auth

package

v0.1.3 Latest Latest Go to latest Published: Apr 7, 2026 License: MIT Imports: 13 Imported by: 0

Details

This section is empty.

View Source

var (
	ErrAuthorizationDenied = fmt.Errorf("authorization denied by dynamic hook")
)

func PermissionsFromContext(ctx context.Context) []string

PermissionsFromContext extracts the permissions from the context.

func RolesFromContext(ctx context.Context) []string

RolesFromContext extracts the roles from the context.

func TenantIDFromContext(ctx context.Context) string

TenantIDFromContext extracts the tenant ID from the context.

func UserIDFromContext(ctx context.Context) string

UserIDFromContext extracts the user ID from the context.

func WithIdentity(ctx context.Context, id *Identity) context.Context

WithIdentity stores the identity in the context.

func WithTenantID(ctx context.Context, tenantID string) context.Context

WithTenantID stores a tenant ID in the context (useful for background workers).

type AuthorizationHook struct {
	// contains filtered or unexported fields
}

AuthorizationHook calls the consuming system's dynamic authorization endpoint to determine if a checker is allowed to act on a request.

func NewAuthorizationHook(timeout time.Duration) *AuthorizationHook

func (h *AuthorizationHook) Check(ctx context.Context, hookURL string, secret string, hookReq model.AuthorizationHookRequest) error

func (h *AuthorizationHook) SetMetrics(m *metrics.Metrics)

type Identity struct {
	UserID      string
	Roles       []string
	Permissions []string
	TenantID    string
}

Identity represents the authenticated user extracted from the request.

type Provider interface {
	Authenticate(r *http.Request) (*Identity, error)
}

Provider extracts identity from an HTTP request.

type TrustProvider struct {
	UserIDHeader      string
	RolesHeader       string
	PermissionsHeader string
	TenantIDHeader    string
}

TrustProvider trusts identity headers from the host app.

func NewTrustProvider(userIDHeader, rolesHeader, permissionsHeader, tenantIDHeader string) *TrustProvider

func (p *TrustProvider) Authenticate(r *http.Request) (*Identity, error)