README
¶
authaction-go-sdk
AuthAction JWT verification SDK for Go. Works with net/http, Gin, Echo, and any other Go HTTP framework.
Installation
go get github.com/authaction/authaction-go-sdk
Quick start
import authaction "github.com/authaction/authaction-go-sdk"
client, err := authaction.New(authaction.Config{
Domain: "your-tenant.eu.authaction.com",
Audience: "https://api.your-app.com",
})
if err != nil {
log.Fatal(err)
}
payload, err := client.VerifyToken(ctx, tokenString)
if err != nil {
log.Fatal(err)
}
fmt.Println(payload.Sub)
net/http middleware
mux := http.NewServeMux()
mux.Handle("/api/", client.Middleware()(apiHandler))
http.ListenAndServe(":8080", mux)
func apiHandler(w http.ResponseWriter, r *http.Request) {
payload, _ := authaction.TokenFromContext(r.Context())
fmt.Fprintln(w, payload.Sub)
}
Gin
r := gin.Default()
r.Use(authaction.GinMiddleware(client))
r.GET("/protected", func(c *gin.Context) {
payload, _ := authaction.TokenFromGin(c)
c.JSON(200, gin.H{"sub": payload.Sub})
})
Echo
e := echo.New()
e.Use(authaction.EchoMiddleware(client))
e.GET("/protected", func(c echo.Context) error {
payload, _ := authaction.TokenFromEcho(c)
return c.JSON(200, map[string]string{"sub": payload.Sub})
})
Error handling
payload, err := client.VerifyToken(ctx, tokenString)
switch {
case errors.Is(err, authaction.ErrTokenExpired):
// token expired
case errors.Is(err, authaction.ErrTokenMissing):
// no token in request
case errors.Is(err, authaction.ErrTokenInvalid):
// bad signature, issuer, or audience
}
License
MIT
Documentation
¶
Overview ¶
Package authaction provides JWT verification for AuthAction access tokens.
Installation ¶
go get github.com/authaction/authaction-go-sdk
Basic usage ¶
client, err := authaction.New(authaction.Config{
Domain: "your-tenant.eu.authaction.com",
Audience: "https://api.your-app.com",
})
if err != nil {
log.Fatal(err)
}
payload, err := client.VerifyToken(ctx, tokenString)
if err != nil {
log.Fatal(err)
}
fmt.Println(payload.Sub)
net/http middleware ¶
mux := http.NewServeMux()
mux.Handle("/api/", client.Middleware()(apiHandler))
http.ListenAndServe(":8080", mux)
// Read token in handlers
func apiHandler(w http.ResponseWriter, r *http.Request) {
payload, _ := authaction.TokenFromContext(r.Context())
fmt.Fprintln(w, payload.Sub)
}
Gin middleware ¶
r := gin.Default()
r.Use(authaction.GinMiddleware(client))
r.GET("/protected", func(c *gin.Context) {
payload, _ := authaction.TokenFromGin(c)
c.JSON(200, gin.H{"sub": payload.Sub})
})
Echo middleware ¶
e := echo.New()
e.Use(authaction.EchoMiddleware(client))
e.GET("/protected", func(c echo.Context) error {
payload, _ := authaction.TokenFromEcho(c)
return c.JSON(200, map[string]string{"sub": payload.Sub})
})
Error handling ¶
payload, err := client.VerifyToken(ctx, tokenString)
switch {
case errors.Is(err, authaction.ErrTokenExpired):
// token expired
case errors.Is(err, authaction.ErrTokenMissing):
// no token in request
case errors.Is(err, authaction.ErrTokenInvalid):
// bad signature, issuer, or audience
}
Index ¶
Constants ¶
This section is empty.
Variables ¶
ErrJWKSUnavailable is returned when the JWKS endpoint cannot be reached and no cached keys are available.
var ErrTokenExpired = errors.New("authaction: token expired")
ErrTokenExpired is returned when the JWT exp claim is in the past.
var ErrTokenInvalid = errors.New("authaction: token invalid")
ErrTokenInvalid is returned when the JWT signature, issuer, audience, or structure is invalid.
var ErrTokenMissing = errors.New("authaction: token missing")
ErrTokenMissing is returned when no Bearer token is present in the request.
Functions ¶
func WithClaims ¶
func WithClaims(ctx context.Context, claims *TokenPayload) context.Context
WithClaims returns a copy of ctx carrying the verified token payload. Called by the middleware after successful token verification.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client verifies AuthAction JWT access tokens using JWKS.
func New ¶
New creates a Client from the provided Config. Returns an error when Domain or Audience is empty.
func (*Client) VerifyRequest ¶
VerifyRequest extracts the Bearer token from r's Authorization header and verifies it. Returns ErrTokenMissing when the header is absent or malformed.
func (*Client) VerifyToken ¶
VerifyToken parses and validates a raw JWT string.
Checks: RS256 algorithm, issuer, audience, and expiry. Returns ErrTokenExpired, ErrTokenInvalid, or ErrJWKSUnavailable on failure.
type Config ¶
type Config struct {
// Domain is the AuthAction tenant domain, e.g. "acme.eu.authaction.com".
Domain string
// Audience is the API identifier (audience claim) registered in AuthAction.
Audience string
// JWKSCacheTTL controls how long signing keys are cached. Default: 1 hour.
JWKSCacheTTL time.Duration
// HTTPClient is used to fetch the JWKS endpoint.
// Defaults to a client with a 10-second timeout.
HTTPClient *http.Client
}
Config holds the settings for the AuthAction JWT verifier.
type TokenPayload ¶
type TokenPayload struct {
// Sub is the subject — the user or M2M client identifier.
Sub string
// Iss is the token issuer.
Iss string
// Aud contains the audience values (may be one or many).
Aud []string
// Exp is the expiry time (Unix seconds).
Exp int64
// Iat is the issued-at time (Unix seconds).
Iat int64
// Scope is the space-separated list of granted OAuth2 scopes.
Scope string
// Extra holds any additional claims not covered by the standard fields above.
Extra map[string]interface{}
}
TokenPayload holds the verified claims from an AuthAction JWT access token.
func ClaimsFromContext ¶
func ClaimsFromContext(ctx context.Context) (*TokenPayload, bool)
ClaimsFromContext retrieves the verified token payload attached by middleware. Returns (nil, false) when no claims are present in ctx.
func (*TokenPayload) HasScope ¶
func (p *TokenPayload) HasScope(scope string) bool
HasScope reports whether the token payload includes the given scope.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package authactionecho provides Echo middleware for AuthAction JWT verification.
|
Package authactionecho provides Echo middleware for AuthAction JWT verification. |
|
Package authactiongin provides Gin middleware for AuthAction JWT verification.
|
Package authactiongin provides Gin middleware for AuthAction JWT verification. |