Documentation
¶
Overview ¶
Package authkit provides scoped inbound bearer-token validation for services that need Windmill-callable HTTP or gRPC endpoints.
Index ¶
- Constants
- func ContextWithPrincipal(ctx context.Context, p *Principal) context.Context
- func HTTPMiddleware(verifier *StaticVerifier, requiredScopes ...string) func(http.Handler) http.Handler
- func StreamServerInterceptor(verifier *StaticVerifier, requiredScopes ...string) grpc.StreamServerInterceptor
- func UnaryServerInterceptor(verifier *StaticVerifier, requiredScopes ...string) grpc.UnaryServerInterceptor
- type Key
- type Principal
- type StaticVerifier
Constants ¶
const (
DefaultEnvVar = "CHASSIS_AUTHKIT_KEYS"
)
Variables ¶
This section is empty.
Functions ¶
func ContextWithPrincipal ¶
ContextWithPrincipal returns a child context containing p.
func HTTPMiddleware ¶
func HTTPMiddleware(verifier *StaticVerifier, requiredScopes ...string) func(http.Handler) http.Handler
HTTPMiddleware authenticates HTTP requests before invoking next.
func StreamServerInterceptor ¶
func StreamServerInterceptor(verifier *StaticVerifier, requiredScopes ...string) grpc.StreamServerInterceptor
StreamServerInterceptor authenticates gRPC streaming calls.
func UnaryServerInterceptor ¶
func UnaryServerInterceptor(verifier *StaticVerifier, requiredScopes ...string) grpc.UnaryServerInterceptor
UnaryServerInterceptor authenticates gRPC unary calls.
Types ¶
type Key ¶
Key describes one static bearer credential and the scopes it grants.
func LoadStaticKeysFromEnv ¶
LoadStaticKeysFromEnv parses CHASSIS_AUTHKIT_KEYS by default. The format is:
key-id=scrypt$N$r$p$salt_b64$derived_key_b64:scope1,scope2;other=...
func ParseStaticKeys ¶
ParseStaticKeys parses the static key environment format.
type StaticVerifier ¶
type StaticVerifier struct {
// contains filtered or unexported fields
}
StaticVerifier verifies token strings in the form <key-id>.<secret> against stored scrypt hashes.
func MustStaticVerifier ¶
func MustStaticVerifier(keys []Key) *StaticVerifier
MustStaticVerifier is like NewStaticVerifier but panics on invalid keys.
func NewStaticVerifier ¶
func NewStaticVerifier(keys []Key) (*StaticVerifier, error)
NewStaticVerifier builds a verifier from static key records.
func (*StaticVerifier) VerifyBearer ¶
func (v *StaticVerifier) VerifyBearer(ctx context.Context, authorization string, requiredScopes ...string) (*Principal, error)
VerifyBearer validates an Authorization header value and returns a principal.
Source Files