auth

package

v0.26.0 Latest Latest Go to latest Published: Aug 28, 2026 License: BSD-3-Clause-Clear Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/opentdf/platform

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func ContextWithAuthNInfo(ctx context.Context, key jwk.Key, accessToken jwt.Token, raw string) context.Context
func ContextWithPublicRoute(ctx context.Context, publicRoute bool) context.Context
func EnrichIncomingContextMetadataWithAuthn(ctx context.Context, l optionalErrorLogger, clientID string) context.Context
func GetAccessTokenFromContext(ctx context.Context, l optionalErrorLogger) jwt.Token
func GetClientIDFromContext(ctx context.Context, incoming bool) (string, error)
func GetJWKFromContext(ctx context.Context, l optionalErrorLogger) jwk.Key
func GetRawAccessTokenFromContext(ctx context.Context, l optionalErrorLogger) string
func PublicRouteFromContext(ctx context.Context) (bool, bool)
type Principal
- func PrincipalFromContext(ctx context.Context) (Principal, bool)

Constants ¶

View Source

const (
	AccessTokenKey = "access_token"
	ClientIDKey    = "client_id"
)

Variables ¶

View Source

var (
	ErrNoMetadataFound  = errors.New("no metadata found within context")
	ErrMissingClientID  = errors.New("missing authn idP clientID")
	ErrConflictClientID = errors.New("context metadata mistakenly has more than one authn idP clientID")
)

Functions ¶

func ContextWithAuthNInfo ¶

func ContextWithAuthNInfo(ctx context.Context, key jwk.Key, accessToken jwt.Token, raw string) context.Context

func ContextWithPublicRoute ¶ added in v0.17.0

func ContextWithPublicRoute(ctx context.Context, publicRoute bool) context.Context

ContextWithPublicRoute returns a child context carrying whether the request matched a configured public route.

func EnrichIncomingContextMetadataWithAuthn ¶ added in v0.11.0

func EnrichIncomingContextMetadataWithAuthn(ctx context.Context, l optionalErrorLogger, clientID string) context.Context

EnrichIncomingContextMetadataWithAuthn adds the access token and client ID to incoming context metadata

This transports an already-authenticated token across internal hops. It does not validate the token again; the ConnectUnaryServerInterceptor auth middleware does that before ContextWithAuthNInfo is created.

func GetAccessTokenFromContext ¶

func GetAccessTokenFromContext(ctx context.Context, l optionalErrorLogger) jwt.Token

func GetClientIDFromContext ¶ added in v0.11.0

func GetClientIDFromContext(ctx context.Context, incoming bool) (string, error)

GetClientIDFromContext retrieves the client ID from the metadata in the context

func GetJWKFromContext ¶

func GetJWKFromContext(ctx context.Context, l optionalErrorLogger) jwk.Key

func GetRawAccessTokenFromContext ¶

func GetRawAccessTokenFromContext(ctx context.Context, l optionalErrorLogger) string

func PublicRouteFromContext ¶ added in v0.17.0

func PublicRouteFromContext(ctx context.Context) (bool, bool)

PublicRouteFromContext returns whether the request matched a configured public route, if that state has been set by auth middleware.

Types ¶

type Principal ¶ added in v0.26.0

type Principal struct {
	Subject string
	Issuer  string
}

Principal identifies the authenticated requester established by token verification. It is intentionally separate from audit event subjects, which may describe an entity being evaluated rather than the requester.

func PrincipalFromContext ¶ added in v0.26.0

func PrincipalFromContext(ctx context.Context) (Principal, bool)

PrincipalFromContext returns the verified requester identity installed by authentication. Header metadata is never considered a principal source.

Source Files ¶

View all Source files

context_auth.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL