middleware

func AuthenticateAny ¶ added in v0.4.0

func AuthenticateAny(guard string, tokens *services.APITokens, users repositories.UsersRepository, requiredScopes ...string) contractshttp.Middleware

AuthenticateAny uses bearer authentication whenever an Authorization header is present and otherwise falls back to the normal Authkit session guard. It never silently accepts a session after a malformed or invalid bearer token.

func Authenticated ¶

func Authenticated(guard string, users repositories.UsersRepository) contractshttp.Middleware

Authenticated guards routes behind the named session guard. It:

1. resolves the session's user id (401 on no session) and loads the user from the instance's table (401 on a deleted user),
2. compares the login-stamped password_changed_at with the DB value — a mismatch means the password changed after this session was issued, so this (older) session is logged out (401),
3. injects the user id into the request context (helpers.CtxAuthUserID).

func BearerAuthenticated ¶ added in v0.4.0

func BearerAuthenticated(guard string, tokens *services.APITokens, users repositories.UsersRepository, requiredScopes ...string) contractshttp.Middleware

BearerAuthenticated authenticates an opaque Authkit API token and optionally requires token scopes. Live user state is checked on every request, so deleting or disabling the owner immediately denies the token.

func DefaultRateLimitStore ¶ added in v0.4.0

func DefaultRateLimitStore() authcontracts.RateLimitStore

DefaultRateLimitStore returns the shared process-local fallback store.

func FormatPasswordTimestamp ¶

func FormatPasswordTimestamp(t time.Time) string

FormatPasswordTimestamp renders a password_changed_at value in the canonical form stored in the session. Exported so the login handler stamps it in the same format Authenticated compares against.

func RateLimitByIP ¶ added in v0.4.0

func RateLimitByIP(limiter *AttemptLimiter, attempts int) contractshttp.Middleware

RateLimitByIP applies the guard's IP bucket before the endpoint handler.

func RejectWhileImpersonating ¶ added in v0.3.0

func RejectWhileImpersonating(guard string) contractshttp.Middleware

RejectWhileImpersonating blocks an action when the session under guard is an impersonated one. It guards the credential- and privilege-sensitive routes (password change, user management, and starting another impersonation) so an actor acting "as" a user cannot change that user's password, manage users, or chain into a nested impersonation. It is a no-op for ordinary sessions.

func RememberLogin ¶

func RememberLogin(guard, rememberCookieName string, users repositories.UsersRepository, remember *services.Remember, audit *services.Audit, sessions *services.Sessions) contractshttp.Middleware

RememberLogin re-establishes a session from a valid "remember me" cookie when the request has no live session. It must run BEFORE Authenticated (so the freshly-logged-in user is seen) and only matters on guarded routes. When the cookie is missing, already-authenticated, or invalid it is a transparent no-op (invalid cookies are cleared). On success it logs the user in via the native session guard, stamps password_changed_at, rotates the session id, re-issues the rotated remember cookie, and audits the silent login. A disabled account is refused and its remember tokens revoked. Pass a nil audit to skip the audit write.

func RequireRole ¶

func RequireRole(guard string, users repositories.UsersRepository, allowed ...string) contractshttp.Middleware

RequireRole rejects authenticated users whose role is not in allowed. It must run AFTER Authenticated. The /users routes are always mounted with a non-empty allow-list (defaulting to "admin", fail-closed), so this gate is real for them. An empty allowed list is a defensive no-op; callers should never pass one for a route that must be protected.

func TrackSession ¶

func TrackSession(guard string, sessions *services.Sessions) contractshttp.Middleware

TrackSession enforces the active-session list: it refreshes the current session's last-active time and, when the row is gone, treats the session as terminated (signs it out). It must run AFTER Authenticated (a live session is assumed). Rows are created at login, not here — so a missing row means the session was terminated remotely (or predates the feature). A DB error fails open so a transient outage doesn't lock everyone out.

func UnlessBearer ¶ added in v0.4.0

func UnlessBearer(inner contractshttp.Middleware, signature string) contractshttp.Middleware

UnlessBearer runs inner only when no Authorization header is present. It is used by hybrid routes to keep bearer requests stateless while preserving the normal session and CSRF middleware for browser requests.

func VerifyRequestOrigin ¶ added in v0.4.0

func VerifyRequestOrigin(trustedOrigins []string) contractshttp.Middleware

VerifyRequestOrigin rejects state-changing browser requests that do not come from the request host or an explicitly trusted origin. Missing origin signals fail closed; non-browser clients must send Origin as well.