
تفرعات GitHub: ٦٦

ملف README للمستودع

مصدر ملف README للمستودع: README.md

قراءة الملف الأصلي

عرض ملف README كاملًا

# go-authcrunch AuthCrunch provides Authentication, Authorization, and Accounting (AAA) Security Functions (SF) in Golang. <a href="https://github.com/greenpau/go-authcrunch/actions/workflows/test.yml" target="_blank"><img src="https://github.com/greenpau/go-authcrunch/actions/workflows/test.yml/badge.svg?branch=main"></a> <a href="https://pkg.go.dev/github.com/greenpau/go-authcrunch" target="_blank"><img src="https://img.shields.io/badge/godoc-reference-blue.svg"></a> This code base contains the functions implementing AAA. It is a standalone library, i.e. it can be used with Gin, Beego, Echo,Mux (Gorilla). Originally developed for the Caddy web server in the form of `caddy-security` app, AuthCrunch forms the foundation for the server's security functionality, including authentication portal, authorization gateway, and other features. ## Documentation Please browse to [docs.authcrunch.com](https://docs.authcrunch.com/). See [portal refresh sessions](.codex/skills/refresh-token-implementation/references/configuration-and-clients.md) for opt-in rotating refresh credentials, configuration, client integration, and lifecycle behavior. See [the portal OpenID Provider](.codex/skills/authentication-portal-oidc/references/configuration-and-clients.md) for local-user OIDC login and relying-party registration, the [reusable Go provider](.codex/skills/authentication-portal-oidc/references/reusable-provider.md), and [conformance testing](.codex/skills/authentication-portal-oidc/references/conformance.md). ## Standalone server Run AuthCrunch directly with Go's HTTP server using `authdb`: ```sh make build ./bin/authdb run --config /path/to/authdb.json ``` Start with [the example configuration](cmd/authdb/config.json), set your TLS certificate/key and identity database paths, and follow the [authdb usage guide](cmd/authdb/README.md). The example serves the portal at `https://localhost:8443/auth`. `authdbctl` remains the management client; Caddy is not required. ## Development Use Go 1.26 or newer (CI uses 1.26.8), Node 24, Python 3.9+, Make, and Google Chrome on macOS or Linux. The Go suite includes browser E2E tests; set `AUTHCRUNCH_TEST_BROWSER` to the Chrome executable if it is not discovered on PATH or at the standard macOS installation path. ```sh make dep make change-test make ci-check ``` `make change-test` tests staged, unstaged, and untracked changes. Use `make change-test CHANGE_DRY_RUN=1` to inspect its selection. Documentation-only changes skip tests; Go changes select owning packages and affected consumers. Selected Go reports are in `.coverage/changes/go/index.html`. See [change-based testing](.codex/skills/scripts-and-automation/references/change-tests.md) for commit ranges and fallbacks. GitHub runs the full suite once across parallel test and package shards; see [parallel CI validation](.codex/skills/scripts-and-automation/references/ci-shards.md). `make test` runs race-enabled Go tests through pinned `tested` and writes the coverage/report bundle to `.coverage/index.html`. Use `make test-ui` for Node simulations of the login and refresh clients; real browser journeys run in the Go suite. Use `make build` for `bin/authdb` and `bin/authdbctl`. Local tests run one package at a time with a memory/process watchdog on macOS and Linux. An exceeded budget stops the run and records the reason in `.coverage/resource-usage.json`. See the [test resource controls](.codex/skills/scripts-and-automation/references/test-resources.md) for limits and troubleshooting. Run `make generate-acl` to regenerate ACL conditions, rules, and their tests from `assets/scripts/generate_acl.py`. It requires Python 3.9+ and `gofmt` on PATH; no separate generator repository or Python packages are needed. Repository guidance lives in [repo-local skills](.codex/skills). [Release and versioning](.codex/skills/release-and-versioning/SKILL.md) describes `make release` (patch) and `make minor-release`, which publish a release. Use `make fast-release` or `make fast-minor-release` to skip the local quality gate, including tests; GitHub release validation still runs. ## Issues Please open issues in [caddy-security](https://github.com/greenpau/caddy-security/issues/new/choose). ## Plugins Production plugins are separate Go modules. Synthetic references under `plugins/` are packages in this root module. Secrets plugins retrieve values for an embedding application to apply to AuthCrunch configuration. Host registration and configuration syntax belong to that application's adapter; this library does not automatically discover or load plugins. ### Secrets | Plugin | Backend | | --- | --- | | [SQLite](plugins/secrets/sqlite) | Private local JSON records with explicit consumer adoption, pure Go | | [`go-authcrunch-secrets-static-secrets-manager`](https://github.com/greenpau/go-authcrunch-secrets-static-secrets-manager) | Statically configured secret maps | | [`go-authcrunch-secrets-aws-secrets-manager`](https://github.com/greenpau/go-authcrunch-secrets-aws-secrets-manager) | JSON secrets retrieved from AWS Secrets Manager | See the [secrets plugin contracts](.codex/skills/secrets-plugins/SKILL.md) for their APIs, integration examples, and lifecycle differences. To build a plugin, start with the [plugin architecture](.codex/skills/plugin-development/SKILL.md) and [development blueprint](.codex/skills/plugin-development/references/development-blueprint.md). ### Plugin categories Beyond secrets, the architecture covers the following extension categories. Existing Go interfaces support some forms of direct composition; other entries describe proposed integration work. This is a development map, not a list of installed or automatically loadable backends. | Category | Purpose | Integration status | | --- | --- | --- | | [Identity stores](.codex/skills/plugin-development/references/plugin-categories.md#identity-stores) | Account databases such as PostgreSQL, DynamoDB, or Consul | [SQLite password plugin](plugins/identity-stores/sqlite) with portal injection; new root-config kinds need dispatch integration | | [Identity providers](.codex/skills/plugin-development/references/plugin-categories.md#identity-providers) | Federation services and authentication protocols | [SQLite sign-in tickets](plugins/identity-providers/sqlite), trusted issuance and browser-bound portal login | | [Credential authenticators](.codex/skills/plugin-development/references/plugin-categories.md#credential-authenticators) | External Basic-credential or API-key verification | [SQLite API-key plugin](plugins/credential-authenticators/sqlite), fresh gatekeeper verification and configured realm binding | | [Messaging](.codex/skills/plugin-development/references/plugin-categories.md#messaging) | Email APIs and notification delivery | [SQLite outbox](plugins/messaging/sqlite), runtime provider binding and registration notifications | | [Registration workflows](.codex/skills/plugin-development/references/plugin-categories.md#registration-workflows) | Invitations, approvals, and account creation | [SQLite email confirmation](plugins/registration-workflows/sqlite), recoverable account creation and portal attachment; root configuration is local-only | | [Session and refresh storage](.codex/skills/plugin-development/references/plugin-categories.md#session-and-refresh-storage) | Shared token-family storage and revocation | [SQLite plugin](plugins/session-and-refresh-storage/sqlite) for refresh-engine composition; portal selection needs wiring | | [Cryptographic signing](.codex/skills/plugin-development/references/plugin-categories.md#cryptographic-signing) | Sign approved token claims with a selected key | [Local PS256 plugin](plugins/cryptographic-signing/rsapss), refresh-engine injection, and core verification; general portal/OIDC signer selection remains separate | | [External authorization](.codex/skills/plugin-development/references/plugin-categories.md#external-authorization) | Decisions from an external policy service | Required gatekeeper/validator decisions and [HTTP JSON plugin](plugins/external-authorization/httpjson) | | [Claims enrichment](.codex/skills/plugin-development/references/plugin-categories.md#claims-enrichment) | Trusted organization, group, or entitlement attributes | Request-time gatekeeper/validator hook and [static claims plugin](plugins/claims-enrichment/static) | The [category contracts](.codex/skills/plugin-development/references/plugin-categories.md) describe current APIs, implementation gaps, lifecycle requirements, and acceptance scenarios for each category. Backend examples do not imply published support. ### Other plugin projects At the inspected revisions linked below, these repositories contain project scaffolding only, with no Go backend implementation or module manifest. They are project references, not usable plugins. Check implementation and consumer compatibility when revisiting a newer revision. | Category | Project | Inspected status | | --- | --- | --- | | Identity stores | [`go-authcrunch-ids-consul`](https://github.com/greenpau/go-authcrunch-ids-consul) — Consul KV | [Scaffold](https://github.com/greenpau/go-authcrunch-ids-consul/tree/0e5fc8d9669559ef0770280491c042dffde02908) | | Identity stores | [`go-authcrunch-ids-dynamodb`](https://github.com/greenpau/go-authcrunch-ids-dynamodb) — Amazon DynamoDB | [Scaffold](https://github.com/greenpau/go-authcrunch-ids-dynamodb/tree/c274052b44f9588df267670333876843520b28df) | | Credentials | [`go-authcrunch-creds-aws-ssm-parameter-store`](https://github.com/greenpau/go-authcrunch-creds-aws-ssm-parameter-store) — AWS SSM Parameter Store | [Scaffold](https://github.com/greenpau/go-authcrunch-creds-aws-ssm-parameter-store/tree/5e6d455275419921c2fe9695bae4ff9110de7d8f) | The HTTP API reference is maintained as YAML under `assets/openapi/content/`. Run `make openapi` to generate its ignored JSON bundle, or `make serve-openapi` to browse it at `http://127.0.0.1:8080`. Its version follows `VERSION`.

جارٍ تحميل ملف README للمستودع…

Skills في هذا المستودع

مطوّرو البرمجيات

١ فئات مهنية · 2% مصنفة

skill

المهنة

الوصف

آخر تحديث

authentication-portal-documents

غير مصنف

Maintain the opt-in encrypted Documents API, immutable account ownership, SQLite ciphertext storage, chunk transactions, recipient key envelopes, configuration parser, and TLS/browser cryptographic tests. The separately maintained React application has its…

لغة النص الأصلي: الإنجليزية

2026-10-11

coding-directives

غير مصنف

Apply AuthCrunch coding contracts when creating, modifying, or reviewing repository code. Covers package ownership, dedicated configuration parsers, public APIs, validation, errors, logging, serialization, and security boundaries, and routes to the owning…

لغة النص الأصلي: الإنجليزية

2026-10-11

documents-app-integration

غير مصنف

Implement the separately maintained Documents React client for AuthCrunch encrypted storage, recovery keys, chunk upload/download, recipient sharing, and safe session handling. Does not implement manager/profile APIs or provision the backend.

لغة النص الأصلي: الإنجليزية

2026-10-11

openapi-generation

غير مصنف

Maintain AuthCrunch's YAML HTTP contract, deterministic JSON/YAML exports, Scalar reference and local server. Use after HTTP-facing source/configuration changes, source-review drift, or API reference tooling changes.

لغة النص الأصلي: الإنجليزية

2026-10-11

scripts-and-automation

غير مصنف

Maintain go-authcrunch Make targets, pinned Go tools, build/test orchestration, maintenance scripts, generated artifacts, and embedded UI refresh workflows.

لغة النص الأصلي: الإنجليزية

2026-10-11

authentication-portal-challenges

غير مصنف

Maintain conditional authentication challenge policies, reusable authchal and user-transform FromDirectives parsers, safe claim substitution, GitHub ID/organization transforms, registered-factor inventory, passwordless WebAuthn selection, verified AMR access…

لغة النص الأصلي: الإنجليزية

2026-10-10

authentication-portal-cross-device

غير مصنف

Maintain optional cross-device portal login, its directive parser, QR and polling UI, approving-browser binding, single-use transfers, MFA and provider evidence, logout invalidation, and TLS/browser tests.

لغة النص الأصلي: الإنجليزية

2026-10-10

authentication-portal-profile

غير مصنف

Maintain authenticated local profile APIs, user authentication-flow preferences and UI integration, canonical account selection, atomic identity-bound operations, browser origin checks, and credential-management TLS tests.

لغة النص الأصلي: الإنجليزية

2026-10-10

oauth-identity-provider

غير مصنف

Maintain upstream OAuth identity-provider directive parsers, shared configuration dispatch, OAuth/OIDC discovery, GitHub identity claims, JWKS and static public PEM verification, EdDSA/Ed25519 token validation, key refresh, and real portal OAuth E2E tests.…

لغة النص الأصلي: الإنجليزية

2026-10-10

refresh-token-identity

غير مصنف

Maintain refresh-token login evidence, MFA completion, sandbox redemption, immutable local identity, credential-version invalidation, transactional current-identity checks, and captured upstream provider snapshots in AuthCrunch.

لغة النص الأصلي: الإنجليزية

2026-10-10

refresh-token-implementation

غير مصنف

Implement or change AuthCrunch portal refresh configuration, opaque token families, atomic rotation, replay revocation, issuance claims, store adapters, and portal lifecycle. Use for portal refresh tokens, not upstream OAuth token renewal.

لغة النص الأصلي: الإنجليزية

2026-10-10

refresh-token-transports

غير مصنف

Change AuthCrunch refresh/logout HTTP routes, secure cookies, native JSON credential transport, browser Web Locks, continuation pages, fresh login, or cross-tab session coordination.

لغة النص الأصلي: الإنجليزية

2026-10-10

runtime-state

غير مصنف

Maintain host-independent persistent runtime state, its reusable directory parser, encrypted records and generated keys, portal and portal-free OAuth sessions, refresh/OIDC replay history, local identity epochs, restart E2E tests, and embedding lifecycle…

لغة النص الأصلي: الإنجليزية

2026-10-10

session-and-refresh-storage

غير مصنف

Maintain the local SQLite refresh-storage plugin, its public parser, atomic rotation and replacement, replay history, durability and lifecycle, and refresh-engine consumer tests. Excludes automatic portal backend selection and storage for OIDC or OAuth…

لغة النص الأصلي: الإنجليزية

2026-10-10

testing-and-ci

غير مصنف

Require corresponding tests for every Go code change, E2E coverage whenever developing tests, and immediate diagnostic remediation while agents edit code; select, run, and maintain AuthCrunch tests through pinned tested, browser tests, automation fixtures,…

لغة النص الأصلي: الإنجليزية

2026-10-10

authdb

غير مصنف

Maintain the standalone cmd/authdb server, pkg/httpserver listener and portal routing, HTTP configuration parser, TLS, shutdown, executable tests, and deployment guidance. Use authdbctl for the management client.

لغة النص الأصلي: الإنجليزية

2026-10-10

authentication-portal-cookies

غير مصنف

Maintain portal cookie configuration, reusable cookie directive parsing, common prefixes and explicit names, domain attributes, factory issuance/deletion, and cookie interoperability with OIDC, refresh, OAuth, and gatekeepers.

لغة النص الأصلي: الإنجليزية

2026-10-10

authentication-portal-themes

غير مصنف

Build, customize, or update AuthCrunch authentication portal themes using Go HTML templates, CSS, and SVG branding. Use for responsive layouts, login QR controls, cross-device approval views, filesystem overrides, UI/static-asset configuration,…

لغة النص الأصلي: الإنجليزية

2026-10-10

plugin-development

غير مصنف

Develop AuthCrunch plugins in separate repositories, maintain category reference plugins under plugins/, and compose companion host plugins. Covers repository bootstrapping, shared and local guidance, category contracts, existing APIs, and integration gaps;…

لغة النص الأصلي: الإنجليزية

2026-10-10

saml-identity-provider

غير مصنف

Maintain upstream SAML identity-provider authentication, request/response browser binding, ACS and assertion validation, pinned signing certificates, and signed TLS/browser tests.

لغة النص الأصلي: الإنجليزية

2026-10-10

sqlite-registration

غير مصنف

Maintain SQLite email-confirmed registration, its public parser, optional portal confirmation hook, hashed pending credentials, recoverable account creation, and registration-to-login E2E tests. Excludes administrative approval and general identity-store…

لغة النص الأصلي: الإنجليزية

2026-10-10

threat-hunting

غير مصنف

Audit AuthCrunch security boundaries, triage vulnerability reports and scanner findings, reproduce authentication or authorization failures, and prepare evidence-backed remediation. Covers trust, credentials, redirects, concurrency, diagnostic logging, and…

لغة النص الأصلي: الإنجليزية

2026-10-10

sqlite-ticket-provider

غير مصنف

Maintain the pure-Go SQLite single-use ticket identity provider, public parser, trusted issuance API, HTTP login capability, cookie and realm binding, portal signing, and TLS consumer tests. Excludes OAuth/SAML protocols and anonymous ticket issuance services.

لغة النص الأصلي: الإنجليزية

2026-10-10

authentication-portal-mfa

غير مصنف

Maintain portal TOTP and WebAuthn login checkpoints and enrollment, server-side challenges, factor-specific verification, replay prevention, and real TLS MFA journeys.

لغة النص الأصلي: الإنجليزية

2026-10-09

authentication-portal-oidc

غير مصنف

Maintain the downstream pkg/oidc OpenID Provider and portal adapter, including client configuration, code/PKCE, claims, consent rendering, response policies, provider tokens, and conformance. Excludes upstream OAuth providers and portal refresh-token…

لغة النص الأصلي: الإنجليزية

2026-10-09

authentication-client

غير مصنف

Maintain or embed pkg/authclient for portal login, password/TOTP and API-key authentication, native credential transport, configuration parsing, and credential files. Covers authdbctl login wiring; management commands and the admin API have separate owners.

لغة النص الأصلي: الإنجليزية

2026-10-08

authentication-portal-jwks

غير مصنف

Maintain portal public signing-key discovery at .well-known/jwks.json, reusable admin API directive parsing, opt-in admin private-key export, KMS key serialization, asymmetric issuer selection, base-path routing, and JWT verification tests. Excludes upstream…

لغة النص الأصلي: الإنجليزية

2026-10-08

local-password-authentication

غير مصنف

Maintain local bcrypt and Argon2id password generation, prefixed imports, reusable hashing configuration/parser, duplicate detection, changes, resets, credential revocation, and authentication work equalization.

لغة النص الأصلي: الإنجليزية

2026-10-08

release-and-versioning

غير مصنف

Maintain AuthCrunch VERSION authority, versioned synchronization, patch/minor release commands, CI artifact identities, and GoReleaser publication. Use for version checks, release automation, or release preparation.

لغة النص الأصلي: الإنجليزية

2026-10-08

claims-enrichment

غير مصنف

Maintain request-time claims enrichment, its public backend and parser APIs, gatekeeper and validator hooks, and the static claims-enrichment plugin. Excludes portal issuance-time transforms and token signing.

لغة النص الأصلي: الإنجليزية

2026-10-07

secrets-plugins

غير مصنف

Integrate and develop AuthCrunch secrets plugins using the SQLite, static, and AWS Secrets Manager implementations. Covers exact APIs, resource binding, payload types, safe metadata, lifecycle, parser gaps, and consumer validation; excludes identity-store…

لغة النص الأصلي: الإنجليزية

2026-10-07

sqlite-identity-store

غير مصنف

Maintain the pure-Go SQLite password identity store, reusable parser, immutable account evidence, idempotent enrollment, portal injection, and login E2E tests. Excludes local JSON database internals and MFA/profile feature implementation.

لغة النص الأصلي: الإنجليزية

2026-10-07

sqlite-messaging

غير مصنف

Maintain the pure-Go SQLite notification outbox, public parser, runtime messaging-provider injection, worker leases, and registration delivery E2E tests. Excludes SMTP transports and registration enrollment state.

لغة النص الأصلي: الإنجليزية

2026-10-07

credential-authenticators

غير مصنف

Maintain injected credential authenticators, method-isolated caching, request-context propagation, and the pure-Go SQLite API-key plugin. Excludes interactive portal password authentication and identity-store provisioning.

لغة النص الأصلي: الإنجليزية

2026-10-07

authorization-policy-acl

غير مصنف

Maintain authorization ACL rules, typed custom claim fields, their reusable parser, policy integration, and signed-token or authenticated-user E2E coverage.

لغة النص الأصلي: الإنجليزية

2026-10-06

authorization-policy-oauth

غير مصنف

Maintain authorization-policy OAuth login without an authentication portal, including provider selection, directive parsing, gatekeeper callbacks, opaque sessions, ACL checks, logout, lifecycle, TLS E2E tests, and embedding contracts. Upstream protocol and…

لغة النص الأصلي: الإنجليزية

2026-10-06

external-authorization

غير مصنف

Maintain required external authorization decisions, gatekeeper and validator hooks, the HTTP JSON plugin, reusable parsers, and protected-request E2E coverage. Excludes credential authentication and claims enrichment.

لغة النص الأصلي: الإنجليزية

2026-10-06

cryptographic-signing

غير مصنف

Maintain the local RSA-PSS PS256 signing plugin, its public parser, refresh-engine composition, public JWKS, and strict core verification. Excludes portal or OIDC signer selection and remote KMS backends.

لغة النص الأصلي: الإنجليزية

2026-10-06

skill-authoring

غير مصنف

Create or revise repo-local skills connected by actionable routing statements from AGENTS.md through broad and increasingly specialized skills. Use when documenting AuthCrunch engineering knowledge, adding or routing a skill, reorganizing the skill hierarchy,…

لغة النص الأصلي: الإنجليزية

2026-10-06

authdbctl

غير مصنف

Maintain cmd/authdbctl commands, flags, configuration, terminal input, management retries, output, and executable E2E tests. Use authentication-client for the reusable portal login protocol.

لغة النص الأصلي: الإنجليزية

2026-09-27

عرض ٤٠ من أصل ٤٤ skills مجمعة.

التثبيت بمساعدة مساعد ذكي

انسخ هذا الطلب إلى المساعد الذكي الذي تستخدمه.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/greenpau/go-authcrunch.