Documentation
¶
Overview ¶
Package security contains the types used by the code generators to secure Loom endpoint. It supports the following security schemes:
- Basic security using usernames and passwords.
- API key security using keys.
- JWT security using JWT tokens.
- OAuth2 security using OAuth2 tokens.
Index ¶
- func DecodeBearer(value string) (string, bool)
- func IsOtherAuthorizationScheme(value, expected string) bool
- func Protect(check EndpointCheck, next loom.Endpoint, ...) loom.Endpoint
- func RequireAuthorizer(authorizer any)
- func RunCheck(ctx context.Context, req any, check EndpointCheck) (context.Context, error)
- type APIKeyScheme
- type AuthAPIKeyFunc
- type AuthBasicFunc
- type AuthJWTFunc
- type AuthOAuth2Func
- type BasicScheme
- type EndpointCheck
- type JWTScheme
- type OAuth2Scheme
- type OAuthFlow
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecodeBearer ¶
DecodeBearer extracts an Authorization bearer credential. The scheme is case-insensitive and separated from the nonempty token by one or more spaces. Tokens cannot contain whitespace. Raw tokens and other schemes are rejected; token content constraints and authentication remain the caller's responsibility.
func IsOtherAuthorizationScheme ¶
IsOtherAuthorizationScheme reports whether value has a syntactically valid Authorization scheme token other than expected, followed by a space and a nonempty credential. It classifies framing only; it does not authenticate or validate the foreign credential. Generated decoders use it only when the optional credential has an independent authentication alternative.
func Protect ¶ added in v1.9.0
func Protect(check EndpointCheck, next loom.Endpoint, middleware ...func(loom.Endpoint) loom.Endpoint) loom.Endpoint
Protect runs check before invoking next. Both dependencies are mandatory. Middleware factories are constructed once, in order, with the last outermost. Checks run before middleware short circuits and repeat before service execution. Middleware must preserve the supplied context (or derive a child from it); discarding it fails closed. Original request cancellation remains authoritative. Checks must be read-only and safe to repeat within a single invocation.
func RequireAuthorizer ¶ added in v1.9.0
func RequireAuthorizer(authorizer any)
RequireAuthorizer rejects missing evaluator dependencies at construction, including typed nil implementations stored in an interface. It panics on invalid configuration, matching generated endpoint constructor semantics. Reflection is limited to detecting nil; requests are accessed by typed code.
func RunCheck ¶
RunCheck executes a request check while retaining original request cancellation. The check may replace its context, but a successful nil or canceled context is rejected. Repeated checks retain the original cancellation boundary. Callback errors take precedence over cancellation observed after the callback.
Types ¶
type APIKeyScheme ¶
type APIKeyScheme struct {
// Name is the scheme name defined in the design.
Name string
// Scopes holds a list of scopes for the scheme.
Scopes []string
// RequiredScopes holds a list of scopes which are required
// by the scheme. It is a subset of Scopes field.
RequiredScopes []string
}
APIKeyScheme represents the API key security scheme. It consists of a key which is used in authentication.
func (*APIKeyScheme) Validate ¶
func (s *APIKeyScheme) Validate(scopes []string) error
Validate returns a non-nil error if scopes does not contain all of APIKey scheme's required scopes.
type AuthAPIKeyFunc ¶
AuthAPIKeyFunc is the function type that implements the API key scheme of using an API key. Checks must be read-only and safe to repeat within one invocation, including stream admission, the complete endpoint, and protected middleware boundaries.
type AuthBasicFunc ¶
type AuthBasicFunc func(ctx context.Context, user, pass string, s *BasicScheme) (context.Context, error)
AuthBasicFunc is the function type that implements the basic auth scheme of using username and password. Checks must be read-only and safe to repeat within one invocation, including stream admission, the complete endpoint, and protected middleware boundaries.
type AuthJWTFunc ¶
AuthJWTFunc is the function type that implements the JWT scheme of using a JWT token. Checks must be read-only and safe to repeat within one invocation, including stream admission, the complete endpoint, and protected middleware boundaries.
type AuthOAuth2Func ¶
type AuthOAuth2Func func(ctx context.Context, token string, s *OAuth2Scheme) (context.Context, error)
AuthOAuth2Func is the function type that implements the OAuth2 scheme of using an OAuth2 token. Checks must be read-only and safe to repeat within one invocation, including stream admission, the complete endpoint, and protected middleware boundaries.
type BasicScheme ¶
type BasicScheme struct {
// Name is the scheme name defined in the design.
Name string
// Scopes holds a list of scopes for the scheme.
Scopes []string
// RequiredScopes holds a list of scopes which are required
// by the scheme. It is a subset of Scopes field.
RequiredScopes []string
}
BasicScheme represents the BasicAuth security scheme. It consists of a simple username and password.
func (*BasicScheme) Validate ¶
func (s *BasicScheme) Validate(scopes []string) error
Validate returns a non-nil error if scopes does not contain all of Basic scheme's required scopes.
type EndpointCheck ¶ added in v1.9.0
EndpointCheck checks a typed request at an invocation boundary. Complete endpoint checks validate, authenticate, and evaluate application access; stream admission checks authenticate a metadata-derived partial payload. A nil error permits the next phase using the returned context; every error prevents execution.
type JWTScheme ¶
type JWTScheme struct {
// Name is the scheme name defined in the design.
Name string
// Scopes holds a list of scopes for the scheme.
Scopes []string
// RequiredScopes holds a list of scopes which are required
// by the scheme. It is a subset of Scopes field.
RequiredScopes []string
}
JWTScheme represents an API key based scheme with support for scopes.
type OAuth2Scheme ¶
type OAuth2Scheme struct {
// Name is the scheme name defined in the design.
Name string
// Scopes holds a list of scopes for the scheme.
Scopes []string
// RequiredScopes holds a list of scopes which are required
// by the scheme. It is a subset of Scopes field.
RequiredScopes []string
// Flows determine the oauth2 flows.
Flows []*OAuthFlow
}
OAuth2Scheme represents the oauth2 security scheme.
func (*OAuth2Scheme) Validate ¶
func (s *OAuth2Scheme) Validate(scopes []string) error
Validate returns a non-nil error if scopes does not contain all of OAuth2 scheme's required scopes.
type OAuthFlow ¶
type OAuthFlow struct {
// Type is the type of grant.
Type string
// AuthorizationURL to be used for implicit or authorizationCode flows.
AuthorizationURL string
// TokenURL to be used for password, clientCredentials or authorizationCode flows.
TokenURL string
// RefreshURL to be used for obtaining refresh token.
RefreshURL string
}
OAuthFlow represents the OAuth2 flow defined by the scheme.
Source Files