Documentation
¶
Index ¶
Constants ¶
const ( ProviderStatic = "static" // StaticTokenAuthenticator — token-to-principal map ProviderEntra = "entra" // Microsoft Entra ID (Azure AD) — future ProviderPing = "ping" // Ping Identity — future )
Provider constants identify which authentication mechanism issued a Principal. Handlers and audit code can branch on these without importing provider packages.
const ( RolePlatformAdmin = "platform.admin" RolePlatformOperator = "platform.operator" RolePlatformViewer = "platform.viewer" )
Platform domain roles govern access to MIDAS operations.
const ( RoleGovernanceApprover = "governance.approver" RoleGovernanceReviewer = "governance.reviewer" )
Governance domain roles govern workflow participation (approval, review).
const RoleAdmin = "admin"
Deprecated: use RolePlatformAdmin instead.
const RoleApprover = "approver"
Deprecated: use RoleGovernanceApprover instead.
const RoleOperator = "operator"
Deprecated: use RolePlatformOperator instead.
const RoleReviewer = "reviewer"
Deprecated: use RoleGovernanceReviewer instead.
Variables ¶
This section is empty.
Functions ¶
func NormalizeRoles ¶
NormalizeRoles maps legacy role strings to their canonical equivalents, deduplicates, and returns a deterministic sorted slice. Unknown or already-canonical roles are preserved as-is. Normalization is case-insensitive for legacy role lookup.
Types ¶
type Principal ¶
type Principal struct {
ID string // e.g. "user:alice" or an OIDC sub claim
Name string // human-readable display name
Roles []string // e.g. ["approver"], ["admin"]
Provider string // identifies the auth provider; use Provider* constants
Subject string // raw subject claim from the provider (e.g. OIDC sub)
Claims map[string]any // arbitrary provider-specific claims (e.g. JWT payload)
}
Principal represents a verified caller identity. The Provider field indicates which authentication mechanism populated this struct, enabling handlers to apply provider-specific logic without type switches.
func (*Principal) HasAnyRole ¶
HasAnyRole returns true if the principal holds at least one of the given roles. Comparison is case-insensitive, matching the semantics of HasRole.
Source Files