auth

package

v2.1.2 Latest Latest Go to latest Published: Sep 5, 2026 License: MIT Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/osauer/hyperserve

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth provides the small authentication boundary needed by HTTP applications without owning identity-provider setup, sessions, or application authorization.

Index ¶

Variables
func Require(authenticator Authenticator) func(http.Handler) http.Handler
type Authenticator
- func Bearer(verifier TokenVerifier) Authenticator
type AuthenticatorFunc
- func (f AuthenticatorFunc) Authenticate(r *http.Request) (Principal, error)
type Principal
- func PrincipalFromContext(ctx context.Context) (Principal, bool)
- func PrincipalFromRequest(r *http.Request) (Principal, bool)
- func (p Principal) Valid() bool
type TokenVerifier
type TokenVerifierFunc
- func (f TokenVerifierFunc) VerifyToken(ctx context.Context, token string) (Principal, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrUnauthenticated = errors.New("unauthenticated")

ErrUnauthenticated reports absent, invalid, or expired credentials. An Authenticator should wrap this error when the client may safely retry with different credentials. Other errors are treated as internal failures.

Functions ¶

func Require ¶

func Require(authenticator Authenticator) func(http.Handler) http.Handler

Require authenticates each request and places its Principal in the request context. Authentication failures receive 401; provider or configuration failures receive a generic 500 without leaking details.

Types ¶

type Authenticator ¶

type Authenticator interface {
	Authenticate(*http.Request) (Principal, error)
}

Authenticator establishes the principal for an HTTP request.

func Bearer ¶

func Bearer(verifier TokenVerifier) Authenticator

Bearer builds an Authenticator for RFC 6750 Authorization headers.

type AuthenticatorFunc ¶

type AuthenticatorFunc func(*http.Request) (Principal, error)

AuthenticatorFunc adapts a named function to Authenticator, following the same interface-plus-function pattern as http.Handler and http.HandlerFunc.

func (AuthenticatorFunc) Authenticate ¶

func (f AuthenticatorFunc) Authenticate(r *http.Request) (Principal, error)

Authenticate calls f(r).

type Principal ¶

type Principal struct {
	Issuer  string
	Subject string
}

Principal identifies one authenticated subject. Issuer and Subject form the stable identity key used by OpenID Connect and prevent subject collisions between identity providers.

func PrincipalFromContext ¶

func PrincipalFromContext(ctx context.Context) (Principal, bool)

PrincipalFromContext returns the principal established by Require.

func PrincipalFromRequest ¶

func PrincipalFromRequest(r *http.Request) (Principal, bool)

PrincipalFromRequest returns the principal established for r.

func (Principal) Valid ¶

func (p Principal) Valid() bool

Valid reports whether the principal has a complete stable identity.

type TokenVerifier ¶

type TokenVerifier interface {
	VerifyToken(context.Context, string) (Principal, error)
}

TokenVerifier validates a bearer token and returns its stable principal. OIDC and other federated adapters can implement this interface without coupling provider-specific claims to the server package.

type TokenVerifierFunc ¶

type TokenVerifierFunc func(context.Context, string) (Principal, error)

TokenVerifierFunc adapts a named function to TokenVerifier.

func (TokenVerifierFunc) VerifyToken ¶

func (f TokenVerifierFunc) VerifyToken(ctx context.Context, token string) (Principal, error)

VerifyToken calls f(ctx, token).

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL