engine

package
v0.0.24 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: MIT Imports: 11 Imported by: 6

Documentation

Index

Constants

View Source 
const (
	ClaimFieldIssuer         = "iss" // 代表 JWT 的签发者。它是一个字符串或者 URL，用于标识是哪个实体（如服务器、服务提供商等）签发了这个 JWT。
	ClaimFieldSubject        = "sub" // 代表 JWT 的主题。通常是一个唯一标识符，用于标识 JWT 所涉及的主体，这个主体通常是用户，但也可以是其他实体，如设备等。
	ClaimFieldAudience       = "aud" // 代表 JWT 的受众。它指定了 JWT 的接收方，是一个或多个字符串或者 URL。
	ClaimFieldExpirationTime = "exp" // 代表 JWT 的过期时间。它是一个数字，表示从 1970 年 1 月 1 日 00:00:00 UTC 开始到过期时间的秒数。
	ClaimFieldNotBefore      = "nbf" // 代表 JWT 的生效时间。和exp类似，它是一个数字，表示从 1970 年 1 月 1 日 00:00:00 UTC 开始到生效时间的秒数。
	ClaimFieldIssuedAt       = "iat" // 代表 JWT 的签发时间。也是一个数字，表示从 1970 年 1 月 1 日 00:00:00 UTC 开始到签发时间的秒数。
	ClaimFieldJwtID          = "jti" // 代表 JWT 的唯一标识符。是一个字符串，用于唯一标识一个 JWT。

	ClaimFieldScope = "scope" // 代表 JWT 的权限范围。它是一个字符串或者字符串数组，用于标识 JWT 的权限范围。在一个 API 访问场景中，scope的值可能是["read:users", "write:posts"]。这意味着拥有此 JWT 的用户被授权读取用户信息和写入文章相关内容。通过这种方式，scope清晰地界定了用户凭借该令牌可以进行的操作范围。
)
View Source 
const (
	// HeaderAuthorize 是标准认证请求头。
	HeaderAuthorize = "Authorization"

	// BearerWord 是 Bearer 认证方案名称。
	BearerWord = "Bearer"
	// BasicWord 是 Basic 认证方案名称。
	BasicWord = "Basic"
)

Variables

View Source 
var (
	ErrorInvalidType = status.Error(codes.Code(AuthErrorCodeInvalidType), "invalid type")

	ErrInvalidJwtID      = status.Error(codes.Code(AuthErrorCodeInvalidJwtID), "invalid jwt id")
	ErrMissingJwtId      = status.Error(codes.Code(AuthErrorCodeMissingJwtId), "jwt id missing")
	ErrInvalidSubject    = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidSubject), "invalid subject")
	ErrInvalidAudience   = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidAudience), "invalid audience")
	ErrInvalidIssuer     = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidIssuer), "invalid issuer")
	ErrInvalidExpiration = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidExpiration), "invalid expiration")
	ErrInvalidNotBefore  = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidNotBefore), "invalid not before")
	ErrInvalidIssuedAt   = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidIssuedAt), "invalid issued at")
	ErrInvalidClaims     = status.Error(codes.Code(AuthErrorCodeInvalidClaims), "invalid claims")
	ErrInvalidToken      = status.Error(codes.Code(AuthErrorCodeAuthFailedInvalidBearerToken), "invalid bearer token")

	ErrMissingBearerToken       = status.Error(codes.Code(AuthErrorCodeBearerTokenMissing), "missing bearer token")
	ErrUnauthenticated          = status.Error(codes.Code(AuthErrorCodeUnauthenticated), "unauthenticated")
	ErrTokenExpired             = status.Error(codes.Code(AuthErrorCodeTokenExpired), "token expired")
	ErrUnsupportedSigningMethod = status.Error(codes.Code(AuthErrorCodeUnsupportedSigningMethod), "unsupported signing method")
	ErrMissingKeyFunc           = status.Error(codes.Code(AuthErrorCodeMissingKeyFunc), "missing keyFunc")
	ErrSignTokenFailed          = status.Error(codes.Code(AuthErrorCodeSignTokenFailed), "sign token failed")
	ErrGetKeyFailed             = status.Error(codes.Code(AuthErrorCodeGetKeyFailed), "get key failed")

	ErrNoAtHash      = status.Error(codes.Code(AuthCodeNoAtHash), "id token did not have an access token hash")
	ErrInvalidAtHash = status.Error(codes.Code(AuthCodeInvalidAtHash), "access token hash does not match value in ID token")
)

Functions

func AuthFromMD 

func AuthFromMD(ctx context.Context, expectedScheme string, ctxType ContextType) (string, error)

AuthFromMD 从上下文元数据中解析指定认证方案的 Token。

func ContextWithAuthClaims 

func ContextWithAuthClaims(parent context.Context, claims *AuthClaims) context.Context

ContextWithAuthClaims injects the provided AuthClaims into the parent context.

func MDWithAuth 

func MDWithAuth(ctx context.Context, expectedScheme string, tokenStr string, ctxType ContextType) context.Context

MDWithAuth .

Types

type AuthClaims 

type AuthClaims map[string]interface{}

AuthClaims contains claims that are included in OIDC standard claims. See https://openid.net/specs/openid-connect-core-1_0.html#IDToken 

type AuthClaims struct {
	jwtV5.MapClaims
}

func AuthClaimsFromContext 

func AuthClaimsFromContext(ctx context.Context) (*AuthClaims, bool)

AuthClaimsFromContext extracts the AuthClaims from the provided ctx (if any).

func (*AuthClaims) GetAudience 

func (c *AuthClaims) GetAudience() (jwt.ClaimStrings, error)

GetAudience implements the Claims interface.

func (*AuthClaims) GetClaimStrings 

func (c *AuthClaims) GetClaimStrings(key string) (jwt.ClaimStrings, error)

func (*AuthClaims) GetExpirationTime 

func (c *AuthClaims) GetExpirationTime() (*jwt.NumericDate, error)

GetExpirationTime implements the Claims interface.

func (*AuthClaims) GetFloat32 

func (c *AuthClaims) GetFloat32(key string) (float32, error)

func (*AuthClaims) GetFloat64 

func (c *AuthClaims) GetFloat64(key string) (float64, error)

func (*AuthClaims) GetInt 

func (c *AuthClaims) GetInt(key string) (int, error)

func (*AuthClaims) GetInt8 

func (c *AuthClaims) GetInt8(key string) (int8, error)

func (*AuthClaims) GetInt16 

func (c *AuthClaims) GetInt16(key string) (int16, error)

func (*AuthClaims) GetInt32 

func (c *AuthClaims) GetInt32(key string) (int32, error)

func (*AuthClaims) GetInt64 

func (c *AuthClaims) GetInt64(key string) (int64, error)

func (*AuthClaims) GetIssuedAt 

func (c *AuthClaims) GetIssuedAt() (*jwt.NumericDate, error)

GetIssuedAt implements the Claims interface.

func (*AuthClaims) GetIssuer 

func (c *AuthClaims) GetIssuer() (string, error)

GetIssuer implements the Claims interface.

func (*AuthClaims) GetJwtID 

func (c *AuthClaims) GetJwtID() (string, error)

func (*AuthClaims) GetNotBefore 

func (c *AuthClaims) GetNotBefore() (*jwt.NumericDate, error)

GetNotBefore implements the Claims interface.

func (*AuthClaims) GetScopes 

func (c *AuthClaims) GetScopes() (jwt.ClaimStrings, error)

GetScopes returns the scopes of the token. Scopes see: https://datatracker.ietf.org/doc/html/rfc6749#section-3.3

func (*AuthClaims) GetString 

func (c *AuthClaims) GetString(key string) (string, error)

func (*AuthClaims) GetStrings 

func (c *AuthClaims) GetStrings(key string) ([]string, error)

func (*AuthClaims) GetSubject 

func (c *AuthClaims) GetSubject() (string, error)

GetSubject implements the Claims interface.

func (*AuthClaims) GetUint 

func (c *AuthClaims) GetUint(key string) (uint, error)

func (*AuthClaims) GetUint8 

func (c *AuthClaims) GetUint8(key string) (uint8, error)

func (*AuthClaims) GetUint16 

func (c *AuthClaims) GetUint16(key string) (uint16, error)

func (*AuthClaims) GetUint32 

func (c *AuthClaims) GetUint32(key string) (uint32, error)

func (*AuthClaims) GetUint64 

func (c *AuthClaims) GetUint64(key string) (uint64, error)

type AuthErrorCode 

type AuthErrorCode int32
const (
	AuthErrorCodeInvalidType AuthErrorCode = 500

	AuthErrorCodeInvalidJwtID                 AuthErrorCode = 1001
	AuthErrorCodeMissingJwtId                 AuthErrorCode = 1002
	AuthErrorCodeInvalidClaims                AuthErrorCode = 1003
	AuthErrorCodeAuthFailedInvalidBearerToken AuthErrorCode = 1004
	AuthErrorCodeAuthFailedInvalidSubject     AuthErrorCode = 1005
	AuthErrorCodeAuthFailedInvalidAudience    AuthErrorCode = 1006
	AuthErrorCodeAuthFailedInvalidIssuer      AuthErrorCode = 1007
	AuthErrorCodeAuthFailedInvalidExpiration  AuthErrorCode = 1008
	AuthErrorCodeAuthFailedInvalidNotBefore   AuthErrorCode = 1009
	AuthErrorCodeAuthFailedInvalidIssuedAt    AuthErrorCode = 1010

	AuthErrorCodeUnauthenticated          AuthErrorCode = 1500
	AuthErrorCodeBearerTokenMissing       AuthErrorCode = 1010
	AuthErrorCodeTokenExpired             AuthErrorCode = 1011
	AuthErrorCodeUnsupportedSigningMethod AuthErrorCode = 1012
	AuthErrorCodeMissingKeyFunc           AuthErrorCode = 1014
	AuthErrorCodeSignTokenFailed          AuthErrorCode = 1015
	AuthErrorCodeGetKeyFailed             AuthErrorCode = 1016

	AuthCodeNoAtHash      AuthErrorCode = 1050
	AuthCodeInvalidAtHash AuthErrorCode = 1051
)

type Authenticator 

type Authenticator interface {
	RequestAuthenticator
	TokenAuthenticator
	ContextIdentityCreator
	IdentityCreator
	AuthenticatorCloser
}

Authenticator 是兼容旧调用方的完整认证能力组合。

type AuthenticatorCloser added in v0.0.21 

type AuthenticatorCloser interface {
	// Close 停止认证器后台任务并释放资源。
	Close()
}

AuthenticatorCloser 释放认证器持有的资源。

type ContextIdentityCreator added in v0.0.21 

type ContextIdentityCreator interface {
	// CreateIdentityWithContext 根据身份声明创建凭证并写入上下文。
	CreateIdentityWithContext(requestContext context.Context, contextType ContextType, claims AuthClaims, request any) (context.Context, error)
}

ContextIdentityCreator 把身份凭证注入请求上下文。

type ContextType 

type ContextType int
const (
	ContextTypeGrpc ContextType = iota
	ContextTypeKratosMetaData
)

type IdentityCreator added in v0.0.21 

type IdentityCreator interface {
	// CreateIdentity 创建可传输的身份令牌。
	CreateIdentity(claims AuthClaims) (string, error)
}

IdentityCreator 根据身份声明创建令牌。

type RequestAuthenticator added in v0.0.21 

type RequestAuthenticator interface {
	// Authenticate 认证请求并返回身份声明。
	Authenticate(requestContext context.Context, contextType ContextType, request any) (*AuthClaims, error)
}

RequestAuthenticator 从请求上下文认证身份。

type TokenAuthenticator added in v0.0.21 

type TokenAuthenticator interface {
	// AuthenticateToken 认证令牌并返回身份声明。
	AuthenticateToken(token string) (*AuthClaims, error)
}

TokenAuthenticator 直接认证令牌字符串。

Source Files

View all Source files

Directories

Path Synopsis
jwt module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.