Documentation
¶
Overview ¶
package: auth / authn type: interface + factory + dispatcher job: the Auth port — a credential in, a Principal out — plus factory and dispatcher limits: identity only; authority is access's, checking the backends' (-> internal/core/access)
The port settles who the caller is, never what they may do.
A Set dispatches on the scheme presented: one credential routes to its backend, none falls back to NoAuth, more than one is ambiguous — never guessed from the bytes.
Index ¶
Constants ¶
const ( SchemeNone = "" // NoAuth: no credential presented SchemeAPIKey = "apikey" // an API key (e.g. X-API-Key) SchemeBearer = "bearer" // a JWT bearer token SchemeMacaroon = "macaroon" // a macaroon )
Well-known credential schemes: a backend reports its own via Scheme(), an endpoint tags each credential with the same string, and the empty scheme is NoAuth.
Variables ¶
var ErrAmbiguousCredentials = errors.New("auth: ambiguous credentials")
ErrAmbiguousCredentials reports more than one auth scheme on one request. An endpoint raises it while extracting, before core runs, and maps it to 400.
var ErrUnauthenticated = errors.New("auth: unauthenticated")
ErrUnauthenticated reports that a credential was required but missing or invalid — an endpoint maps it to 401.
Functions ¶
This section is empty.
Types ¶
type Auth ¶
type Auth interface {
// Authenticate resolves token to a Principal, or returns ErrUnauthenticated.
// NoAuth ignores the token and returns its configured account.
Authenticate(ctx context.Context, token string) (access.Principal, error)
// Scheme reports which Scheme* constant this backend consumes.
Scheme() string
}
Auth authenticates one credential scheme. Backends: NoAuth, JWT, API key, Macaroon (-> sub-packages).
type Credential ¶
Credential is one authentication token an endpoint extracted from a request, tagged with the scheme it was presented under.
type Set ¶
type Set struct {
// contains filtered or unexported fields
}
Set is the configured authenticators indexed by scheme, plus the optional NoAuth fallback. It is what an endpoint hands a request's credentials to.
func NewSet ¶
NewSet indexes the backends by scheme, rejecting two backends that claim the same scheme (an endpoint could not route between them).
func (*Set) Authenticate ¶
Authenticate routes one credential by scheme; a zero value falls back to NoAuth, and neither found is ErrUnauthenticated.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
package: apikey / authn type: adapter job: authenticate a request by matching its API key against configured account keys limits: recognises keys, never mints them; holds digests only (-> auth.New, internal/core/access)
|
package: apikey / authn type: adapter job: authenticate a request by matching its API key against configured account keys limits: recognises keys, never mints them; holds digests only (-> auth.New, internal/core/access) |
|
package: noauth / authn type: adapter job: authenticate every request as one fixed subject — the no-auth backend limits: no credential checking; for single-tenant/dev stacks (-> auth.New)
|
package: noauth / authn type: adapter job: authenticate every request as one fixed subject — the no-auth backend limits: no credential checking; for single-tenant/dev stacks (-> auth.New) |