Documentation
¶
Overview ¶
Package auth enforces the gateway's bearer token/API key allow-list on every ingress HTTP request, per spec.md §5.4 and the FEATURE-019 acceptance criterion: a request without a valid token is rejected before it ever reaches MCP session handling, let alone a backend.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Middleware ¶
Middleware wraps next with cfg's bearer/API-key check. If cfg.Enabled is false it returns next unchanged — auth is opt-in, per spec.md §7's auth.enabled field. Otherwise, every request's cfg.Header value (with a leading "Bearer " scheme stripped, if present, for the Authorization header's usual convention) is compared against cfg.Tokens using a constant-time comparison, so response timing can't be used to probe valid tokens; anything not on the list gets codeUnauthorized before next ever runs.
Types ¶
This section is empty.
Source Files