Documentation
¶
Overview ¶
Package authkitgin bridges AuthKit's net/http middleware to gin. Route mounting is NOT here (#250): build the whole surface with authhttp.MountHandler and mount it once via gin.WrapH.
Index ¶
- func Fallback(h http.Handler) gin.HandlerFunc
- func Optional(v *verify.Verifier) gin.HandlerFunc
- func Principal(c *gin.Context) (authkit.Principal, bool)
- func RequirePermission(checker verify.PermissionChecker, perm authkit.Perm, ...) gin.HandlerFunc
- func Required(v *verify.Verifier) gin.HandlerFunc
- func RequiredLive(v *verify.Verifier) (gin.HandlerFunc, error)
- func Use(mw ...func(http.Handler) http.Handler) gin.HandlerFunc
- type UserClaimsData
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Fallback ¶
func Fallback(h http.Handler) gin.HandlerFunc
Fallback adapts a neutral handler (authhttp.MountHandler) for use as a gin NoRoute fallback. gin pre-sets 404 on the response before running NoRoute handlers, which silently overrides any handler that relies on the implicit 200-on-first-write; this clears the pending status so the mounted handler's own status wins (its 404s still 404).
router.NoRoute(authkitgin.Fallback(mount))
For explicit wildcard mounts (r.Any("/oidc/*path", …)) plain gin.WrapH is fine — gin only pre-sets 404 on the NoRoute path.
func Optional ¶
func Optional(v *verify.Verifier) gin.HandlerFunc
Optional is the gin-native form of verify.Optional (#209): parses and stores claims when a valid Bearer token is present, and passes through anonymously otherwise. See Required for usage.
func RequirePermission ¶
func RequirePermission(checker verify.PermissionChecker, perm authkit.Perm, resolve func(*gin.Context) verify.PermissionScope) gin.HandlerFunc
func Required ¶
func Required(v *verify.Verifier) gin.HandlerFunc
Required is the gin-native form of verify.Required (#209): validates the Bearer token and stores claims in the request context, aborting with the verifier's 401 on failure. Use it directly on gin routes/groups instead of hand-writing an http.Handler↔gin.HandlerFunc shim:
api := r.Group("/api", authkitgin.Required(verifier))
func RequiredLive ¶
func RequiredLive(v *verify.Verifier) (gin.HandlerFunc, error)
RequiredLive is the gin-native form of verify.RequiredLive (#267): Required plus a per-request account-liveness gate, so a banned or deleted user is rejected on their next request and the handler reads fresh identity claims. Returns verify.ErrLivenessUnconfigured when the verifier has no LivenessSource wired.
Source Files