Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrTenantNotResolved = errors.New("approval: cannot resolve caller tenant from principal")
ErrTenantNotResolved indicates the resolver received a principal whose Details shape doesn't expose a tenant_id / tenantId / TenantID key. The resource layer surfaces this as an authentication failure so a misconfigured host can't accidentally serve cross-tenant data through a zero-value CallerContext.
var Module = fx.Module( "vef:approval:auth", fx.Provide( fx.Annotate( NewDefaultPrincipalTenantResolver, fx.As(new(approval.PrincipalTenantResolver)), ), ), )
Module provides identity-resolution defaults (tenant resolver). Hosts override the resolver via fx.Replace when their principal carries tenant info in a typed struct instead of a generic map.
Functions ¶
func NewDefaultPrincipalTenantResolver ¶
func NewDefaultPrincipalTenantResolver() approval.PrincipalTenantResolver
NewDefaultPrincipalTenantResolver constructs the default resolver.
Types ¶
type DefaultPrincipalTenantResolver ¶
type DefaultPrincipalTenantResolver struct{}
DefaultPrincipalTenantResolver extracts the tenant id from Principal.Details. It handles two common shapes:
- map[string]any (JWT claims deserialized without a typed model) — looks up the candidate keys in order.
- typed struct or pointer to struct — looks up the candidate field names in order via reflection.
Anonymous and system principals (Details == nil) are explicitly recognized: they return an empty tenant without an error so the resource layer can treat them as needing an explicit fallback (e.g. the system caller marker). Authenticated principals whose Details does not expose a tenant return ErrTenantNotResolved — fail-closed.
Source Files