auth

package

v0.6.0 Latest Latest Go to latest Published: Jun 1, 2026 License: MIT Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/fromforgesoftware/forge

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth provides authentication primitives and middleware components. It supports token abstraction, extraction from HTTP/gRPC requests, validation via Firebase, and context injection.

Key components: - Token: Represents an authentication token with claims. - Authenticator: Validates tokens (currently supports Firebase ID tokens). - TokenExtractor: Extracts tokens from requests (HTTP headers or gRPC metadata). - ContextInjector: Injects validated tokens into the context for usage by services.

Index ¶

Constants
func FxModule() fx.Option
func InjectTokenInCtx(ctx context.Context, token Token) context.Context
func MustOrgID(ctx context.Context) (string, error)
func NewBaseAuthenticator[R any](tokenExtractor TokenExtractor[R], contextInjector ContextInjector, ...) *baseAuthenticator[R]
func NewGrpcAuthenticator(params GrpcAuthenticatorParams) *grpcAuthenticator
func NewGrpcTokenExtractor() *grpcTokenExtractor
func NewHTTPTokenExtractor() *httpTokenExtractor
func NewHttpAuthenticator(tokenExtractor TokenExtractor[*http.Request], contextInjector ContextInjector, ...) *httpAuthenticator
func NewToken(value string, typ TokenType, claims TokenClaims) (*token, error)
func NewTokenContextInjector() *tokenContextInjector
func OrgIDFromCtx(ctx context.Context) (string, bool)
func OrgRoleFromCtx(ctx context.Context) (string, bool)
type ContextInjector
type GrpcAuthenticatorParams
type HmacCredentials
- func NewHmacCredentials(issuer jwt.Issuer) *HmacCredentials
- func (c *HmacCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
- func (c *HmacCredentials) RequireTransportSecurity() bool
type Token
- func TokenFromCtx(ctx context.Context) Token
type TokenClaims
type TokenExtractor
type TokenType
- func (tt TokenType) String() string

Constants ¶

View Source

const (
	AuthorizationHeader = "Authorization"
	BearerPrefix        = "Bearer "
)

View Source

const (
	// SystemAccountID is a fixed UUID for system-internal calls to allow easy identification
	SystemAccountID = "ffffffff-ffff-ffff-ffff-ffffffffffff"
	SystemUsername  = "system"
)

View Source

const (
	ClaimOrgID   = "org_id"
	ClaimOrgRole = "org_role"
)

Active-organization claims carried by the access token (set by the identity service at issuance). Consumers read these to scope tenant data.

Variables ¶

This section is empty.

Functions ¶

func FxModule ¶

func FxModule() fx.Option

func InjectTokenInCtx ¶

func InjectTokenInCtx(ctx context.Context, token Token) context.Context

func MustOrgID ¶ added in v0.6.0

func MustOrgID(ctx context.Context) (string, error)

MustOrgID returns the active organization id or an Unauthorized error when the request carries no active org — the fail-closed default for tenant-scoped repositories.

func NewBaseAuthenticator ¶

func NewBaseAuthenticator[R any](
	tokenExtractor TokenExtractor[R],
	contextInjector ContextInjector,
	firebaseClient firebase.Client,
	hmacValidator jwt.Validator,
) *baseAuthenticator[R]

func NewGrpcAuthenticator ¶

func NewGrpcAuthenticator(params GrpcAuthenticatorParams) *grpcAuthenticator

func NewGrpcTokenExtractor ¶

func NewGrpcTokenExtractor() *grpcTokenExtractor

func NewHTTPTokenExtractor ¶

func NewHTTPTokenExtractor() *httpTokenExtractor

func NewHttpAuthenticator ¶

func NewHttpAuthenticator(
	tokenExtractor TokenExtractor[*http.Request],
	contextInjector ContextInjector,
	firebaseClient firebase.Client,
	hmacValidator jwt.Validator,
) *httpAuthenticator

func NewToken ¶

func NewToken(value string, typ TokenType, claims TokenClaims) (*token, error)

func NewTokenContextInjector ¶

func NewTokenContextInjector() *tokenContextInjector

func OrgIDFromCtx ¶ added in v0.6.0

func OrgIDFromCtx(ctx context.Context) (string, bool)

OrgIDFromCtx returns the active organization id from the request token, and false when no token or no active org is present.

func OrgRoleFromCtx ¶ added in v0.6.0

func OrgRoleFromCtx(ctx context.Context) (string, bool)

OrgRoleFromCtx returns the caller's effective top role on the active org.

Types ¶

type ContextInjector ¶

type ContextInjector interface {
	Inject(ctx context.Context, token Token) (context.Context, error)
}

type GrpcAuthenticatorParams ¶

type GrpcAuthenticatorParams struct {
	fx.In

	TokenExtractor  TokenExtractor[metadata.MD]
	ContextInjector ContextInjector
	FirebaseClient  firebase.Client `optional:"true"`
	HmacValidator   jwt.Validator
}

type HmacCredentials ¶

type HmacCredentials struct {
	// contains filtered or unexported fields
}

HmacCredentials implements credentials.PerRPCCredentials

func NewHmacCredentials ¶

func NewHmacCredentials(issuer jwt.Issuer) *HmacCredentials

func (*HmacCredentials) GetRequestMetadata ¶

func (c *HmacCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)

func (*HmacCredentials) RequireTransportSecurity ¶

func (c *HmacCredentials) RequireTransportSecurity() bool

type Token ¶

type Token interface {
	Claims() TokenClaims
	Value() string
	Type() TokenType
}

func TokenFromCtx ¶

func TokenFromCtx(ctx context.Context) Token

type TokenClaims ¶

type TokenClaims interface {
	Subject() string
	Expiry() time.Time
	Get(key string) any
}

type TokenExtractor ¶

type TokenExtractor[R any] interface {
	Extract(ctx context.Context, req R) (Token, error)
}

type TokenType ¶

type TokenType string

const (
	TokenTypeJWT      TokenType = "JWT"
	TokenTypeFirebase TokenType = "FIREBASE"
	TokenTypeOAuth    TokenType = "OAUTH"
	TokenTypeAPIKey   TokenType = "API_KEY"
	TokenTypeHMAC     TokenType = "HMAC"
	TokenTypeCustom   TokenType = "CUSTOM"
)

func (TokenType) String ¶

func (tt TokenType) String() string

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
authtest Package authtest provides test fixtures (stub authenticators, signed JWTs, etc.) that downstream services use to exercise auth-protected HTTP / gRPC handlers without spinning up a real identity provider.	Package authtest provides test fixtures (stub authenticators, signed JWTs, etc.) that downstream services use to exercise auth-protected HTTP / gRPC handlers without spinning up a real identity provider.
jwt Package jwt provides JWT-based authentication primitives — signing helpers, HMAC + RSA verifiers, claims parsing — used by the kit/auth HTTP + gRPC interceptors.	Package jwt provides JWT-based authentication primitives — signing helpers, HMAC + RSA verifiers, claims parsing — used by the kit/auth HTTP + gRPC interceptors.
jwttest
oidc Package oidc is a minimal OIDC client: discovery, an authorization-code + PKCE redirect, code→token exchange, and ID-token verification.	Package oidc is a minimal OIDC client: discovery, an authorization-code + PKCE redirect, code→token exchange, and ID-token verification.
password Package password hashes and verifies passwords with argon2id (PHC-encoded).	Package password hashes and verifies passwords with argon2id (PHC-encoded).
provider Package provider defines the IdentityProvider interface that the HTTP + gRPC authenticators delegate to.	Package provider defines the IdentityProvider interface that the HTTP + gRPC authenticators delegate to.
providertest

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL