auth

type APIKey ¶

type APIKey struct {
	In    string // header | query | cookie
	Name  string
	Value string
}

APIKey puts the key where the API expects it: header, query or cookie.

func (k APIKey) Apply(_ context.Context, req *http.Request) error

type Applier ¶

type Applier interface {
	Apply(ctx context.Context, req *http.Request) error
}

Applier stamps identity onto a request that is about to go out.

type Basic ¶

type Basic struct{ User, Password string }

Basic sets `Authorization: Basic <base64(user:password)>`.

func (b Basic) Apply(_ context.Context, req *http.Request) error

type Bearer ¶

type Bearer struct{ Token string }

Bearer sets `Authorization: Bearer <token>`.

func (b Bearer) Apply(_ context.Context, req *http.Request) error

type Flow ¶

type Flow struct {
	// URL of the endpoint that issues the token.
	URL string
	// Fields sent as form-urlencoded, which is what authentication endpoints usually accept.
	Fields map[string]string
	// TokenPath says where the token sits in the JSON response, as nested keys.
	// E.g. {"data":{"token":"x"}} → []string{"data","token"}.
	TokenPath []string
	// TTL is how long the token is valid. The renewal margin is derived from it.
	TTL time.Duration
	// Client is injectable for tests.
	Client *http.Client
	// contains filtered or unexported fields
}

Flow is dynamic auth: it trades credentials for a short-lived token and renews it on its own.

The token is kept in memory and renewed BEFORE it expires, with a margin. Renewing on a 401 would also work, but it burns one call every couple of hours and turns a predictable event into a visible failure for whoever is on the other side.

func (f *Flow) Apply(ctx context.Context, req *http.Request) error

func (f *Flow) Invalidate()

type None ¶

type None struct{}

None authenticates nothing — public APIs exist.

func (None) Apply(context.Context, *http.Request) error

type Signature ¶ added in v1.3.0

type Signature struct {
	// Algo is `sha256` (plain hash of the payload) or `hmac-sha256` (keyed by Secret).
	Algo string
	// Payload is the template of the string to sign.
	Payload string
	// Into says where the signature goes: `header:Name=template` or `query:name=template`.
	Into string

	AppID  string
	Secret string
}

Signature is per-request authentication: instead of carrying a fixed token, each call is signed over its own content. Shopee's affiliate API and TikTok Shop's both work this way, and no amount of bearer/apikey configuration reaches them — the credential is not a value, it is a computation.

The shapes differ (Shopee hashes appId+timestamp+body+secret into an Authorization header; TikTok HMACs path+query+body into a `sign` query parameter), so what is configurable here is the RECIPE: which algorithm, which string gets signed, and where the result goes.

Placeholders, usable in both Payload and Into:

{app_id} {secret}     the credentials
{timestamp}           unix seconds, computed per request
{body} {path} {query} the request itself ({query} sorted, `k=v` joined, no separator)
{signature}           the result (Into only)

func (s Signature) Apply(_ context.Context, req *http.Request) error