auth

type CallerIdentityConfig ¶ added in v0.3.0

type CallerIdentityConfig struct {
	JWTIdentityClaim string
	HeaderName       string
}

CallerIdentityConfig controls how the caller identity is resolved for audit fields. Identity resolution is enabled by setting the relevant fields:

• HeaderName: when non-empty, the named HTTP header is checked first
• JWTIdentityClaim: when non-empty, the JWT claim is used as fallback (or primary when no header is configured)

type CallerIdentityMiddleware ¶ added in v0.3.0

type CallerIdentityMiddleware interface {
	ResolveCallerIdentity(next http.Handler) http.Handler
}

CallerIdentityMiddleware resolves and attaches the caller identity used for audit fields.

func NewCallerIdentityMiddleware(cfg CallerIdentityConfig) (CallerIdentityMiddleware, error)

type JWTHandler ¶ added in v0.3.0

type JWTHandler struct {
	// contains filtered or unexported fields
}

JWTHandler validates JWT tokens on incoming requests. Call Close() during shutdown to stop the background JWKS refresh goroutine.

func NewJWTHandler(ctx context.Context, cfg JWTHandlerConfig) (*JWTHandler, error)

func (h *JWTHandler) Close()

func (h *JWTHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

type JWTHandlerConfig ¶ added in v0.3.0

type JWTHandlerConfig struct {
	Next        http.Handler
	KeysFile    string
	KeysURL     string
	IssuerURL   string
	Audience    string
	PublicPaths []string
}

type Payload ¶

type Payload struct {
	Username  string `json:"username"`
	FirstName string `json:"first_name"`
	LastName  string `json:"last_name"`
	Email     string `json:"email"`
	Issuer    string `json:"iss"`
	ClientID  string `json:"clientId"`
}

Payload defines the structure of the JWT payload we expect

func GetAuthPayload(r *http.Request) (*Payload, error)

func GetAuthPayloadFromContext(ctx context.Context) (*Payload, error)