tokens

package

v0.6.3 Latest Latest Go to latest Published: Jun 11, 2026 License: MPL-2.0 Imports: 12 Imported by: 0

Details

Package tokens manages token authentication

This section is empty.

This section is empty.

func ParseBearerToken(r *http.Request) (string, error)

ParseBearerToken parses an HTTP Authorization header with a bearer token. It returns an empty string and a nil error if there is no such header.

type JWTAuthenticator struct {
	Client JWTAuthenticatorClient
}

JWTAuthenticator authenticates requests possessing a header with a JWT token (i.e. API requests).

func (a *JWTAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) (authz.Subject, error)

type JWTAuthenticatorClient interface {
	GetSubject(ctx context.Context, token []byte) (authz.Subject, error)
}

type Options struct {
	Logger logr.Logger
	Secret []byte
}

type Service struct {
	// contains filtered or unexported fields
}

func NewService(opts Options) (*Service, error)

func (r Service) GetSubject(ctx context.Context, token []byte) (authz.Subject, error)

GetSubject retrieves the subject from a JWT.

func (f Service) NewToken(subjectID resource.TfeID, expiry *time.Time) ([]byte, error)

func (r Service) RegisterKind(k resource.Kind, fn SubjectGetter)

RegisterKind registers a kind of authentication token, providing a func that can retrieve the OTF subject indicated in the token.

type SubjectGetter func(ctx context.Context, jwtSubject resource.TfeID) (authz.Subject, error)

SubjectGetter retrieves an OTF subject given the jwtSubject string, which is the value of the 'subject' field parsed from a JWT.

type TokensService = Service

Alias service to permit embedding it with other services in a struct without a name clash.