Auth, databases, email and a web framework for Go, behind one facade.

CoreGo gives your Go API sign-up, sessions, MongoDB and PostgreSQL, transactional email and a web framework. A protected endpoint takes about ten lines.

go get github.com/berkkaradalan/CoreGo@v0.2.0

Get started

A protected API in one file.

One call to corego.New reads your environment, connects your database and starts the auth service.

main.go

package main

import (
	"log"
	"net/http"

	corego "github.com/berkkaradalan/CoreGo"
	"github.com/berkkaradalan/CoreGo/auth"
	"github.com/berkkaradalan/CoreGo/web"
)

func main() {
	core, err := corego.New(&corego.Config{Auth: &corego.AuthOptions{}})
	if err != nil {
		log.Fatal(err)
	}
	app := core.Server()
	api := app.Group("/api", core.RequireAuth())
	api.Get("/hello", func(c *web.Context) error {
		user := auth.MustUser(c)
		return c.JSON(http.StatusOK, map[string]string{"hello": user.Name})
	})
	if err := core.Run(); err != nil {
		log.Fatal(err)
	}
}

Read the hello world

Six building blocks, one import path.

Authentication

Sign-up, sign-in and server-side sessions, email verification, password reset, email and password changes, bans. Seventeen ready-made routes under /auth.

Web framework

A standard-library-only router: groups, middleware, CORS, rate limiting, request logging, timeouts and graceful shutdown.

Databases

MongoDB and PostgreSQL connected from one environment variable, with typed QueryAll[T] and QueryOne[T], transactions and a single ErrNotFound.

Email

SMTP with STARTTLS or implicit TLS, a log sender for development and a capture sender for tests. Verification and reset emails are wired for you.

Configuration

A .env file plus the process environment. Every switch can be set from the environment, and one startup line tells you what was resolved.

Your storage

Keep users and sessions in memory, MongoDB or PostgreSQL. Indexes and versioned migrations run on startup, or bring your own store.

Secure by default.

Tokens hashed at rest
Session and email tokens are stored as SHA-256 digests; passwords use bcrypt.
Single-use, purpose-bound tokens
A verification link can never reset a password, and no token works twice.
No account enumeration
Password reset and verification answer the same way, in the same time, for every address.
CSRF protection
Cookie sessions reject cross-site requests unless the origin is trusted.
Rate limits built in
Per client IP and per email address on every sensitive route.
Safe under concurrency
Optimistic locking means parallel requests never overwrite each other's changes.