middleware

func AuthMiddleware ¶

func AuthMiddleware(keyRing *jwtpkg.KeyRing, expectedTenant string) func(http.Handler) http.Handler

AuthMiddleware verifies JWT Bearer tokens on non-exempt paths and injects the authenticated user ID into the X-Authenticated-User-Id request header so downstream Connect handlers can read it.

expectedTenant, when non-empty, is enforced on every verified token: tokens whose "tenant" claim does not match are rejected. Pass an empty string to disable the cross-tenant check.

For auth-exempt paths the middleware still attempts to parse and verify a token when one is present (e.g. GetCurrentUser may optionally read the caller identity) but never rejects the request.

func CORSMiddleware ¶

func CORSMiddleware(allowedOrigins string) func(http.Handler) http.Handler

CORSMiddleware handles CORS preflight requests and injects the appropriate response headers for allowed origins.

allowedOrigins is a comma-separated list of origins (e.g. "http://localhost:9002,http://localhost:3000").

func HealthMiddleware ¶

func HealthMiddleware(next http.Handler) http.Handler

HealthMiddleware handles /health, /healthz, and / before the request reaches the Connect handler. This keeps health probes (e.g. Azure Container Apps) cheap and independent of service readiness.

func JWKSMiddleware ¶

func JWKSMiddleware(keyRing *jwtpkg.KeyRing) func(http.Handler) http.Handler

JWKSMiddleware serves the /.well-known/jwks.json endpoint from the key ring. The response contains the RSA public keys for all keys in the ring so that third-party services can verify tokens without sharing a secret.

func LoggingMiddleware ¶

func LoggingMiddleware(logger *zap.Logger) func(http.Handler) http.Handler

LoggingMiddleware logs every request's method, path, response status code, duration, and remote address using the provided zap logger.