auth

type Authenticator ¶

type Authenticator interface {
	Authenticate(ctx context.Context, endpoint *config.Endpoint, username, password string, op Operation) (Result, error)
}

Authenticator validates credentials and checks authorisation for an endpoint.

Implementations must return Result{Authenticated: false} (not an error) when the provided credentials are invalid. Errors should only be returned for transient failures such as network errors or upstream service outages. The username parameter may be ignored by implementations where the token is self-authenticating (e.g., GitHub PATs).

type GitHub ¶

type GitHub struct {
	// contains filtered or unexported fields
}

GitHub authenticates users by validating their token against the GitHub API. Successful authentication results are cached to reduce API calls.

func NewGitHub(httpClient *http.Client, cacheTTL time.Duration, baseURL *url.URL) *GitHub

func (g *GitHub) Authenticate(ctx context.Context, endpoint *config.Endpoint, _ string, password string, op Operation) (Result, error)

func (g *GitHub) Close() error

type None ¶

type None struct{}

None is an authenticator that permits all operations without credentials.

func (n *None) Authenticate(_ context.Context, _ *config.Endpoint, username, _ string, _ Operation) (Result, error)

type Operation ¶

type Operation string

Operation represents an LFS operation type (download or upload).

const (
	OperationDownload Operation = "download"
	OperationUpload   Operation = "upload"
)

type Result ¶

type Result struct {
	// Authenticated indicates the user provided valid credentials.
	Authenticated bool
	// Authorized indicates the user has permission for the requested operation.
	Authorized bool
	// Username identifies the authenticated user (used for lock ownership).
	Username string
}

Result represents the outcome of an authentication attempt.