Help us shape the future of Go! Take the 2026 Go Developer Survey

hooks

package
v1.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 7, 2026 License: AGPL-3.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

View Source
const (
	GrantTypeClientCredentials string = "client_credentials"
	GrantTypeJWTBearer         string = "urn:ietf:params:oauth:grant-type:jwt-bearer"
)

Variables

View Source
var ErrTooBusy = errors.New("worker pool is full")

ErrTooBusy is returned by ProcessRequest when the worker pool queue is full.

Functions

This section is empty.

Types

type API

type API struct {
	// contains filtered or unexported fields
}

func NewAPI

func NewAPI(
	service ServiceInterface,
	middleware *AuthMiddleware,
	tracer tracing.TracingInterface,
	monitor monitoring.MonitorInterface,
	logger logging.LoggerInterface,
) *API

NewAPI creates a new API handler for the Hydra token hook endpoint.

func (*API) RegisterEndpoints

func (a *API) RegisterEndpoints(mux *chi.Mux)

RegisterEndpoints registers the Hydra token hook endpoint on the given router.

type AuthMiddleware

type AuthMiddleware struct {
	// contains filtered or unexported fields
}

func NewAuthMiddleware

func NewAuthMiddleware(token string, tracer tracing.TracingInterface, logger logging.LoggerInterface) *AuthMiddleware

func (*AuthMiddleware) AuthMiddleware

func (m *AuthMiddleware) AuthMiddleware(next http.Handler) http.Handler

type AuthorizerInterface added in v1.0.2

type AuthorizerInterface interface {
	CanAccess(context.Context, string, string, []string) (bool, error)
	BatchCanAccess(context.Context, string, []string, []string) (bool, error)
}

type ClientInterface

type ClientInterface interface {
	FetchUserGroups(context.Context, User) ([]*types.Group, error)
}

type ConsentRequestSessionData added in v1.4.1

type ConsentRequestSessionData struct {
	AccessToken map[string]interface{} `json:"access_token"`
	IDToken     map[string]interface{} `json:"id_token"`
}

ConsentRequestSessionData contains the enriched session claims for access and ID tokens.

type DatabaseInterface added in v1.0.2

type DatabaseInterface interface {
	GetGroupsForUser(context.Context, string) ([]*types.Group, error)
}

type DefaultSession added in v1.4.1

type DefaultSession struct {
	Subject string         `json:"subject"`
	Claims  *IDTokenClaims `json:"id_token_claims"`
}

DefaultSession represents OpenID Connect session data.

func (*DefaultSession) IDTokenClaims added in v1.4.1

func (d *DefaultSession) IDTokenClaims() *IDTokenClaims

IDTokenClaims returns the claims pointer, initializing it if nil.

type HookContext added in v1.3.0

type HookContext struct {
	// Groups is the list of groups the user belongs to.
	Groups []*types.Group
	// TenantID is the tenant the request is scoped to, or empty if none.
	TenantID string
}

HookContext contains the enriched result of processing an OAuth token hook request. It is returned by ProcessRequest on success.

type IDTokenClaims added in v1.4.1

type IDTokenClaims struct {
	Subject  string                 `json:"sub,omitempty"`
	Issuer   string                 `json:"iss,omitempty"`
	Audience []string               `json:"aud,omitempty"`
	JTI      string                 `json:"jti,omitempty"`
	Extra    map[string]interface{} `json:"ext,omitempty"`
}

IDTokenClaims represents the claims inside an ID token.

func (*IDTokenClaims) ToMap added in v1.4.1

func (c *IDTokenClaims) ToMap() map[string]interface{}

ToMap returns a map representation of the ID token claims for inclusion in token session.

func (*IDTokenClaims) UnmarshalJSON added in v1.4.1

func (c *IDTokenClaims) UnmarshalJSON(data []byte) error

UnmarshalJSON implements json.Unmarshaler to handle both "ext" and "extra" keys.

type Request added in v1.4.1

type Request struct {
	ClientID        string              `json:"client_id"`
	RequestedScopes []string            `json:"requested_scopes"`
	GrantedScopes   []string            `json:"granted_scopes"`
	GrantedAudience []string            `json:"granted_audience"`
	GrantTypes      []string            `json:"grant_types"`
	Payload         map[string][]string `json:"payload"`
}

Request is the OAuth 2.0 request context within a TokenHookRequest.

type Service

type Service struct {
	// contains filtered or unexported fields
}

func (*Service) AuthorizeRequest added in v1.0.2

func (s *Service) AuthorizeRequest(
	ctx context.Context,
	user User,
	req TokenHookRequest,
	groups []*types.Group,
) (bool, error)

This implements deny by default TODO: we should make this configurable

func (*Service) FetchUserGroups

func (s *Service) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)

func (*Service) ProcessRequest added in v1.3.0

func (s *Service) ProcessRequest(ctx context.Context, user User, req TokenHookRequest) (*HookContext, error)

ProcessRequest orchestrates an OAuth token hook request. FetchUserGroups and (when a tenant is present) ValidateMembership are dispatched to the worker pool concurrently. AuthorizeRequest is gated only on FetchUserGroups, so tenant validation proceeds in parallel with authorization. Returns ErrTooBusy when the pool queue is full; all other errors indicate an authorization failure.

type ServiceInterface

type ServiceInterface interface {
	ProcessRequest(context.Context, User, TokenHookRequest) (*HookContext, error)
}

type Session added in v1.4.1

type Session struct {
	Extra          map[string]interface{} `json:"extra"`
	ClientID       string                 `json:"client_id"`
	DefaultSession *DefaultSession        `json:"id_token"`
}

Session represents the session data sent in the token hook request.

func (*Session) IDTokenClaims added in v1.4.1

func (s *Session) IDTokenClaims() *IDTokenClaims

IDTokenClaims returns the claims container from DefaultSession, if present.

func (*Session) UnmarshalJSON added in v1.4.1

func (s *Session) UnmarshalJSON(data []byte) error

UnmarshalJSON implements json.Unmarshaler to handle both id_token and camelCase idToken.

type StorageHookGroupsClient added in v1.0.2

type StorageHookGroupsClient struct {
	// contains filtered or unexported fields
}

func NewLocalStorageClient added in v1.0.2

NewLocalStorageClient creates a new StorageHookGroupsClient.

func (*StorageHookGroupsClient) FetchUserGroups added in v1.0.2

func (c *StorageHookGroupsClient) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)

FetchUserGroups retrieves user groups from the local storage database.

type TenantValidatorInterface added in v1.3.0

type TenantValidatorInterface interface {
	ValidateMembership(ctx context.Context, identityID, tenantID string) error
}

TenantValidatorInterface validates that a user is an active member of a tenant. See internal/tenants for the real and noop implementations.

type TokenHookRequest added in v1.4.1

type TokenHookRequest struct {
	Session *Session `json:"session"`
	Request Request  `json:"request"`
}

TokenHookRequest is the request body sent to the Ory Hydra token hook.

type TokenHookResponse added in v1.4.1

type TokenHookResponse struct {
	Session ConsentRequestSessionData `json:"session"`
}

TokenHookResponse is the response body returned to the Ory Hydra token hook.

type User

type User struct {
	SubjectId string
	ClientId  string
	Email     string
}

func NewUserFromHookRequest

func NewUserFromHookRequest(r *TokenHookRequest, logger logging.LoggerInterface) *User

func (*User) GetUserId

func (u *User) GetUserId() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL