Documentation
¶
Overview ¶
Package middleware provides shared HTTP middleware for the platform API.
Index ¶
- func PluginRequest(runner PluginRequestRunner) func(http.Handler) http.Handler
- func PluginRouteInterceptor(router PluginRouter, verifier TokenVerifier) func(http.Handler) http.Handler
- func RequireAuth(verifier TokenVerifier) func(http.Handler) http.Handler
- func RequireRole(roles ...string) func(http.Handler) http.Handler
- type Claims
- type PluginRequestRunner
- type PluginRouter
- type PluginTokenVerifier
- type TokenVerifier
- type VerifyResult
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PluginRequest ¶
func PluginRequest(runner PluginRequestRunner) func(http.Handler) http.Handler
PluginRequest fans out to all plugins that declared CapabilityAPIMiddleware. Must sit inside RequireAuth so claims are already in context. If any plugin denies the request it short-circuits with 403.
func PluginRouteInterceptor ¶
func PluginRouteInterceptor(router PluginRouter, verifier TokenVerifier) func(http.Handler) http.Handler
PluginRouteInterceptor wraps the entire handler stack. For routes declared by a plugin (via CapabilityAPIRoutes), it intercepts the request, optionally validates the bearer token for non-public routes, forwards via gRPC Handle, and writes the plugin's raw HTTP response. All other requests pass through.
func RequireAuth ¶
func RequireAuth(verifier TokenVerifier) func(http.Handler) http.Handler
RequireAuth validates the Bearer token on every request using the provided TokenVerifier. On success, claims are injected into the request context.
Types ¶
type PluginRequestRunner ¶
type PluginRequestRunner interface {
RunMiddleware(ctx context.Context, userID string, roles []string, method, path string) error
}
PluginRequestRunner is the subset of PluginManager used by PluginRequest.
type PluginRouter ¶
type PluginRouter interface {
MatchPluginRoute(method, path string) (pluginID string, public bool, ok bool)
HandlePluginRoute(ctx context.Context, pluginID string, req *pluginsv1.HTTPRequest) (*pluginsv1.HTTPResponse, error)
}
PluginRouter is the subset of PluginManager used by PluginRouteInterceptor.
type PluginTokenVerifier ¶
type PluginTokenVerifier struct {
// contains filtered or unexported fields
}
PluginTokenVerifier implements TokenVerifier by delegating to the active IDP plugin's ValidateToken gRPC method.
func NewPluginTokenVerifier ¶
func NewPluginTokenVerifier(manager ports.PluginManager) *PluginTokenVerifier
func (*PluginTokenVerifier) Verify ¶
func (v *PluginTokenVerifier) Verify(ctx context.Context, rawToken string) (*VerifyResult, error)
type TokenVerifier ¶
type TokenVerifier interface {
Verify(ctx context.Context, rawToken string) (*VerifyResult, error)
}
TokenVerifier validates a raw bearer token and returns its claims. Implemented by PluginTokenVerifier, which delegates to the active IDP plugin.
type VerifyResult ¶
VerifyResult is returned by TokenVerifier.Verify on success.
Source Files