go list -f '{{.ImportPath}} -> {{join .Imports " "}}' ./.... Higher layers
depend only on lower ones; nothing in a lower layer imports back up.
- L0 — no internal deps:
core,jwt,crypto/password,observe,ratelimit,web/cors,saml - L1:
core/event→core;web/session→jwt - L2:
authn,web/csrf,web/rememberme,web/middleware,oidcprovider - L3:
authz,oauth2,lockout,web/resource - L4:
web/auth,adminui - L5 (facade):
securityhttp
==>) mark the three cross-layer edges worth calling out by
name: securityhttp → web/auth, web/auth → oauth2, and lockout →
authn. The edge set above is a representative subset, not the full ~45
import edges — this graph tracks layers, not every dependency, so it survives
package-internal refactors.
saml, oidcprovider, adminui, and core/event are real packages with no
docs page yet (shown unlinked above); everything else links to its module
page. web/internal/secutil and examples/* are omitted — internal-only and
leaf consumers, respectively.
Two islands: saml and oidcprovider are unreachable from
securityhttp/web/auth — nothing in the facade imports them. web/resource
and adminui also sit outside the facade’s dependency tree.
go-security-sql is a separate Go module (replace => ../ in its go.mod).
The dependency direction is strictly one-way: it imports web/session and
lockout, never the reverse.
See the securityhttp middleware chain
for how the L5 facade assembles these packages into one http.Handler.