Documentation
¶
Index ¶
- func CanAccessResource(user *models.AuthenticatedUser, permission models.Permission, ...) bool
- func ExtractBearerToken(r *http.Request) (string, error)
- func FindEndpointPermission(method, path string) (*models.EndpointPermission, bool)
- func GetAuthContext(ctx context.Context) (*models.AuthContext, error)
- func GetAuthenticatedUser(ctx context.Context) (*models.AuthenticatedUser, error)
- func GetRequestIP(r *http.Request) string
- func IsOwner(user *models.AuthenticatedUser, resourceOwnerIdpUserId string) bool
- func IsOwnerOrAdmin(user *models.AuthenticatedUser, resourceOwnerIdpUserId string) bool
- func MatchesEndpoint(requestPath, endpointPattern string) bool
- func RequireAnyRole(r *http.Request, requiredRoles ...models.Role) (*models.AuthenticatedUser, error)
- func RequireAuthentication(r *http.Request) (*models.AuthenticatedUser, error)
- func RequirePermission(r *http.Request, requiredPermission models.Permission) (*models.AuthenticatedUser, error)
- func RequireRole(r *http.Request, requiredRole models.Role) (*models.AuthenticatedUser, error)
- func ResetEndpointCacheForTesting()
- func SetAuthContext(ctx context.Context, authCtx *models.AuthContext) context.Context
- func SetAuthenticatedUser(ctx context.Context, user *models.AuthenticatedUser) context.Context
- type AuthContextKey
- type GraphQLHandler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CanAccessResource ¶
func CanAccessResource(user *models.AuthenticatedUser, permission models.Permission, resourceOwnerIdpUserId string) bool
CanAccessResource determines if a user can access a resource based on: 1. Admin role (can access everything) 2. System role (read-only access to most resources) 3. Member role with ownership (can access their own resources)
func ExtractBearerToken ¶
ExtractBearerToken extracts the Bearer token from the Authorization header
func FindEndpointPermission ¶
func FindEndpointPermission(method, path string) (*models.EndpointPermission, bool)
FindEndpointPermission finds the required permission for a given HTTP method and path Uses an optimized lookup structure with O(1) for exact matches and minimal linear search for wildcards Performance: ~36ns/op with 0 allocations (significant improvement over linear search as endpoints scale)
func GetAuthContext ¶
func GetAuthContext(ctx context.Context) (*models.AuthContext, error)
GetAuthContext retrieves the auth context from request context
func GetAuthenticatedUser ¶
func GetAuthenticatedUser(ctx context.Context) (*models.AuthenticatedUser, error)
GetAuthenticatedUser retrieves the authenticated user from request context
func GetRequestIP ¶
GetRequestIP extracts the client IP address from the request
func IsOwner ¶
func IsOwner(user *models.AuthenticatedUser, resourceOwnerIdpUserId string) bool
IsOwner checks if the authenticated user owns the resource by comparing their IdP user ID This is used for resource-level authorization
func IsOwnerOrAdmin ¶
func IsOwnerOrAdmin(user *models.AuthenticatedUser, resourceOwnerIdpUserId string) bool
IsOwnerOrAdmin checks if the user is either the owner of the resource or has admin role
func MatchesEndpoint ¶
MatchesEndpoint checks if a request path matches an endpoint pattern Supports wildcard matching with *
func RequireAnyRole ¶
func RequireAnyRole(r *http.Request, requiredRoles ...models.Role) (*models.AuthenticatedUser, error)
RequireAnyRole checks if the authenticated user has any of the required roles
func RequireAuthentication ¶
func RequireAuthentication(r *http.Request) (*models.AuthenticatedUser, error)
RequireAuthentication is a helper that checks if a user is authenticated
func RequirePermission ¶
func RequirePermission(r *http.Request, requiredPermission models.Permission) (*models.AuthenticatedUser, error)
RequirePermission checks if the authenticated user has the required permission
func RequireRole ¶
RequireRole checks if the authenticated user has the required role
func ResetEndpointCacheForTesting ¶
func ResetEndpointCacheForTesting()
ResetEndpointCacheForTesting resets the endpoint cache for testing purposes This function should only be used in tests to reset the sync.Once state
func SetAuthContext ¶
SetAuthContext sets the auth context in request context
func SetAuthenticatedUser ¶
SetAuthenticatedUser sets the authenticated user in request context
Types ¶
type AuthContextKey ¶
type AuthContextKey string
AuthContextKey is the key used to store authentication context in request context
const ( AuthContextKeyUser AuthContextKey = "authenticated_user" AuthContextKeyAuth AuthContextKey = "auth_context" )
type GraphQLHandler ¶
type GraphQLHandler struct{}
GraphQLHandler handles GraphQL SDL parsing and conversion to policy metadata requests
func NewGraphQLHandler ¶
func NewGraphQLHandler() *GraphQLHandler
NewGraphQLHandler creates a new GraphQLHandler instance
func (*GraphQLHandler) ParseSDLToPolicyRequest ¶
func (h *GraphQLHandler) ParseSDLToPolicyRequest(schemaID, sdl string) (*models.PolicyMetadataCreateRequest, error)
ParseSDLToPolicyRequest parses GraphQL SDL and creates a PolicyMetadataCreateRequest
Source Files