auth

package

v0.4.18 Latest Latest Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/mcpdev80/baseharbor

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func BearerToken(header string) (string, error)
type Config
- func (c Config) Validate() error
type OIDCVerifier
- func NewOIDCVerifier(ctx context.Context, cfg Config) (*OIDCVerifier, error)
- func (v *OIDCVerifier) Verify(ctx context.Context, rawToken string) (*identity.Principal, error)
type Verifier

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrMissingAuthorization = errors.New("authorization header required")
	ErrInvalidBearerFormat  = errors.New("authorization must use bearer scheme")
)

View Source

var (
	ErrInvalidIssuer   = errors.New("invalid oidc issuer")
	ErrMissingAudience = errors.New("missing oidc audience")
)

View Source

var ErrInvalidToken = errors.New("invalid or expired token")

Functions ¶

func BearerToken ¶

func BearerToken(header string) (string, error)

BearerToken parses a bearer token from an Authorization header. It returns only public, stable errors and never includes token material.

Types ¶

type Config ¶

type Config struct {
	Issuer    string
	Audiences []string
}

Config describes provider-neutral OIDC verification requirements.

func (Config) Validate ¶

func (c Config) Validate() error

Validate rejects incomplete or insecure OIDC configuration.

type OIDCVerifier ¶

type OIDCVerifier struct {
	// contains filtered or unexported fields
}

OIDCVerifier verifies ID tokens using OIDC discovery and the provider JWKS. One verifier is created per accepted audience so the upstream library keeps ownership of issuer, signature, expiry and authorized-party validation.

func NewOIDCVerifier ¶

func NewOIDCVerifier(ctx context.Context, cfg Config) (*OIDCVerifier, error)

NewOIDCVerifier discovers the OIDC provider and prepares verifiers for every configured audience. Discovery must succeed before the verifier is usable.

func (*OIDCVerifier) Verify ¶

func (v *OIDCVerifier) Verify(ctx context.Context, rawToken string) (*identity.Principal, error)

Verify validates the token against one of the configured audiences and returns only provider-neutral identity claims. Validation failures are intentionally collapsed so raw token material never reaches callers.

type Verifier ¶

type Verifier interface {
	Verify(ctx context.Context, rawToken string) (*identity.Principal, error)
}

Verifier converts a verified OIDC/JWT token into BaseHarbor's provider-neutral identity. Implementations must validate signature, issuer, audience, expiry and not-before claims.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL