Documentation
¶
Overview ¶
Package httpverifier implements the legacy external auth provider: POST a JSON envelope to a verifier URL and trust its response.
This is the provider that the historical --auth-url / FORGE_AUTH_URL flag configures. The request/response shape is preserved byte-for-byte so existing custom verifier services keep working unchanged.
Request: POST {URL}
Content-Type: application/json
{ "token": "<bearer>", "org_id": "<org-id>" }
Response: 200 OK
{ "valid": bool, "error": "...", "user_id": "...",
"org_id": "...", "email": "...", "workspace_id": "..." }
The HTTP verifier claims every token presented to it — it never returns ErrTokenNotForMe. When placed in a chain, it is typically the terminator.
Index ¶
Constants ¶
const DefaultTimeout = 10 * time.Second
DefaultTimeout is the per-request timeout used when Config.Timeout is unset.
const ProviderName = "http_verifier"
ProviderName is the type name used to register and reference this provider.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// URL is the verifier endpoint. Required.
URL string `yaml:"url"`
// DefaultOrg is the org_id sent to the verifier when no X-Org-ID
// header (or org-id / org_id variant) is present on the request.
DefaultOrg string `yaml:"default_org,omitempty"`
// Timeout caps each verify call. Defaults to DefaultTimeout.
Timeout time.Duration `yaml:"timeout,omitempty"`
// HTTPClient overrides the default client. Injectable for tests.
HTTPClient *http.Client `yaml:"-"`
}
Config controls the http_verifier provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements auth.Provider against a remote HTTP verifier.
func (*Provider) Verify ¶
func (p *Provider) Verify(ctx context.Context, token string, headers auth.Headers) (*auth.Identity, error)
Verify implements auth.Provider. It POSTs the bearer token (with the caller's org_id) to the configured verifier URL and translates the response into an Identity or one of the sentinel errors.
Mapping (review #6 — separated "token bad" from "verifier down"):
- HTTP 200 + valid:true → (Identity, nil)
- HTTP 200 + valid:false → ErrTokenRejected
- HTTP 401 → ErrTokenRejected
- HTTP 4xx (other) → ErrTokenRejected (verifier denied — token-side)
- HTTP 5xx → ErrProviderUnavailable (server-side failure)
- Network / transport error → ErrProviderUnavailable
- Response body undecodable → ErrProviderUnavailable (verifier returned garbage)
- Local marshal / request-build err → ErrInvalidToken (extremely rare; bug in caller path)
This provider does not return ErrTokenNotForMe.
Source Files