go-auth

A small, reusable Go library for SQLite-backed session authentication and role-based access control (RBAC). It provides:

• bcrypt password hashing
• cryptographically random bearer tokens, stored as SHA-256 hashes
• session expiry and revocation
• an RBAC permission matrix (auth_module × auth_permission)
• a stdlib net/http middleware
• a Gin middleware adapter
• deterministic per-account progress keys (auth-user:<id>)

The schema is compatible with the auth tables used by the workshop and ai_interviewing platforms, so those projects can migrate to this library without altering existing databases.

Installation

go get github.com/vasic-digital/go-auth

Quickstart

package main

import (
    "log"
    "net/http"

    "github.com/vasic-digital/go-auth/pkg/middleware"
    "github.com/vasic-digital/go-auth/pkg/store"
    "github.com/vasic-digital/go-auth/pkg/token"
)

func main() {
    st, err := store.Open("./run")
    if err != nil {
        log.Fatal(err)
    }
    defer st.Close()

    // Configure modules, permissions, and seed users once per deployment.
    if err := store.SeedModules(st, store.Module{Name: "app", DisplayName: "My App"}); err != nil {
        log.Fatal(err)
    }
    if err := store.SeedPermissions(st, "app", []store.SeedPermission{
        {Resource: "documents", Actions: []string{"read", "write"}, Role: "admin"},
        {Resource: "documents", Actions: []string{"read"}, Role: "user"},
    }); err != nil {
        log.Fatal(err)
    }

    hash, _ := token.HashPassword("secret")
    if err := store.SeedUsers(st, []store.SeedUser{
        {Username: "alice", PasswordHash: hash, Role: "admin"},
    }); err != nil {
        log.Fatal(err)
    }

    protected := middleware.Middleware(st, "app")(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("ok"))
    }))

    log.Fatal(http.ListenAndServe(":8080", protected))
}

Packages

Package	Purpose
pkg/store	SQLite-backed user/session/permission store and seed helpers
pkg/token	Password hashing, random token generation, token hashing, expiry
pkg/middleware	stdlib net/http middleware and context helpers
pkg/gin	Gin framework adapter (middleware, Can/Require, cookie helpers)

Schema

The library creates four tables on first open:

• auth_user — accounts with username, password_hash, role, timestamps
• auth_module — named RBAC modules (e.g. workshop, ai_interviewing, app)
• auth_permission — matrix of module_id × resource × action × role
• auth_session — bearer token hashes with expiry and revocation timestamps

The schema is intentionally identical to the existing tables in consuming projects so that Open against an existing database is a no-op migration.

License

MIT