Documentation
¶
Overview ¶
Package config is the production wiring entrypoint for runtime/auth components. Callers MUST use NewJWTIssuerFromRegistry / NewJWTVerifierFromRegistry to obtain issuer/verifier instances; direct calls to auth.NewJWTIssuer / auth.NewJWTVerifier are reserved for tests and future internal wiring.
The Registry struct is the single source of truth for (Issuer, Audiences, KeySet, Clock) — established in F1 per docs/plans/202604191515-auth-federated-whistle.md.
ref: Hydra internal/driver/config.DefaultProvider — single Registry pattern ref: Kratos middleware/auth/jwt WithParserOptions — one-time injection
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewJWTIssuerFromRegistry ¶
func NewJWTIssuerFromRegistry(reg *Registry, ttl time.Duration, opts ...auth.JWTIssuerOption) (*auth.JWTIssuer, error)
NewJWTIssuerFromRegistry constructs a *auth.JWTIssuer whose issuer string, default audiences, signing key, and clock are all sourced from reg.
This is the single authorized entry point for creating a JWTIssuer in production code; the raw NewJWTIssuer constructor is retained only for test helpers that build issuers independently of Registry.
ref: Hydra internal/driver/config.DefaultProvider — configuration through registry
func NewJWTVerifierFromRegistry ¶
func NewJWTVerifierFromRegistry(reg *Registry, opts ...auth.JWTVerifierOption) (*auth.JWTVerifier, error)
NewJWTVerifierFromRegistry constructs a *auth.JWTVerifier whose expected audiences, expected issuer, verification key store, and clock are all sourced from reg.
ref: Hydra internal/driver/config.DefaultProvider — configuration through registry
Types ¶
type Config ¶
type Config struct {
// Issuer is the JWT issuer claim (iss). Required when RealMode is true.
// Corresponds to GOCELL_JWT_ISSUER.
Issuer string
// Audiences is the list of accepted JWT audience values. Required when
// RealMode is true. Corresponds to GOCELL_JWT_AUDIENCE (single value
// stored as []string{"value"}). Future: GOCELL_JWT_AUDIENCES comma-separated.
Audiences []string
// KeyProv supplies the active RSA signing key. May be nil in non-real mode.
KeyProv auth.SigningKeyProvider
// KeyStore provides public keys for JWT verification. May be nil in non-real mode.
KeyStore auth.VerificationKeyStore
// RealMode enforces non-empty Issuer and Audiences at construction time.
// Set to true in production; leave false for dev/test.
RealMode bool
}
Config carries the inputs for constructing a Registry.
type EnvOption ¶
type EnvOption func(*envConfig)
EnvOption configures FromEnv behavior.
func WithKeySeparate ¶
func WithKeySeparate(prov auth.SigningKeyProvider, store auth.VerificationKeyStore) EnvOption
WithKeySeparate sets key provider and key store independently. Typed-nil inputs are filtered out per WithKeys' rationale.
func WithKeys ¶
func WithKeys(prov auth.SigningKeyProvider) EnvOption
WithKeys sets the key provider and key store for the registry built by FromEnv. Typed-nil inputs are rejected (not stored); the subsequent factory call will fail with a clear "SigningKeyProvider is nil" error rather than panicking at first method dispatch.
func WithRealMode ¶
WithRealMode enables real-mode validation (fail-fast on missing env vars).
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry is the single source of truth for JWT configuration. All JWT consumers (JWTIssuer, JWTVerifier, middleware) obtain their configuration from Registry instead of carrying per-instance copies.
Registry is safe for concurrent read access after construction.
func FromEnv ¶
FromEnv constructs a Registry by reading GOCELL_JWT_ISSUER and GOCELL_JWT_AUDIENCE from the environment.
The audience env var stores a single value stored as []string{value}. When the value is empty and RealMode is false, Audiences will be nil.
Returns an error in real mode when required env vars are missing or empty.
func New ¶
New constructs a Registry from the given Config. Returns an error when RealMode is true and Issuer or Audiences are missing.
Configuration errors use errcode.ErrAuthVerifierConfig so operators can distinguish startup misconfigurations from runtime key errors.
func (*Registry) Audiences ¶
Audiences returns a defensive copy of the configured audience allowlist. Mutating the returned slice does not affect the Registry.
func (*Registry) Clock ¶
Clock returns the clock used for token timestamps. Always non-nil — required as a positional parameter to New and FromEnv.
func (*Registry) SigningKeyProvider ¶
func (r *Registry) SigningKeyProvider() auth.SigningKeyProvider
SigningKeyProvider returns the configured key provider for JWT signing. May be nil when the Registry was constructed in non-real mode without keys.
func (*Registry) VerificationKeyStore ¶
func (r *Registry) VerificationKeyStore() auth.VerificationKeyStore
VerificationKeyStore returns the configured key store for JWT verification. May be nil when the Registry was constructed in non-real mode without keys.
Source Files