auth

func OIDCMiddleware ¶

func OIDCMiddleware(issuer, clientID, tenantClaim string, next http.Handler) (http.Handler, error)

OIDCMiddleware authenticates control-plane requests with an OIDC ID token (Authorization: Bearer <id_token>) issued by the configured issuer. The token's subject becomes the Principal subject; the tenant claim (default "tenant", configurable) becomes the tenant scope every store query is bounded by. This is the production identity path the tech baseline requires before any non-development deployment.

func StaticMiddleware ¶

func StaticMiddleware(principal Principal, next http.Handler) http.Handler

StaticMiddleware is intentionally suitable only for a single-tenant local development server. Production deployments must replace it with verified workload or user identity middleware.

func WithPrincipal ¶

func WithPrincipal(ctx context.Context, principal Principal) context.Context