Documentation
¶
Index ¶
- Constants
- func ClearExclusiveProvider()
- func IsAuthErrorCode(authErr *AuthError, code AuthErrorCode) bool
- func RegisterProvider(typ string, provider Provider)
- func SetExclusiveProvider(typ string)
- func StableIndex(provider, principal string) string
- func UnregisterProvider(typ string)
- type AccessConfig
- type AccessProvider
- type AuthError
- type AuthErrorCode
- type Manager
- type Provider
- type Result
Constants ¶
const ( // AccessProviderTypeConfigAPIKey is the built-in provider validating inline API keys. AccessProviderTypeConfigAPIKey = "config-api-key" // DefaultAccessProviderName is applied when no provider name is supplied. DefaultAccessProviderName = "config-inline" )
Variables ¶
This section is empty.
Functions ¶
func ClearExclusiveProvider ¶
func ClearExclusiveProvider()
ClearExclusiveProvider removes any active provider restriction installed by SetExclusiveProvider. It is called when the exclusive plugin shuts down so the regular provider chain resumes.
func IsAuthErrorCode ¶
func IsAuthErrorCode(authErr *AuthError, code AuthErrorCode) bool
func RegisterProvider ¶
RegisterProvider registers a pre-built provider instance for a given type identifier.
func SetExclusiveProvider ¶
func SetExclusiveProvider(typ string)
SetExclusiveProvider restricts RegisteredProviders to a single provider key when set. Plugins use this to take over front-door authentication exclusively (for example when a plugin installs a higher-priority credential verifier). Passing an unknown type is harmless: RegisteredProviders falls back to the full ordered list when the exclusive entry is missing.
func StableIndex ¶
StableIndex returns the stable access index for provider and principal.
func UnregisterProvider ¶
func UnregisterProvider(typ string)
UnregisterProvider removes a provider by type identifier.
Types ¶
type AccessConfig ¶
type AccessConfig struct {
// Providers lists configured authentication providers.
Providers []AccessProvider `yaml:"providers,omitempty" json:"providers,omitempty"`
}
AccessConfig groups request authentication providers.
type AccessProvider ¶
type AccessProvider struct {
// Name is the instance identifier for the provider.
Name string `yaml:"name" json:"name"`
// Type selects the provider implementation registered via the SDK.
Type string `yaml:"type" json:"type"`
// SDK optionally names a third-party SDK module providing this provider.
SDK string `yaml:"sdk,omitempty" json:"sdk,omitempty"`
// APIKeys lists inline keys for providers that require them.
APIKeys []string `yaml:"api-keys,omitempty" json:"api-keys,omitempty"`
// Config passes provider-specific options to the implementation.
Config map[string]any `yaml:"config,omitempty" json:"config,omitempty"`
}
AccessProvider describes a request authentication provider entry.
func MakeInlineAPIKeyProvider ¶
func MakeInlineAPIKeyProvider(keys []string) *AccessProvider
MakeInlineAPIKeyProvider constructs an inline API key provider configuration. It returns nil when no keys are supplied.
type AuthError ¶
type AuthError struct {
Code AuthErrorCode
Message string
StatusCode int
Cause error
}
AuthError carries authentication failure details and HTTP status.
func NewInternalAuthError ¶
func NewInvalidCredentialError ¶
func NewInvalidCredentialError() *AuthError
func NewNoCredentialsError ¶
func NewNoCredentialsError() *AuthError
func NewNotHandledError ¶
func NewNotHandledError() *AuthError
func (*AuthError) HTTPStatusCode ¶
HTTPStatusCode returns a safe fallback for missing status codes.
type AuthErrorCode ¶
type AuthErrorCode string
AuthErrorCode classifies authentication failures.
const ( AuthErrorCodeNoCredentials AuthErrorCode = "no_credentials" AuthErrorCodeInvalidCredential AuthErrorCode = "invalid_credential" AuthErrorCodeNotHandled AuthErrorCode = "not_handled" AuthErrorCodeInternal AuthErrorCode = "internal_error" )
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager coordinates authentication providers.
func (*Manager) Authenticate ¶
Authenticate evaluates providers until one succeeds.
func (*Manager) SetProviders ¶
SetProviders replaces the active provider list.
type Provider ¶
type Provider interface {
Identifier() string
Authenticate(ctx context.Context, r *http.Request) (*Result, *AuthError)
}
Provider validates credentials for incoming requests.
func RegisteredProviders ¶
func RegisteredProviders() []Provider
RegisteredProviders returns the global provider instances in registration order. When a plugin has installed an exclusive provider via SetExclusiveProvider and that provider is still registered, only that provider is returned.
Source Files