type

AuthConfig

type AuthConfig struct {
	// SessionDuration is how long a login remains valid. Zero defaults to 24 hours.
	SessionDuration time.Duration
	// Password controls local password validation and hashing. Zero values use
	// the secure framework defaults documented on PasswordPolicy.
	Password PasswordPolicy
	// MaxLoginAttempts is the number of consecutive credential failures allowed
	// before the account is temporarily locked. Zero defaults to 5; a negative
	// value disables account lockout.
	MaxLoginAttempts int
	// LockDuration is how long an account remains locked after MaxLoginAttempts.
	// Zero defaults to 10 minutes.
	LockDuration time.Duration
	// PasswordReset enables the forgot/reset-password flow when Send is set.
	// The raw single-use token is delivered only to this trusted callback.
	PasswordReset PasswordResetConfig
	// Verify enables email verification. When non-nil, newly provisioned
	// credentials cannot log in until a verification token is consumed.
	Verify *VerifyEmailConfig
	// APIKeys allows users to mint revocable, session-independent bearer
	// credentials. API keys are disabled by default.
	APIKeys bool
	// Access contains authorization rules for auth operations that are not CRUD.
	Access AuthAccess
	// Hooks contains authentication lifecycle callbacks.
	Hooks AuthHooks
	// Strategies adds application-owned request authentication in declaration order.
	Strategies []AuthStrategy
}

Session, credentials, recovery, and custom-strategy policy for an auth collection.

Source core/config.go:255

SessionDurationtime.Duration: Session lifetime; zero defaults to 24 hours.
PasswordPasswordPolicy: Controls local password validation and hashing.
MaxLoginAttemptsint: Failures before lockout; zero defaults to 5 and a negative value disables lockout.
LockDurationtime.Duration: Lockout duration; zero defaults to 10 minutes.
PasswordResetPasswordResetConfig: Enables recovery when its Send callback is configured.
Verify*VerifyEmailConfig: Requires verified email before local login when non-nil.
APIKeysbool: Allows revocable session-independent bearer credentials.
AccessAuthAccess: Authorizes authentication operations outside CRUD.
HooksAuthHooks: Observes or rejects authentication lifecycle phases.
Strategies[]AuthStrategy: Adds application-owned request authentication in declaration order.