securex

Oct 3, 2026

Changes in this version

+ const AuthUnavailableRetryAfter

+ const MinHS256SecretBytes

+ var ErrAuthUnavailable = errors.New("securex: authentication temporarily unavailable")

+ var ErrHS256SecretTooShort = errors.New("securex: HS256 secret is shorter than the 256-bit minimum (RFC 7518 §3.2)")

+ func CheckHS256Secret(secret []byte) error

Sep 28, 2026

Changes in this version

+ const GenericServiceUnavailableCode

+ const InvalidTokenChallenge

+ const MaxJWTBytes

+ const MinimalBearerChallenge

+ var ErrClientCertificateMismatch = errors.New("securex: the verified chain's leaf is not the presented client certificate")

+ var ErrIdentityConflict = fmt.Errorf("%w: the credentials of one auth group name different identities", ...)

+ var ErrJWTExpired = errors.New("securex: jwt expired")

+ var ErrMTLSPrincipalControl = errors.New("securex: mtls: the certificate principal carries a control character")

+ var ErrNoBearerToken = fmt.Errorf("%w: no bearer token", ErrAuthFailed)

+ var ErrNoClientCertificate = errors.New("securex: no verified TLS client certificate")

+ var ErrNoSessionCookie = fmt.Errorf("%w: no session cookie", ErrAuthFailed)

+ var ErrResourceVerifierRequired = errors.New(...)

+ var ErrSPIFFEMalformed = errors.New("securex: malformed SPIFFE ID")

+ var ErrWorkloadAuthDisabled = errors.New("securex: workload_auth is not enabled")

+ var ErrWorkloadNotAllowed = errors.New("securex: the client certificate's workload is not allowed")

+ var ErrWorkloadTrustBundle = errors.New("securex: workload trust bundle")

+ var ErrWorkloadVerifierRequired = errors.New(...)

+ func BearerCause(err error) error

+ func CallerKindFromClaims(rules []configx.CallerKindRule, claims *Claims, raw map[string]any) callerctx.Kind

+ func CertificateUPN(c *x509.Certificate) string

+ func CertificateURISANs(c *x509.Certificate) []string

+ func ClientCertificateLeaf(cs *tls.ConnectionState) (*x509.Certificate, error)

+ func ContextWithCallerKind(ctx context.Context, kind callerctx.Kind) context.Context

+ func ContextWithMTLSWorkload(ctx context.Context, w callerctx.Workload) context.Context

+ func ContextWithVerifiedCaller(ctx context.Context, c *callerctx.Caller) context.Context

+ func HasIdentityControl(s string) bool

+ func LegacyCallerKind(c *Claims) callerctx.Kind

+ func MTLSWorkloadFromContext(ctx context.Context) (callerctx.Workload, bool)

+ func ParseSPIFFEID(uri string) (trustDomain, path string, err error)

+ func VerifiedCallerFromContext(ctx context.Context) (*callerctx.Caller, bool)

+ func WriteBearerUnauthorized(w http.ResponseWriter, err error)

+ func WriteChallenge(w http.ResponseWriter, internalErr error, status int, challenge string)

+ func WriteForbiddenChallenge(w http.ResponseWriter, internalErr error, challenge string)

+ func WriteServiceUnavailable(w http.ResponseWriter, internalErr error, retryAfter time.Duration)

+ func WriteUnauthorizedChallenge(w http.ResponseWriter, internalErr error, challenge string)

type Claims

+ func ClaimsFromCaller(c *callerctx.Caller) *Claims

+ func VerifyJWTWithClaimSet(token string, secret []byte, opts JWTVerifyOptions) (*Claims, map[string]any, error)

+ type CompositeError struct

+ func (e *CompositeError) Error() string

+ func (e *CompositeError) Is(target error) bool

+ func (e *CompositeError) Unwrap() []error

type Gate

+ func GateSessionCookie(cookieName string, verifyJWT func(*http.Request) error) Gate

type JWKSVerifyOptions

+ AcceptableSkew time.Duration

type MTLSPolicy

+ Workload *WorkloadVerifier

type Role

+ const RoleNone

+ type WorkloadOption func(*workloadOptions)

+ func WithListenerCAs(pool *x509.CertPool) WorkloadOption

+ func WithTrustBundle(trustDomain string, roots *x509.CertPool) WorkloadOption

+ type WorkloadVerifier struct

+ func NewWorkloadVerifier(cfg *configx.WorkloadAuthConfig, opts ...WorkloadOption) (*WorkloadVerifier, error)

+ func (v *WorkloadVerifier) Authenticate(r *http.Request) (*http.Request, error)

+ func (v *WorkloadVerifier) ListenerCAsAssertTrustDomain() bool

+ func (v *WorkloadVerifier) Verify(r *http.Request) (*callerctx.Workload, error)

Sep 25, 2026

Changes in this version

+ func CallerFromRequest(r *http.Request) *callerctx.Caller

+ func ContextWithCaller(ctx context.Context, c *callerctx.Caller) context.Context

+ func ContextWithOwnedCaller(ctx context.Context, c *callerctx.Caller) context.Context

+ func HumanSubject(ctx context.Context) string

+ func MustCaller(ctx context.Context) *callerctx.Caller

type AuthSource

+ func (s AuthSource) String() string

type Claims

+ ACR string

+ AZP string

+ ClientID string

+ Issuer string

Sep 20, 2026

Changes in this version

+ const GenericForbiddenCode

+ const GenericPayloadTooLargeCode

+ const GenericUnauthorizedCode

Sep 15, 2026

Changes in this version

+ func RequireRoleH(h *RoleHierarchy, minimum Role, secret []byte, opts JWTVerifyOptions, ...) http.Handler

+ type RoleHierarchy struct

+ func DefaultRoleHierarchy() *RoleHierarchy

+ func MustRoleHierarchy(namesHighestFirst []string) *RoleHierarchy

+ func NewRoleHierarchy(namesHighestFirst []string) (*RoleHierarchy, error)

+ func (h *RoleHierarchy) Highest(c *Claims) Role

+ func (h *RoleHierarchy) Name(r Role) string

+ func (h *RoleHierarchy) Names() []string

+ func (h *RoleHierarchy) Parse(s string) (Role, error)

Sep 8, 2026

Changes in this version

+ var ErrClaimControlChar = errors.New("securex: subject/role/scope claim contains a control character")

+ var ErrJWTSubjectRequired = errors.New("securex: jwt sub claim required")

+ func ContextWithAuthSource(ctx context.Context, src AuthSource) context.Context

+ func ContextWithMTLSPrincipal(ctx context.Context, principal, classification string) context.Context

+ func MTLSPrincipalFromContext(ctx context.Context) (principal, classification string, ok bool)

+ func SetAuditSink(fn func(event string, fields map[string]any))

+ func VerifyMTLSRequest(r *http.Request, policy MTLSPolicy) (*http.Request, error)

type AuthSource

+ func AuthSourceConsumed(r *http.Request) AuthSource

+ func AuthSourceFromContext(ctx context.Context) (AuthSource, bool)

+ type CertPolicyContextVerifier interface

+ VerifyContext func(ctx context.Context, leaf *x509.Certificate) (enriched context.Context, principal, classification string, err error)

type JWTVerifyOptions

+ RequireSubject bool

Jul 26, 2026

Changes in this version

+ var ErrMTLSNoIssuer = errors.New("securex: mtls: no issuer certificate in verified chain for revocation check")

+ var ErrMTLSRuntimeRequired = errors.New(...)

+ func StartNonceGCLegacy(seen *sync.Map, interval time.Duration) chan struct

+ type CertPolicyVerifier interface

+ Verify func(leaf *x509.Certificate) (principal, classification string, err error)

+ type CertPolicyVerifierFunc func(leaf *x509.Certificate) (principal, classification string, err error)

+ func (f CertPolicyVerifierFunc) Verify(leaf *x509.Certificate) (string, string, error)

type Claims

+ func VerifyJWTWithClaims(token string, secret []byte, opts JWTVerifyOptions) (*Claims, error)

type MTLSPolicy

+ Runtime MTLSRuntime

+ type MTLSRuntime struct

+ CRL RevocationChecker

+ CertPolicy CertPolicyVerifier

+ OCSP RevocationChecker

+ type RevocationChecker interface

+ Check func(ctx context.Context, leaf, issuer *x509.Certificate) error

Jul 1, 2026

Changes in this version

+ const DevEnvVar

+ const GenericForbiddenBody

+ const GenericUnauthorizedBody

+ const InsecureDevEnv

+ var AllowedAsymmetricAlgs = []jwa.SignatureAlgorithm

+ var ErrAuthAPIKeyRequired = errors.New(...)

+ var ErrAuthFailed = errors.New("securex: authentication failed")

+ var ErrAuthMTLSRequired = errors.New(...)

+ var ErrAuthVerifierRequired = errors.New(...)

+ var ErrAuthWebhookRequired = errors.New(...)

+ var ErrBodyTooLarge = errors.New("securex: request body exceeds signing limit")

+ var ErrCSRFSignerRequired = errors.New("securex: CSRF signer required")

+ var ErrInsufficientAMR = errors.New("securex: insufficient amr (step-up required)")

+ var ErrInsufficientRole = errors.New("securex: insufficient role")

+ var ErrInvalidConfig = errors.New("securex: invalid configuration")

+ var ErrJWKSEmpty = errors.New("securex: jwks empty (no keys to verify against)")

+ var ErrJWTUnsupported = errors.New("securex: jwt algorithm or token unsupported")

+ var ErrMTLSCertEKUMissing = errors.New("securex: client cert lacks clientAuth EKU")

+ var ErrMTLSCertMissing = errors.New("securex: client certificate missing")

+ var ErrMTLSCertNotVerified = errors.New("securex: client certificate not verified")

+ var ErrNoCookieToken = errors.New("securex: missing auth cookie")

+ var ErrOwnershipDenied = errors.New("securex: object ownership denied")

+ var ErrRateLimited = errors.New("securex: rate limit exceeded")

+ var ErrVerifierMisconfigured = errors.New("securex: verifier misconfigured (Require* set without expected value)")

+ var ErrWebhookFailed = errors.New("securex: webhook verification failed")

+ func APIKeyAuth(r *http.Request, secret []byte, window time.Duration, seen *sync.Map) error

+ func APIKeyAuthHTTP(w http.ResponseWriter, r *http.Request, secret []byte, window time.Duration, ...) bool

+ func APIKeyAuthHTTPWithLimit(w http.ResponseWriter, r *http.Request, secret []byte, window time.Duration, ...) bool

+ func APIKeyAuthWithLimit(r *http.Request, secret []byte, window time.Duration, seen *sync.Map, ...) error

+ func AllowInsecureDev(r *http.Request, debugMode bool) bool

+ func AllowInsecureDevAtStartup(debugMode bool) bool

+ func ContextWithClaims(ctx context.Context, claims *Claims) context.Context

+ func EvalComposite(r *http.Request, groups [][]Gate) (*http.Request, error)

+ func ExtractCookieToken(r *http.Request, cookieName string) (string, error)

+ func NewTestVerifier() func(*http.Request) error

+ func RequestWithAuth(r *http.Request) *http.Request

+ func RequestWithAuthPolicy(r *http.Request, policy RequestAuthPolicy) *http.Request

+ func RequireABAC(secret []byte, policies ...ABACPolicy) func(http.Handler) http.Handler

+ func RequireABACWithOptions(secret []byte, opts JWTVerifyOptions, policies ...ABACPolicy) func(http.Handler) http.Handler

+ func RequireOwnership(secret []byte, extract OwnerExtractor, next http.Handler) http.Handler

+ func RequireOwnershipWithOptions(secret []byte, opts JWTVerifyOptions, extract OwnerExtractor, ...) http.Handler

+ func RequireRole(minimum Role, secret []byte, next http.Handler) http.Handler

+ func RequireRoleWithOptions(minimum Role, secret []byte, opts JWTVerifyOptions, next http.Handler) http.Handler

+ func SetRateHeaders(w http.ResponseWriter, limit, remaining int, reset time.Time)

+ func SetRoleHierarchy(names []string)

+ func SignAPIKeyRequest(r *http.Request, secret []byte, now time.Time) error

+ func SignAPIKeyRequestWithValues(r *http.Request, secret []byte, nonce, ts string) error

+ func SignWebhookRequest(r *http.Request, secret []byte, alg WebhookAlg, now time.Time) error

+ func StartNonceGC(seen *sync.Map, interval time.Duration) chan struct

+ func VerifyJWT(token string, secret []byte) error

+ func VerifyJWTAllowNoExpiry(token string, secret []byte) error

+ func VerifyJWTWithJWKS(_ context.Context, token string, keys jwk.Set, opts JWKSVerifyOptions) (jwt.Token, error)

+ func VerifyJWTWithOptions(token string, secret []byte, opts JWTVerifyOptions) error

+ func VerifyMTLS(r *http.Request, policy MTLSPolicy) error

+ func VerifyWebhook(r *http.Request, secret []byte, pol WebhookPolicy) error

+ func WebhookReplayStorePtr() *sync.Map

+ func WriteForbidden(w http.ResponseWriter, internalErr error)

+ func WriteUnauthorized(w http.ResponseWriter, internalErr error)

+ type ABACPolicy interface

+ Evaluate func(c *Claims) bool

+ func HasAttribute(key string) ABACPolicy

+ func MatchAttribute(key, value string) ABACPolicy

+ type ABACPolicyFunc func(c *Claims) bool

+ func (f ABACPolicyFunc) Evaluate(c *Claims) bool

+ type AuthSource int

+ const AuthSourceCookie

+ const AuthSourceHeader

+ const AuthSourceNone

+ const AuthSourceQuery

+ func AuthSourceForRequest(r *http.Request, cookieName string) AuthSource

+ type Bucket = ratebucket.Bucket

+ func NewBucket(rate, burst float64) *Bucket

+ type BucketSnapshot = ratebucket.Snap

+ type Claims struct

+ AMR []string

+ Attributes map[string]string

+ Email string

+ Exp int64

+ Roles []string

+ Scopes []string

+ Subject string

+ func ClaimsFrom(ctx context.Context) (*Claims, bool)

+ func ClaimsFromContext(ctx context.Context) (*Claims, bool)

+ func ParseClaims(token string) (*Claims, error)

+ func (c *Claims) HasAMR(method string) bool

+ func (c *Claims) HasScope(scope string) bool

+ func (c *Claims) HighestRole() Role

+ type Gate func(r *http.Request) (*http.Request, error)

+ func GateAPIKey(verifyAPIKey func(*http.Request) error) Gate

+ func GateCookie(cookieName string, verifyJWT func(*http.Request) error) Gate

+ func GateDeny() Gate

+ func GateJWT(verifyJWT func(*http.Request) error) Gate

+ func GateMTLS(hook func(*http.Request, MTLSPolicy) error, policy MTLSPolicy) Gate

+ type JWKSVerifyOptions struct

+ AllowedAlgs []jwa.SignatureAlgorithm

+ Audience string

+ Issuer string

+ RequireAudience bool

+ RequireExpiry bool

+ RequireIssuer bool

+ type JWTVerifyOptions struct

+ Audience string

+ Issuer string

+ RequireAudience bool

+ RequireExpiry bool

+ RequireIssuer bool

+ type MTLSPolicy struct

+ EKUValidation bool

+ Required bool

+ SupportedIssuers []string

+ type OwnerExtractor func(r *http.Request) (ownerID string, ok bool)

+ type RequestAuthPolicy struct

+ AllowAuthorizationHeader bool

+ AllowQueryBearer bool

+ AllowQuerySignature bool

+ AllowSubprotocolBearer bool

+ AllowSubprotocolSignature bool

+ func DefaultRequestAuthPolicy() RequestAuthPolicy

+ type Role int

+ const RoleAdmin

+ const RoleManager

+ const RoleUser

+ func RoleFromString(s string) (Role, error)

+ func (r Role) HasRole(required Role) bool

+ func (r Role) String() string

+ type WebhookAlg string

+ const WebhookAlgSHA256

+ const WebhookAlgSHA512

+ type WebhookPolicy struct

+ Algs []WebhookAlg

+ IDHeader string

+ MaxBodyBytes int64

+ Name string

+ SignatureHeader string

+ TimestampHeader string

+ Window time.Duration