Documentation
¶
Overview ¶
Package auth — JWT validation against IAM JWKS. Used by RequireIdentity middleware to mint identity headers from validated tokens. Mirrors the pattern in hanzoai/gateway: TTL-cached JWKS, fail-stale, exact issuer and audience checks.
Package auth — identity-header middleware. The trust boundary is the IAM JWT: tasksd validates every Authorization: Bearer <jwt> against JWKS, mints X-Org-Id / X-User-Id / X-User-Email from validated claims, and unconditionally strips any client-supplied identity headers. There is no header-pass-through trust path; client-supplied identity headers are never honored.
In dev / embedded use, set TASKSD_REQUIRE_IDENTITY=false (the default) — requests without a token pass through with empty identity context. In production, set TASKSD_REQUIRE_IDENTITY=true so unauthenticated requests get 401.
Index ¶
Constants ¶
const ( HeaderOrgID = "X-Org-Id" HeaderUserID = "X-User-Id" HeaderUserEmail = "X-User-Email" HeaderAuthorization = "Authorization" )
Variables ¶
This section is empty.
Functions ¶
func RequireIdentity ¶
RequireIdentity returns middleware that:
- Strips any client-supplied X-Org-Id / X-User-Id / X-User-Email.
- If a Bearer JWT is present, validates it via v and mints fresh identity headers + ctx values from the claims.
- If require=true and no validated identity emerged, returns 401.
When v is nil (JWT disabled, embedded/dev mode) and require=false, every request passes through with empty identity ctx — useful for tests and the in-process embedder. When v is nil and require=true, every request is rejected (closed-by-default).
Types ¶
type IAMClaims ¶
type IAMClaims struct {
jwt.Claims
Owner string `json:"owner"`
Email string `json:"email"`
PreferredUsername string `json:"preferred_username"`
Name string `json:"name"`
}
IAMClaims is the subset of Casdoor/hanzo.id claims tasksd cares about. `owner` is the org slug (X-Org-Id), `sub` is the user id (X-User-Id), `email` is the user email (X-User-Email).
type JWTConfig ¶
type JWTConfig struct {
JWKSURL string // e.g. https://hanzo.id/.well-known/jwks
Issuer string // e.g. https://hanzo.id
Audience string // optional; "" → audience check skipped
TTL time.Duration // JWKS cache TTL; 0 → 5 min
}
JWTConfig configures the validator. Zero values disable JWT validation (auth.RequireIdentity falls back to header-pass-through, gated by the require flag).
type Validator ¶
type Validator struct {
// contains filtered or unexported fields
}
Validator verifies bearer tokens against JWKS and returns claims.
func NewValidator ¶
NewValidator returns nil when cfg is empty (JWT disabled).
Source Files