auth

type APIKeyStrategy ¶ added in v0.39.0

type APIKeyStrategy struct {
	// contains filtered or unexported fields
}

APIKeyStrategy implements api.AuthStrategy for static API key authentication: the request presents a key in a header (HeaderXAPIKey by default, overridable per operation via api.APIKeyAuth(header)) and the strategy resolves it through the security.APIKeyLoader.

Every authentication failure denies with security.ErrAPIKeyInvalid (fail closed) and configuration faults are additionally logged server-side, so the 401 stays opaque to the caller. Loader errors propagate as-is: an unavailable backing store is an infrastructure fault, not a credential rejection.

func (s *APIKeyStrategy) Authenticate(ctx fiber.Ctx, options map[string]any) (*security.Principal, error)

func (*APIKeyStrategy) Name() string

type AccessTokenAuthenticator ¶

type AccessTokenAuthenticator struct {
	// contains filtered or unexported fields
}

AccessTokenAuthenticator delegates incoming API-token authentication to the security.AuthManager, dispatching the deployment's configured token mechanism (jwt_token or opaque_token) so the matching authenticator handles it.

func (a *AccessTokenAuthenticator) Authenticate(ctx context.Context, token string) (*security.Principal, error)

type BearerStrategy ¶

type BearerStrategy struct {
	// contains filtered or unexported fields
}

BearerStrategy implements api.AuthStrategy for Bearer token authentication.

func (s *BearerStrategy) Authenticate(ctx fiber.Ctx, _ map[string]any) (*security.Principal, error)

func (*BearerStrategy) Name() string

type HTTPBasicStrategy ¶ added in v0.39.0

type HTTPBasicStrategy struct {
	// contains filtered or unexported fields
}

HTTPBasicStrategy implements api.AuthStrategy for HTTP Basic authentication (RFC 7617): the request presents "Authorization: Basic base64(user:pass)" and the strategy resolves the username through the security.BasicAccountLoader, comparing the stored secret in constant time.

Every authentication failure denies with security.ErrBasicCredentialsInvalid (fail closed) without revealing whether the username or the password was wrong. Loader errors propagate as-is: an unavailable backing store is an infrastructure fault, not a credential rejection.

func (s *HTTPBasicStrategy) Authenticate(ctx fiber.Ctx, _ map[string]any) (*security.Principal, error)

func (*HTTPBasicStrategy) Name() string

type IPStrategy ¶ added in v0.34.0

type IPStrategy struct {
	// contains filtered or unexported fields
}

IPStrategy implements api.AuthStrategy for source-IP whitelist authentication: the client IP is the credential. An operation opts in with api.IPAuth(name); the strategy resolves that name through the security.IPWhitelistLoader and matches the Fiber-resolved client IP against the returned entries. The validator is rebuilt per request because loader data may change between requests; loaders needing to amortize expensive lookups cache on their side.

Every authentication failure denies with security.ErrIPNotAllowed (fail closed) and configuration faults are additionally logged server-side, so the 401 stays opaque to the caller. Loader errors propagate as-is: an unavailable backing store is an infrastructure fault, not a credential rejection.

func (s *IPStrategy) Authenticate(ctx fiber.Ctx, options map[string]any) (*security.Principal, error)

func (*IPStrategy) Name() string

type NoneStrategy ¶

type NoneStrategy struct{}

NoneStrategy implements api.AuthStrategy for public endpoints.

func (*NoneStrategy) Authenticate(fiber.Ctx, map[string]any) (*security.Principal, error)

func (*NoneStrategy) Name() string

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry implements api.AuthStrategyRegistry using a concurrent map.

func (r *Registry) Get(name string) (api.AuthStrategy, bool)

func (r *Registry) Names() []string

func (r *Registry) Register(strategy api.AuthStrategy)

type SignatureStrategy ¶

type SignatureStrategy struct {
	// contains filtered or unexported fields
}

SignatureStrategy implements api.AuthStrategy for HMAC signature authentication. It extracts credentials from HTTP headers and delegates authentication to the security.AuthManager, following the Spring Security pattern.

Required headers:

• X-App-ID: Application identifier (used as Principal)
• X-Timestamp: Unix timestamp in seconds
• X-Nonce: Random string for replay attack prevention
• X-Signature: HMAC signature in hex encoding

func (s *SignatureStrategy) Authenticate(ctx fiber.Ctx, _ map[string]any) (*security.Principal, error)

func (*SignatureStrategy) Name() string

type TokenAuthenticator ¶

type TokenAuthenticator interface {
	// Authenticate validates the bearer token and returns the authenticated principal, or an error if invalid.
	Authenticate(ctx context.Context, token string) (*security.Principal, error)
}

TokenAuthenticator validates a token and returns the principal.

func NewAccessTokenAuthenticator(manager security.AuthManager, cfg *config.SecurityConfig) TokenAuthenticator