Documentation
¶
Index ¶
- Constants
- func Auth(d AuthDeps) echo.MiddlewareFunc
- func EnforceSessionCSRF(c *echo.Context, expected string) error
- func GetAllowedJobAliases(c *echo.Context) []string
- func GetAuthKey(c *echo.Context) *models.APIKey
- func GetCSRFToken(c *echo.Context) string
- func GetPrincipal(c *echo.Context) *auth.Principal
- func ParseTrustedProxyRanges(raw string) []*net.IPNet
- func ParseTrustedProxyRangesStrict(raw string) ([]*net.IPNet, error)
- func RequestIsSecure(r *http.Request, trustedProxies []*net.IPNet) bool
- type AuthDeps
Constants ¶
const ContextKeyAllowedJobAliases = "auth.allowed_job_aliases"
ContextKeyAllowedJobAliases stores the scoped job aliases available to list endpoints.
const ContextKeyAuth = "auth"
ContextKeyAuth is the key used to store the authenticated API key in the Echo context.
const ContextKeyCSRFToken = "auth.csrf_token"
ContextKeyCSRFToken stores the resolved session's CSRF token for handlers.
const ContextKeyPrincipal = "auth.principal"
ContextKeyPrincipal stores the unified authenticated identity for the request.
Variables ¶
This section is empty.
Functions ¶
func Auth ¶
func Auth(d AuthDeps) echo.MiddlewareFunc
Auth returns Echo middleware that enforces API-key or session-cookie authentication and RBAC.
func EnforceSessionCSRF ¶
EnforceSessionCSRF validates the synchronizer CSRF token for cookie-authenticated unsafe requests. Bearer/API-key requests are exempt at the auth middleware call site because they are not ambient browser credentials.
func GetAllowedJobAliases ¶
GetAllowedJobAliases returns the scoped aliases injected by the auth middleware.
func GetAuthKey ¶
GetAuthKey extracts the authenticated API key from the Echo context. Returns nil if no key is present (e.g. unauthenticated endpoints).
func GetCSRFToken ¶
GetCSRFToken returns the session CSRF token stashed by auth middleware, or "".
func GetPrincipal ¶
GetPrincipal returns the unified authenticated identity, or nil if unauthenticated.
func ParseTrustedProxyRanges ¶
ParseTrustedProxyRanges parses a comma-separated proxy allowlist into IP ranges. Entries may be CIDR ranges or individual IP addresses.
func ParseTrustedProxyRangesStrict ¶
ParseTrustedProxyRangesStrict parses a proxy allowlist and rejects invalid entries. Use it when a proxy list is part of startup security validation.
Types ¶
type AuthDeps ¶
type AuthDeps struct {
Service *auth.Service
Auditor *auth.AuditLogger
Limiter *auth.RateLimiter
Sessions *auth.SessionStore
CookieName string
}
AuthDeps bundles the dependencies the auth middleware needs.
Source Files