viewerauth

func Middleware ¶

func Middleware(keys []ed25519.PublicKey, app, callPath string, next http.Handler) http.Handler

Middleware verifies the token of every request for app and puts what it names in the request context. A request to callPath must carry a call token, which names the calling app; any other request must carry a viewer token, which names none. Requests without a fitting, valid token get 401 and never reach next.

A viewer token and a call token made for a viewer put the viewer and the raw token in the context; a call token also puts the calling app. A token for a call an app makes as itself puts only the calling app.