Documentation
¶
Index ¶
- Variables
- func Has(scopes []string, required Scope) bool
- func HasAll(scopes []string, required ...Scope) bool
- func HasAny(scopes []string, required ...Scope) bool
- func ParseBearer(authorization string) (string, error)
- type Claims
- type Decision
- type PolicyChecker
- type PolicyRequest
- type Scope
- type Verifier
- type VerifyConfig
Constants ¶
This section is empty.
Variables ¶
var ( // ErrMissingKeyFunc indicates verifier misconfiguration. ErrMissingKeyFunc = errors.New("auth: missing jwt keyfunc") // ErrInvalidToken indicates token is malformed, signature invalid, or claims invalid. // Do not expose underlying parsing details to clients. ErrInvalidToken = errors.New("auth: invalid token") // ErrMissingSubject indicates the token has no "sub". ErrMissingSubject = errors.New("auth: missing subject") // ErrMissingTenantID indicates the token has no tenant_id. ErrMissingTenantID = errors.New("auth: missing tenant_id") )
Functions ¶
func Has ¶
Has reports whether scopes contains the required scope. Matching is exact after TrimSpace normalization.
func HasAll ¶
HasAll reports whether scopes contains all required scopes. Empty required values are ignored. If no non-empty required scopes are provided, returns true.
func HasAny ¶
HasAny reports whether scopes contains any of the required scopes. Empty required values are ignored. If no non-empty required scopes are provided, returns false.
func ParseBearer ¶
ParseBearer extracts the raw JWT from an Authorization header value. Accepts "Bearer <token>" (case-insensitive). Returns ErrInvalidToken on invalid format.
Types ¶
type Claims ¶
type Claims struct {
TenantID string `json:"tenant_id"`
Scopes []string `json:"scopes,omitempty"`
jwt.RegisteredClaims
}
type PolicyChecker ¶
type PolicyChecker interface {
Check(ctx context.Context, req PolicyRequest) (Decision, error)
}
PolicyChecker is implemented by a service adapter (HTTP/gRPC) that knows how to evaluate RBAC/ABAC rules (e.g. by calling Identity/Core).
type PolicyRequest ¶
type PolicyRequest struct {
SubjectID string
TenantID string
Scopes []string
Action string
Resource string
}
PolicyRequest is a normalized policy check input. Action/Resource should be stable strings, e.g. "tenant.members.invite", "orders.create".
type Scope ¶
type Scope string
Scope represents an authorization scope (permission string) attached to an identity.
type Verifier ¶
type Verifier struct {
// KeyFunc is used to provide the verification key based on token header (kid, alg, etc).
KeyFunc jwt.Keyfunc
Config VerifyConfig
}
type VerifyConfig ¶
type VerifyConfig struct {
// AllowedMethods defaults to HS256, RS256, ES256 if empty.
AllowedMethods []string
// Leeway allows small clock skew.
Leeway time.Duration
// Optional issuer/audience checks.
Issuer string
RequireIssuer bool
Audience string
RequireAudience bool
}
VerifyConfig controls optional JWT validation rules.
Source Files