Documentation
¶
Index ¶
- Constants
- func AccessTokenFromContext(ctx context.Context) string
- func AuditLog(lgr logr.Logger, trustProxy bool) func(http.Handler) http.Handler
- func FlightID(next http.Handler) http.Handler
- func FlightIDExtractor() func(ctx context.Context) uint64
- func FlightIDFromContext(ctx context.Context) uint64
- func GzipEncoderFunc(w io.Writer, level int) io.Writer
- func MaxBodySize(maxSize int64) func(http.Handler) http.Handler
- func Metrics() func(http.Handler) http.Handler
- func NewAzureOIDCAuth(tenantID, clientID string, lgr logr.Logger) (func(http.Handler) http.Handler, error)
- func OIDCProviderFromContext(ctx context.Context) string
- func RateLimit(ctx context.Context, maxRequests int, window time.Duration, trustProxy bool) func(http.Handler) http.Handler
- func RedactJSON(v any) any
- func RequestLogging(lgr logr.Logger) func(http.Handler) http.Handler
- func SecurityHeaders(tlsEnabled bool) func(http.Handler) http.Handler
- func TokenPassthrough(allowedTokenHeaderSuffixes []string) func(http.Handler) http.Handler
- func TokensFromContext(ctx context.Context) map[string]string
- func Tracing() func(http.Handler) http.Handler
- func WithAccessToken(ctx context.Context, token string) context.Context
- func WithAuthClaims(ctx context.Context, claims *AuthClaims) context.Context
- func WithContextTokens(ctx context.Context, tokens map[string]string) context.Context
- func WithOIDCProvider(ctx context.Context, provider string) context.Context
- type AuthClaims
- type GzipResponseWriter
- type IdentityType
Constants ¶
const (
TokenHeaderPrefix = "X-Authorization-"
)
Variables ¶
This section is empty.
Functions ¶
func AccessTokenFromContext ¶ added in v0.17.0
AccessTokenFromContext extracts the raw bearer token from the request context.
func AuditLog ¶
AuditLog returns middleware that writes structured audit log entries. Request bodies for mutation methods are captured and redacted before logging to prevent sensitive data (passwords, tokens, secrets) from leaking into logs. Set trustProxy true only when a trusted reverse proxy sanitizes X-Forwarded-For and X-Real-IP; leave false (the safe default) to use RemoteAddr for the audit source IP and prevent clients from spoofing their identity in audit logs.
func FlightID ¶ added in v0.17.0
FlightID is a middleware that assigns a unique monotonic uint64 to each request and stores it in the request context for go-flight singleflight tagging.
func FlightIDExtractor ¶ added in v0.17.0
FlightIDExtractor returns a function compatible with go-flight's cache.RequestIDExtractor type for singleflight tagging.
func FlightIDFromContext ¶ added in v0.17.0
FlightIDFromContext extracts the flight ID from context. Returns 0 if no ID was set.
func GzipEncoderFunc ¶
GzipEncoderFunc is a chi-compatible EncoderFunc that creates a gzip writer. The compression level is validated by the chi Compressor before this function is called, so gzip.NewWriterLevel only returns an error for invalid levels.
func MaxBodySize ¶
MaxBodySize returns middleware that rejects requests with bodies larger than maxSize.
func NewAzureOIDCAuth ¶
func NewAzureOIDCAuth(tenantID, clientID string, lgr logr.Logger) (func(http.Handler) http.Handler, error)
NewAzureOIDCAuth creates authentication middleware for Azure AD OIDC JWT validation.
func OIDCProviderFromContext ¶ added in v0.33.0
OIDCProviderFromContext returns the OIDC provider name that authenticated the inbound request, or "" if no OIDC middleware authenticated it.
func RateLimit ¶
func RateLimit(ctx context.Context, maxRequests int, window time.Duration, trustProxy bool) func(http.Handler) http.Handler
RateLimit returns middleware that limits requests per IP using a sliding window. ctx controls the lifetime of the background cleanup goroutine; cancel it (e.g. on server shutdown) to stop the goroutine and prevent leaks. Set trustProxy true only when a trusted reverse proxy sanitizes X-Forwarded-For and X-Real-IP; otherwise leave false to use RemoteAddr and prevent IP spoofing.
func RedactJSON ¶
RedactJSON round-trips v through JSON and redacts sensitive field values in any map keys that match the sensitiveKeys list (e.g. password, secret, token). Arrays of objects are recursively redacted. Non-JSON-serializable values are returned unchanged. Intended for use in API response sanitization.
func RequestLogging ¶
RequestLogging returns middleware that logs every request.
func SecurityHeaders ¶
SecurityHeaders returns middleware that sets standard security headers.
func TokenPassthrough ¶ added in v0.17.0
func TokensFromContext ¶ added in v0.17.0
func WithAccessToken ¶ added in v0.17.0
WithAccessToken stores the raw bearer token in the context.
func WithAuthClaims ¶ added in v0.17.0
func WithAuthClaims(ctx context.Context, claims *AuthClaims) context.Context
WithAuthClaims stores AuthClaims in the context.
func WithContextTokens ¶ added in v0.33.0
WithContextTokens stores extracted passthrough tokens in the context.
Types ¶
type AuthClaims ¶
type AuthClaims struct {
Subject string `json:"sub"`
Name string `json:"name"`
Email string `json:"email"`
TenantID string `json:"tid"`
ObjectID string `json:"oid"`
IDType string `json:"idtyp"`
Groups []string `json:"groups"`
Roles []string `json:"roles"`
Audience string `json:"aud"`
Issuer string `json:"iss"`
ExpiresAt int64 `json:"exp"`
}
AuthClaims holds the validated JWT claims extracted from an Entra OIDC token.
func ClaimsFromContext ¶
func ClaimsFromContext(ctx context.Context) *AuthClaims
ClaimsFromContext extracts auth claims from the request context.
func (*AuthClaims) CallerType ¶ added in v0.17.0
func (c *AuthClaims) CallerType() IdentityType
CallerType returns IdentityTypeApp for service principal tokens (idtyp=app) and IdentityTypeUser for all other callers. Per Entra spec, the idtyp claim is absent for user tokens and set to "app" for application/service principal tokens.
type GzipResponseWriter ¶
type GzipResponseWriter struct {
Writer io.Writer
ResponseWriter http.ResponseWriter
}
GzipResponseWriter wraps an http.ResponseWriter with a gzip writer.
func (*GzipResponseWriter) Close ¶
func (g *GzipResponseWriter) Close() error
Close closes the underlying gzip writer.
func (*GzipResponseWriter) Flush ¶
func (g *GzipResponseWriter) Flush()
Flush flushes the underlying gzip writer and response writer.
func (*GzipResponseWriter) Header ¶
func (g *GzipResponseWriter) Header() http.Header
Header returns the header map.
func (*GzipResponseWriter) Write ¶
func (g *GzipResponseWriter) Write(b []byte) (int, error)
Write writes the compressed data.
func (*GzipResponseWriter) WriteHeader ¶
func (g *GzipResponseWriter) WriteHeader(code int)
WriteHeader sends an HTTP response header with the provided status code.
type IdentityType ¶ added in v0.33.0
type IdentityType int
const ( IdentityTypeUnknown IdentityType = iota IdentityTypeUser IdentityTypeApp )
Source Files