auth

type APIKey ¶

type APIKey struct {
	In    string // header | query | cookie
	Name  string
	Value string
}

APIKey puts the key where the API expects it: header, query or cookie.

func (k APIKey) Apply(_ context.Context, req *http.Request) error

type Applier ¶

type Applier interface {
	Apply(ctx context.Context, req *http.Request) error
}

Applier stamps identity onto a request that is about to go out.

type Basic ¶

type Basic struct{ User, Password string }

Basic sets `Authorization: Basic <base64(user:password)>`.

func (b Basic) Apply(_ context.Context, req *http.Request) error

type Bearer ¶

type Bearer struct{ Token string }

Bearer sets `Authorization: Bearer <token>`.

func (b Bearer) Apply(_ context.Context, req *http.Request) error

type Flow ¶

type Flow struct {
	// URL of the endpoint that issues the token.
	URL string
	// Fields sent as form-urlencoded, which is what authentication endpoints usually accept.
	Fields map[string]string
	// TokenPath says where the token sits in the JSON response, as nested keys.
	// E.g. {"data":{"token":"x"}} → []string{"data","token"}.
	TokenPath []string
	// TTL is how long the token is valid. The renewal margin is derived from it.
	TTL time.Duration
	// Client is injectable for tests.
	Client *http.Client
	// contains filtered or unexported fields
}

Flow is dynamic auth: it trades credentials for a short-lived token and renews it on its own.

The token is kept in memory and renewed BEFORE it expires, with a margin. Renewing on a 401 would also work, but it burns one call every couple of hours and turns a predictable event into a visible failure for whoever is on the other side.

func (f *Flow) Apply(ctx context.Context, req *http.Request) error

func (f *Flow) Invalidate()

type None ¶

type None struct{}

None authenticates nothing — public APIs exist.

func (None) Apply(context.Context, *http.Request) error