auth

package

v0.4.3 Latest Latest Go to latest Published: Nov 27, 2025 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/dployr-io/dployr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth implements authentication primitives and middleware for the daemon's HTTP API. It defines core token validation, claims, and user role handling, with middleware supporting authentication and permission checks for protected endpoints. Concrete authentication logic and helpers are provided within this package.

Index ¶

Variables
func GetCurrentUserSystemRole() (store.Role, error)
func GetUserSystemRole(username string) (store.Role, error)
func IsPermitted(actual, required string) bool
type Authenticator
type Claims
type Middleware
- func NewMiddleware(auth Authenticator) *Middleware
type Role

Constants ¶

This section is empty.

Variables ¶

View Source

var SystemGroupToRole = map[string]store.Role{
	"dployr-owner":  store.RoleOwner,
	"dployr-admin":  store.RoleAdmin,
	"dployr-dev":    store.RoleDeveloper,
	"dployr-viewer": store.RoleViewer,
}

System group to role mapping

Functions ¶

func GetCurrentUserSystemRole ¶

func GetCurrentUserSystemRole() (store.Role, error)

GetCurrentUserSystemRole returns the current user's highest system role

Example: dployr-admin returns store.RoleAdmin

func GetUserSystemRole ¶

func GetUserSystemRole(username string) (store.Role, error)

GetUserSystemRole returns the highest system role for a specific user

func IsPermitted ¶

func IsPermitted(actual, required string) bool

IsPermitted is a public wrapper for checking role permissions.

Types ¶

type Authenticator ¶

type Authenticator interface {
	ValidateToken(ctx context.Context, inputToken string) (*Claims, error)
}

type Claims ¶

type Claims struct {
	Subject    string   `json:"sub,omitempty"`
	InstanceID string   `json:"instance_id,omitempty"`
	Perm       string   `json:"perm,omitempty"` // one of: viewer, developer, admin, owner
	Scopes     []string `json:"scopes,omitempty"`
	ExpiresAt  int64    `json:"exp"`
	IssuedAt   int64    `json:"iat"`
	jwt.RegisteredClaims
}

Claims represents the token structure used across the system

type Middleware ¶

type Middleware struct {
	// contains filtered or unexported fields
}

func NewMiddleware ¶

func NewMiddleware(auth Authenticator) *Middleware

func (*Middleware) Auth ¶

func (m *Middleware) Auth(next http.Handler) http.Handler

func (*Middleware) RequireRole ¶

func (m *Middleware) RequireRole(required string) func(http.Handler) http.Handler

func (*Middleware) Trace ¶

func (m *Middleware) Trace(next http.Handler) http.Handler

type Role ¶

type Role string

const (
	RoleViewer    Role = "viewer"
	RoleDeveloper Role = "developer"
	RoleAdmin     Role = "admin"
	RoleOwner     Role = "owner"
	RoleAgent     Role = "agent" // M2M role for daemon-to-base communication
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL