Documentation
¶
Overview ¶
Package claims owns a per-process map of custom JWT claims that get merged into every access token minted by the authapi package.
Tests use POST /admin0/claims (and friends) to shape the claim payload at runtime without restarting the service.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type MappingStore ¶ added in v0.231.0
type MappingStore struct {
// contains filtered or unexported fields
}
MappingStore holds the active request-parameter → claim-name mappings. When a mapping is registered, /oauth/token projects the value of the named request-body parameter into the minted access token under the mapped claim name. An empty store means the feature is off and tokens mint exactly as before. Safe for concurrent use.
Tests use PUT /admin0/claims/mappings to shape the mapping at runtime without restarting the service.
func NewMappingStore ¶ added in v0.231.0
func NewMappingStore() *MappingStore
NewMappingStore returns an empty MappingStore.
func (*MappingStore) Clear ¶ added in v0.231.0
func (s *MappingStore) Clear()
Clear removes all mappings.
func (*MappingStore) Get ¶ added in v0.231.0
func (s *MappingStore) Get() map[string]string
Get returns a snapshot of the current mapping.
func (*MappingStore) Project ¶ added in v0.231.0
func (s *MappingStore) Project(params map[string]any, dst map[string]any)
Project copies each mapped request parameter present in params into dst under its claim name. Parameters absent from params are skipped, and params keys with no registered mapping are ignored — the mapping is an allowlist, so arbitrary request keys can't inject claims. Projected values overwrite existing keys in dst, giving per-request parameters final precedence over the global claims store.
Parameters are applied in lexicographic order so projection is deterministic: if two mapped parameters target the same claim and both appear in the request, the parameter that sorts last wins. (Random map iteration order would make such a mint a coin flip — poison for a testing tool.)
func (*MappingStore) Set ¶ added in v0.231.0
func (s *MappingStore) Set(mappings map[string]string)
Set replaces the entire mapping.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store holds the active custom claims. Safe for concurrent use.
Source Files