Documentation
¶
Index ¶
- Variables
- func NaviktMiddleware(v *NaviktVerifier, sm *scs.SessionManager, q db.Querier, adminGroups []string, ...) func(http.Handler) http.Handler
- func UserMiddleware(sm *scs.SessionManager, q db.Querier) func(http.Handler) http.Handler
- type AuthRequestOptions
- type ExchangeOptions
- type GitHubProvider
- type Identity
- type NaviktClaims
- type NaviktVerifier
- type OIDCProvider
- type Provider
Constants ¶
This section is empty.
Variables ¶
var ErrVerifiedEmailRequired = errors.New("verified email required")
Functions ¶
func NaviktMiddleware ¶ added in v1.2.4
func NaviktMiddleware( v *NaviktVerifier, sm *scs.SessionManager, q db.Querier, adminGroups []string, allowedDomains []string, sessionHMACKey string, ) func(http.Handler) http.Handler
NaviktMiddleware verifies the Bearer token injected by the Wonderwall proxy, populates the SessionUser context, and only touches the DB on cache misses. Requests without a valid token (or with a token that fails verification) continue unauthenticated — the RequireLoginExcept middleware enforces the gate.
If the token's groups[] contains any entry in adminGroups, the role is promoted to "admin" for the duration of this request. Otherwise the stored DB role is used.
func UserMiddleware ¶
UserMiddleware reads the authenticated user ID from the SCS session and injects a SessionUser into the request context. Requests with no session or an invalid user ID continue unauthenticated.
Types ¶
type AuthRequestOptions ¶
Provider abstracts a single OAuth2/OIDC login flow.
type ExchangeOptions ¶
type GitHubProvider ¶
type GitHubProvider struct {
// contains filtered or unexported fields
}
func NewGitHubProvider ¶
func NewGitHubProvider(clientID, clientSecret, callbackURL string) *GitHubProvider
func (*GitHubProvider) AuthCodeURL ¶
func (p *GitHubProvider) AuthCodeURL(state string, _ AuthRequestOptions) string
func (*GitHubProvider) Exchange ¶
func (p *GitHubProvider) Exchange(ctx context.Context, code string, _ ExchangeOptions) (Identity, error)
func (*GitHubProvider) Name ¶
func (p *GitHubProvider) Name() string
type Identity ¶
type Identity struct {
Provider string // "github" | "oidc"
ProviderID string // stable subject ID
Email string
Name string
}
Identity is the normalised result from any OAuth2/OIDC provider.
type NaviktClaims ¶ added in v1.2.4
type NaviktClaims struct {
}
NaviktClaims holds the token claims extracted from a NAIS/Entra ID bearer token.
type NaviktVerifier ¶ added in v1.2.4
type NaviktVerifier struct {
// contains filtered or unexported fields
}
NaviktVerifier verifies Entra ID bearer tokens injected by the Wonderwall proxy. It validates the signature against the JWKS endpoint and checks iss, aud, exp.
func NewNaviktVerifier ¶ added in v1.2.4
func NewNaviktVerifier(ctx context.Context, issuer, clientID, jwksURI string) *NaviktVerifier
NewNaviktVerifier constructs a NaviktVerifier that fetches signing keys from the given JWKS URI and validates against the provided issuer and client ID.
func (*NaviktVerifier) Verify ¶ added in v1.2.4
func (v *NaviktVerifier) Verify(ctx context.Context, rawToken string) (NaviktClaims, error)
Verify validates the raw bearer token and extracts NAIS-specific claims. It checks signature, issuer, audience, and expiry.
type OIDCProvider ¶
type OIDCProvider struct {
// contains filtered or unexported fields
}
func NewEntraIDProvider ¶
func NewEntraIDProvider(ctx context.Context, tenantID, clientID, clientSecret, callbackURL string) (*OIDCProvider, error)
NewEntraIDProvider constructs an OIDCProvider pointed at the Microsoft Entra ID v2.0 endpoint for the given tenant.
func NewOIDCProvider ¶
func NewOIDCProvider(ctx context.Context, name, issuerURL, clientID, clientSecret, callbackURL string) (*OIDCProvider, error)
NewOIDCProvider creates a generic OIDC provider. name is the slug used in callback URLs and stored as the provider discriminator (e.g. "oidc", "entra").
func (*OIDCProvider) AuthCodeURL ¶
func (p *OIDCProvider) AuthCodeURL(state string, opts AuthRequestOptions) string
func (*OIDCProvider) Exchange ¶
func (p *OIDCProvider) Exchange(ctx context.Context, code string, opts ExchangeOptions) (Identity, error)
func (*OIDCProvider) Name ¶
func (p *OIDCProvider) Name() string
type Provider ¶
type Provider interface {
// Name returns the slug used in callback URLs (e.g. "github").
Name() string
// AuthCodeURL returns the redirect URL the browser should visit.
AuthCodeURL(state string, opts AuthRequestOptions) string
// Exchange completes the flow: exchanges the code and returns an Identity.
Exchange(ctx context.Context, code string, opts ExchangeOptions) (Identity, error)
}
Source Files
Directories