Documentation
¶
Overview ¶
Package http connects typed security contracts to net/http. It neither chooses a credential scheme nor imposes a principal type.
Index ¶
- func ErrorRules() []pfwhttp.Rule
- type CredentialExtractor
- type Middleware
- func (m *Middleware[C, I, P]) Optional(next stdhttp.Handler) stdhttp.Handler
- func (m *Middleware[C, I, P]) OptionalRequest(r *stdhttp.Request) (*stdhttp.Request, error)
- func (m *Middleware[C, I, P]) Required(next stdhttp.Handler) stdhttp.Handler
- func (m *Middleware[C, I, P]) RequiredRequest(r *stdhttp.Request) (*stdhttp.Request, error)
- type RequestAuthenticator
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ErrorRules ¶
ErrorRules maps wrapped security errors to safe HTTP responses. Register these rules in the same mapper used by middleware, controllers and router adapters. Operational errors are left to the mapper's normal fallback.
Types ¶
type CredentialExtractor ¶
CredentialExtractor reads credentials without authenticating them. Return ErrMissingCredentials only when absent, ErrInvalidCredentials when malformed. Extractors must be safe for concurrent use and must not consume the body unless the application's handler contract explicitly allows that.
type Middleware ¶
type Middleware[C, I, P any] struct { // contains filtered or unexported fields }
Middleware composes extraction, authentication and principal resolution. Dependencies must be non-nil (including values inside interfaces) and safe for concurrent use. No credentials or principals are kept on the middleware.
func NewMiddleware ¶
func NewMiddleware[C, I, P any](extractor CredentialExtractor[C], authenticator security.Authenticator[C, I], resolver security.PrincipalResolver[I, P], mapper pfwhttp.ErrorMapper) (*Middleware[C, I, P], error)
NewMiddleware uses the supplied mapper unchanged; it must include ErrorRules if standard security responses are desired. A nil mapper selects those rules and the safe 500 fallback. Default structured logging reports server errors.
func (*Middleware[C, I, P]) Optional ¶
func (m *Middleware[C, I, P]) Optional(next stdhttp.Handler) stdhttp.Handler
Optional permits anonymous requests only when credentials are absent.
func (*Middleware[C, I, P]) OptionalRequest ¶
OptionalRequest allows only absent credentials to proceed anonymously. Malformed/rejected credentials and resolver failures remain errors. Any upstream principal of P is masked before processing this boundary.
func (*Middleware[C, I, P]) Required ¶
func (m *Middleware[C, I, P]) Required(next stdhttp.Handler) stdhttp.Handler
Required protects a net/http handler with mandatory authentication.
func (*Middleware[C, I, P]) RequiredRequest ¶
RequiredRequest authenticates a request; absent credentials are an error.
type RequestAuthenticator ¶
type RequestAuthenticator interface {
RequiredRequest(*stdhttp.Request) (*stdhttp.Request, error)
OptionalRequest(*stdhttp.Request) (*stdhttp.Request, error)
}
RequestAuthenticator is the transport bridge used by router adapters. On success the returned request has the authenticated or anonymous context.
Source Files