Documentation
¶
Index ¶
- func CORSMiddleware(config CORSConfig) func(http.Handler) http.Handler
- func GetAuthContextFromRequest(r *http.Request) (*models.AuthContext, error)
- func GetUserFromRequest(r *http.Request) (*models.AuthenticatedUser, error)
- func LogAudit(client audit.Auditor, r *http.Request, resource string, resourceID *string, ...)
- func LogAuditEvent(r *http.Request, resource string, resourceID *string, status string)
- func NewCORSMiddleware() func(http.Handler) http.Handler
- type AuthorizationConfig
- type AuthorizationMiddleware
- func (a *AuthorizationMiddleware) AuthorizeRequest(next http.Handler) http.Handler
- func (a *AuthorizationMiddleware) CheckResourceOwnership(user *models.AuthenticatedUser, resourceOwnerIdpUserId string, ...) bool
- func (a *AuthorizationMiddleware) RequireAdminOrSystemRole() func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequireAdminRole() func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequireAnyRole(requiredRoles ...models.Role) func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequireMemberRole() func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequirePermission(requiredPermission models.Permission) func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequireRole(requiredRole models.Role) func(http.Handler) http.Handler
- func (a *AuthorizationMiddleware) RequireSystemRole() func(http.Handler) http.Handler
- type CORSConfig
- type JWK
- type JWKS
- type JWTAuthConfig
- type JWTAuthMiddleware
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CORSMiddleware ¶
func CORSMiddleware(config CORSConfig) func(http.Handler) http.Handler
CORSMiddleware creates a CORS middleware with the given configuration
func GetAuthContextFromRequest ¶
func GetAuthContextFromRequest(r *http.Request) (*models.AuthContext, error)
GetAuthContextFromRequest is a helper to extract the auth context from request context
func GetUserFromRequest ¶
func GetUserFromRequest(r *http.Request) (*models.AuthenticatedUser, error)
GetUserFromRequest is a helper to extract the authenticated user from request context
func LogAudit ¶
func LogAudit(client audit.Auditor, r *http.Request, resource string, resourceID *string, status string)
LogAudit logs an audit event for portal-backend operations by extracting request info and creating an audit log
func LogAuditEvent ¶
LogAuditEvent - global function for easy access from handlers
Types ¶
type AuthorizationConfig ¶
type AuthorizationConfig struct {
// Mode defines the behavior when no explicit permission is defined for an endpoint
Mode models.AuthorizationMode
// StrictMode when true, logs warnings about undefined endpoints in production
StrictMode bool
}
AuthorizationConfig configures the authorization middleware behavior
type AuthorizationMiddleware ¶
type AuthorizationMiddleware struct {
// contains filtered or unexported fields
}
AuthorizationMiddleware provides role-based access control functionality
func NewAuthorizationMiddleware ¶
func NewAuthorizationMiddleware() *AuthorizationMiddleware
NewAuthorizationMiddleware creates a new authorization middleware with default configuration
func NewAuthorizationMiddlewareWithConfig ¶
func NewAuthorizationMiddlewareWithConfig(config AuthorizationConfig) *AuthorizationMiddleware
NewAuthorizationMiddlewareWithConfig creates a new authorization middleware with custom configuration
func (*AuthorizationMiddleware) AuthorizeRequest ¶
func (a *AuthorizationMiddleware) AuthorizeRequest(next http.Handler) http.Handler
AuthorizeRequest returns a middleware function that checks user permissions for endpoints
func (*AuthorizationMiddleware) CheckResourceOwnership ¶
func (a *AuthorizationMiddleware) CheckResourceOwnership(user *models.AuthenticatedUser, resourceOwnerIdpUserId string, permission models.Permission) bool
CheckResourceOwnership is a helper function to be used in handlers to verify resource ownership
func (*AuthorizationMiddleware) RequireAdminOrSystemRole ¶
func (a *AuthorizationMiddleware) RequireAdminOrSystemRole() func(http.Handler) http.Handler
RequireAdminOrSystemRole requires either admin or system role
func (*AuthorizationMiddleware) RequireAdminRole ¶
func (a *AuthorizationMiddleware) RequireAdminRole() func(http.Handler) http.Handler
RequireAdminRole is a convenience middleware that requires admin role
func (*AuthorizationMiddleware) RequireAnyRole ¶
func (a *AuthorizationMiddleware) RequireAnyRole(requiredRoles ...models.Role) func(http.Handler) http.Handler
RequireAnyRole returns a middleware that requires any of the specified roles
func (*AuthorizationMiddleware) RequireMemberRole ¶
func (a *AuthorizationMiddleware) RequireMemberRole() func(http.Handler) http.Handler
RequireMemberRole is a convenience middleware that requires member role
func (*AuthorizationMiddleware) RequirePermission ¶
func (a *AuthorizationMiddleware) RequirePermission(requiredPermission models.Permission) func(http.Handler) http.Handler
RequirePermission returns a middleware that requires a specific permission
func (*AuthorizationMiddleware) RequireRole ¶
func (a *AuthorizationMiddleware) RequireRole(requiredRole models.Role) func(http.Handler) http.Handler
RequireRole returns a middleware that requires a specific role
func (*AuthorizationMiddleware) RequireSystemRole ¶
func (a *AuthorizationMiddleware) RequireSystemRole() func(http.Handler) http.Handler
RequireSystemRole is a convenience middleware that requires system role
type CORSConfig ¶
type CORSConfig struct {
AllowedOrigins []string
AllowedMethods []string
AllowedHeaders []string
ExposedHeaders []string
AllowCredentials bool
MaxAge int
}
CORSConfig holds the CORS configuration
func DefaultCORSConfig ¶
func DefaultCORSConfig() CORSConfig
DefaultCORSConfig returns the default CORS configuration
type JWK ¶
type JWK struct {
Kty string `json:"kty"`
Kid string `json:"kid"`
Use string `json:"use"`
Alg string `json:"alg"`
N string `json:"n"`
E string `json:"e"`
}
JWK represents a single JSON Web Key
type JWKS ¶
type JWKS struct {
Keys []JWK `json:"keys"`
}
JWKS represents the JSON Web Key Set structure
type JWTAuthConfig ¶
type JWTAuthConfig struct {
JWKSURL string
ExpectedIssuer string
ValidClientIDs []string // Multiple valid client IDs for different portals
Timeout time.Duration
// JWKSInsecureSkipVerify disables TLS certificate verification when
// fetching the JWKS. Local-dev only (e.g. ThunderID's self-signed cert,
// see consent-engine's IDP_JWKS_INSECURE_SKIP_VERIFY for the same need) —
// never enable against a real deployment.
JWKSInsecureSkipVerify bool
}
JWTAuthConfig contains configuration for JWT authentication
func (JWTAuthConfig) Validate ¶
func (c JWTAuthConfig) Validate() error
Validate checks if the JWT configuration is valid
type JWTAuthMiddleware ¶
type JWTAuthMiddleware struct {
// contains filtered or unexported fields
}
JWTAuthMiddleware provides JWT authentication functionality Thread-safe: All methods can be called concurrently from multiple goroutines
func NewJWTAuthMiddleware ¶
func NewJWTAuthMiddleware(config JWTAuthConfig) *JWTAuthMiddleware
NewJWTAuthMiddleware creates a new JWT authentication middleware
func (*JWTAuthMiddleware) AuthenticateJWT ¶
func (j *JWTAuthMiddleware) AuthenticateJWT(next http.Handler) http.Handler
AuthenticateJWT returns a middleware function that validates JWT tokens
Source Files