Documentation
¶
Overview ¶
Package authz models the authenticated caller (a Principal) and the authorization decisions made about it. It is deliberately free of imports on the auth/agent packages so those packages can depend on it without a cycle; the concrete authentication wiring is injected (see Authenticator).
Index ¶
Constants ¶
const AgentTokenPrefix = "legant_at_"
AgentTokenPrefix marks an opaque agent token presented as a bearer credential.
Variables ¶
This section is empty.
Functions ¶
func RequireAdmin ¶
RequireAdmin is middleware (placed after Require) that allows only admin-capable principals: a superadmin, or an owner/admin of some org. Use it for org-scoped resources whose handlers further restrict by the caller's orgs.
func RequireSuperadmin ¶
RequireSuperadmin is middleware (placed after Require) that allows only platform superadmins. Use it for global resources that are not org-scoped (e.g. user and client management), so an org-admin cannot reach across tenants.
Types ¶
type AgentTokenResolver ¶
type AgentTokenResolver func(ctx context.Context, token string) (agentID string, scopes []string, tokenID string, ok bool)
AgentTokenResolver validates an opaque agent token.
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator resolves a request to a Principal using, in order: a session cookie, an agent bearer token, or an OAuth2 access token. It loads org membership and superadmin status from the database to populate the Principal.
func NewAuthenticator ¶
func NewAuthenticator(pool *pgxpool.Pool, session SessionResolver, agent AgentTokenResolver, bearer BearerResolver) *Authenticator
func (*Authenticator) Authenticate ¶
func (a *Authenticator) Authenticate(r *http.Request) (*Principal, bool)
Authenticate resolves the request to a Principal, or returns ok=false.
func (*Authenticator) AuthenticateActor ¶
AuthenticateActor validates an agent token and returns the agent Principal. Used by the RFC 8693 token-exchange endpoint to authenticate the acting agent.
type BearerResolver ¶
type BearerResolver func(ctx context.Context, token string) (userID string, scopes []string, ok bool)
BearerResolver validates an OAuth2 access token (e.g. via introspection).
type Principal ¶
type Principal struct {
Type Type
ID string // user id / agent id / client id
OrgRoles map[string]string // org_id -> role ("owner" | "admin" | "member" | "agent")
IsSuperadmin bool
Scopes []string // granted scopes, for token/agent principals
AuthMethod string // "session" | "bearer" | "agent_token"
}
Principal is the authenticated identity behind a request: who they are, which organizations they belong to and with what role, and how they authenticated. It replaces the previously-trusted, spoofable X-User-ID header.
func FromContext ¶
FromContext retrieves the principal placed on the context by the authenticator.
func (*Principal) AdminCapable ¶
AdminCapable reports whether the principal may reach the admin API at all — a superadmin, or an owner/admin of at least one organization.
func (*Principal) CanAccessOrg ¶
CanAccessOrg reports whether the principal may access resources in orgID. A superadmin may access any org. An empty orgID denotes a global (org-less) resource, which only a superadmin may touch.
func (*Principal) IsOrgAdmin ¶
IsOrgAdmin reports whether the principal is an owner/admin of orgID (or a superadmin).
type SessionResolver ¶
SessionResolver returns the user id for a request's session cookie.
Source Files