Documentation
¶
Overview ¶
package: auth / authn type: interface + factory + dispatcher job: the Auth port — a credential in, a Principal out — plus factory and dispatcher limits: identity only; authority is access's, checking the backends' (-> internal/core/access)
The port settles who the caller is, never what they may do.
A Set dispatches on the scheme presented: one credential routes to its backend, none falls back to NoAuth, more than one is ambiguous — never guessed from the bytes.
Index ¶
Constants ¶
const ( SchemeNone = "" // NoAuth: no credential presented SchemeAPIKey = "apikey" // an API key (e.g. X-API-Key) SchemeBearer = "bearer" // a JWT bearer token SchemeMacaroon = "macaroon" // a macaroon )
Well-known credential schemes: a backend reports its own via Scheme(), an endpoint tags each credential with the same string, and the empty scheme is NoAuth.
Variables ¶
var ErrAmbiguousCredentials = errors.New("auth: ambiguous credentials")
ErrAmbiguousCredentials reports more than one auth scheme on one request. An endpoint raises it while extracting, before core runs, and maps it to 400.
var ErrUnauthenticated = autherr.ErrUnauthenticated
ErrUnauthenticated reports that a credential was required but missing or invalid — an endpoint maps it to 401. The value lives in autherr, which a backend returns directly to avoid importing this package back (auth.go already imports it to dispatch New); this is that same value under the name callers outside auth use.
Functions ¶
This section is empty.
Types ¶
type Auth ¶
type Auth interface {
// Authenticate resolves token to a Principal, or returns ErrUnauthenticated.
// NoAuth ignores the token and returns its configured account.
Authenticate(ctx context.Context, token string) (access.Principal, error)
// Scheme reports which Scheme* constant this backend consumes.
Scheme() string
}
Auth authenticates one credential scheme. Backends: NoAuth, JWT, API key, Macaroon (-> sub-packages).
type Credential ¶
Credential is one authentication token an endpoint extracted from a request, tagged with the scheme it was presented under.
type Set ¶
type Set struct {
// contains filtered or unexported fields
}
Set is the configured authenticators indexed by scheme, plus the optional NoAuth fallback. It is what an endpoint hands a request's credentials to.
func NewSet ¶
NewSet indexes the backends by scheme, rejecting two backends that claim the same scheme (an endpoint could not route between them).
func (*Set) Authenticate ¶
Authenticate routes one credential by scheme; a zero value falls back to NoAuth, and neither found is ErrUnauthenticated.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
package: apikey / authn type: adapter job: authenticate a request by matching its API key against configured account keys limits: recognises keys, never mints them; holds digests only (-> auth.New, internal/core/access)
|
package: apikey / authn type: adapter job: authenticate a request by matching its API key against configured account keys limits: recognises keys, never mints them; holds digests only (-> auth.New, internal/core/access) |
|
apikeytest
package: apikeytest / authn type: test-support job: the apikey backend's conformance setup hook, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth)
|
package: apikeytest / authn type: test-support job: the apikey backend's conformance setup hook, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth) |
|
package: autherr / authn type: errors job: the auth port's rejection sentinel, held where every backend can return it limits: one error value; auth.go re-exports it as auth.ErrUnauthenticated (-> auth.go)
|
package: autherr / authn type: errors job: the auth port's rejection sentinel, held where every backend can return it limits: one error value; auth.go re-exports it as auth.ErrUnauthenticated (-> auth.go) |
|
package: jwt / authn type: adapter (JWKS key source) job: fetch and refresh a JSON Web Key Set — the key source for a rotating issuer limits: the only network access in this backend; Authenticate only reads the cached set
|
package: jwt / authn type: adapter (JWKS key source) job: fetch and refresh a JSON Web Key Set — the key source for a rotating issuer limits: the only network access in this backend; Authenticate only reads the cached set |
|
jwttest
package: jwttest / authn type: test-support job: the jwt backend's conformance setup hook and token fixtures, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth)
|
package: jwttest / authn type: test-support job: the jwt backend's conformance setup hook and token fixtures, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth) |
|
package: macaroon / authn type: adapter job: authenticate a macaroon, translating its caveats into attenuated grants limits: verification only — this server never mints or attenuates one (-> auth.New)
|
package: macaroon / authn type: adapter job: authenticate a macaroon, translating its caveats into attenuated grants limits: verification only — this server never mints or attenuates one (-> auth.New) |
|
macaroontest
package: macaroontest / authn type: test-support job: the macaroon backend's conformance setup hook, and a minting helper for fixtures limits: a test helper; only tests import it — this server never mints a macaroon itself
|
package: macaroontest / authn type: test-support job: the macaroon backend's conformance setup hook, and a minting helper for fixtures limits: a test helper; only tests import it — this server never mints a macaroon itself |
|
package: noauth / authn type: adapter job: authenticate every request as one fixed subject — the no-auth backend limits: no credential checking; for single-tenant/dev stacks (-> auth.New)
|
package: noauth / authn type: adapter job: authenticate every request as one fixed subject — the no-auth backend limits: no credential checking; for single-tenant/dev stacks (-> auth.New) |
|
noauthtest
package: noauthtest / authn type: test-support job: the noauth backend's conformance setup hook, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth)
|
package: noauthtest / authn type: test-support job: the noauth backend's conformance setup hook, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth) |