Documentation
¶
Overview ¶
Package authorizationhttp provides fail-closed net/http authorization integration. NewHandler grants only a valid explicit Allow; it does not verify credentials or fetch resource/tenant facts. Authorizers, mappers, handlers and options are borrowed synchronous code; panics/blocking calls are not contained. Default responses contain no cause text, but context helpers expose raw local failures/decision slices. No background worker or handler shutdown is owned.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrNilAuthorizer reports that NewHandler received no authorizer. ErrNilAuthorizer = errors.New("HTTP authorization authorizer is nil") // ErrNilRequestMapper reports that NewHandler received no request mapper. ErrNilRequestMapper = errors.New("HTTP authorization request mapper is nil") // ErrNilNextHandler reports that NewHandler received no downstream handler. ErrNilNextHandler = errors.New("HTTP authorization next handler is nil") )
Functions ¶
func DecisionFromContext ¶
func DecisionFromContext(ctx context.Context) (authorization.Decision, bool)
DecisionFromContext returns the decision attached for denied or allowed downstream handling.
func ErrorFromContext ¶
ErrorFromContext returns the local failure attached for a configured error handler.
func NewHandler ¶
func NewHandler( authorizer Authorizer, mapper RequestMapper, next http.Handler, handlerOptions ...Option, ) (http.Handler, error)
NewHandler constructs fail-closed authorization middleware around next. Only Allow reaches next; denial/failure handlers receive local context state. Dependencies are literal-nil checked only; typed nils/custom options can panic. Concurrent requests require reusable borrowed callbacks/handlers. Context values contain shared decision slices/raw errors, not sanitized public diagnostics.
Types ¶
type Authorizer ¶
type Authorizer interface {
// Decide returns a valid outcome or error; map errors to failure, never allow.
Decide(context.Context, authorization.Request) (authorization.Decision, error)
}
Authorizer decides whether a mapped HTTP request may reach its downstream handler.
type Option ¶
type Option func(*options)
Option configures HTTP authorization failure handling.
func WithDeniedHandler ¶
WithDeniedHandler replaces the handler used for valid non-allow decisions. A nil handler leaves the default HTTP 403 response unchanged.
func WithErrorHandler ¶
WithErrorHandler replaces the handler used for mapping, evaluation, and invalid-outcome failures. A nil handler leaves the default HTTP 500 response unchanged.
type RequestMapper ¶
type RequestMapper func(*http.Request) (authorization.Request, error)
RequestMapper maps an HTTP request to the transport-neutral authorization request.
Source Files