Documentation
¶
Overview ¶
Package auth checks bearer tokens. Only SHA-256 hashes of the tokens are configured, so the service's settings never hold a usable secret.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnauthenticated = errors.New("auth: missing or unknown token") ErrForbidden = errors.New("auth: token lacks the scope") )
Functions ¶
func Require ¶
func Require(v *Verifier, scope Scope, onError func(w http.ResponseWriter, status int, code, message string), next http.Handler) http.Handler
Require wraps an HTTP handler with a scope check. onError writes the refusal in the service's own error shape.
func StreamInterceptor ¶
func StreamInterceptor(v *Verifier) grpc.StreamServerInterceptor
StreamInterceptor guards the only streams the server has, health watches and reflection: health is open for probes, reflection needs any token so the schema is not handed to anyone who reaches the port.
func UnaryInterceptor ¶
func UnaryInterceptor(v *Verifier, scopes map[string]Scope) grpc.UnaryServerInterceptor
UnaryInterceptor checks the scope each gRPC method needs. A method missing from scopes is refused, so a new RPC cannot ship open by accident.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier holds the configured tokens; one with none lets every call in.
func Load ¶
Load combines inline entries with those in file, so a token can live in a mounted secret. A file that yields no tokens is an error: naming one means auth was meant to be on.
func Parse ¶
Parse reads entries name:scope[+scope]:sha256hex, separated by commas or newlines, for example "ktms:write:9f86d0…,console:read:…". A line starting with # is a comment. Several entries may be active at once for rotation.
Source Files