type

AuthConfig

type AuthConfig = core.AuthConfig

Policy for an auth-enabled collection.

Source ridu.go:37

SessionDurationtime.Duration: Session lifetime; zero defaults to 24 hours.
PasswordPasswordPolicy: Controls local password validation and hashing.
MaxLoginAttemptsint: Failures before lockout; zero defaults to 5 and a negative value disables lockout.
LockDurationtime.Duration: Lockout duration; zero defaults to 10 minutes.
PasswordResetPasswordResetConfig: Enables recovery when its Send callback is configured.
Verify*VerifyEmailConfig: Requires verified email before local login when non-nil.
APIKeysbool: Allows revocable session-independent bearer credentials.
AccessAuthAccess: Authorizes authentication operations outside CRUD.
HooksAuthHooks: Observes or rejects authentication lifecycle phases.
Strategies[]AuthStrategy: Adds application-owned request authentication in declaration order.

Local password auth is built in. Recovery/email flows require trusted Send callbacks. External strategies are compiled Go integrations, not dynamically loaded providers. Private hashes and tokens never enter content fields or hooks.