authhttp

type Config struct {
	Accounts *account.Service
	Sessions *session.Manager
	// APIKeys is optional. Without it the key endpoints are not mounted and a
	// key presented as a credential is refused, which is the right behavior for
	// a project that skipped that part of the foundation.
	APIKeys *apikey.Manager

	// AuditLog reads what was recorded. Nil leaves GET <base>/audit unmounted —
	// absent rather than answering 403, so there is nothing to probe, which is
	// the same choice registration and tenant creation make.
	//
	// A reader and not the [github.com/simonjanss/rig/auth/authlog.Log] every
	// other part of this package writes to. The write path discards its failures
	// on purpose and a read cannot, so they are two interfaces; one
	// implementation usually satisfies both.
	AuditLog authlog.Reader

	// Tenant resolves which tenant a request belongs to.
	//
	// There is no default, because there is no sensible one: a subdomain, a
	// header, and a path segment are all reasonable and only the application
	// knows which it uses. Guessing would mean guessing wrong for somebody.
	Tenant func(*http.Request) (uuid.UUID, error)

	// Identities verifies the tenant-less credential the tenant picker runs
	// on. Nil leaves the picker endpoints unmounted and refuses an identity
	// token, which is right for a project where every session names a tenant.
	Identities *session.IdentityManager

	// AllowTenantCreation mounts POST /auth/tenants, where somebody holding an
	// identity session makes one and is signed into it as its Owner.
	//
	// Off by default. What a new tenant consists of beyond the row and its first
	// account is [account.TenantOptions.OnCreated]; whether anybody may make one
	// at all is [account.TenantOptions.Allow]. This only decides whether the route
	// exists — off means absent rather than 403, so there is nothing to probe.
	AllowTenantCreation bool

	// AllowEmailCode mounts POST /auth/email-code and
	// POST /auth/email-code/verify, the sign-in for somebody with no account at
	// a configured provider.
	//
	// Off by default. Off means the endpoints do not exist rather than
	// answering 403, so nothing is there to probe — and a deployment with no
	// provider and this off has no way in at all, which rig does not refuse
	// because a service that only provisions and invites is a legitimate thing
	// to build.
	//
	// Whether a code may go to an address rig has never seen is a separate
	// decision, and it lives on the account service:
	// [github.com/simonjanss/rig/auth/account.EmailCodeOptions.AllowProvisioning].
	AllowEmailCode bool

	// Grants fills in a caller's roles and permissions. Nil means every
	// authenticated caller has none, which makes any endpoint with a permission
	// requirement answer 403 — correct, and confusing enough that it is worth
	// saying here.
	Grants Grants

	// BasePath prefixes every route. It defaults to /auth.
	BasePath string

	// OnError renders a failure. Nil uses a small default; an application that
	// already has an error shape should pass its own so that authentication
	// failures look like every other failure.
	OnError func(w http.ResponseWriter, r *http.Request, err error)

	// TrustedProxies are the networks whose X-Forwarded-For headers may be
	// believed.
	//
	// Empty means none, and that is the safe default: an address read out of a
	// header a client controls is an address a client chooses, and rate limits
	// keyed on it are rate limits an attacker can walk straight around.
	TrustedProxies []netip.Prefix
}

type Grants func(ctx context.Context, tenantID, accountID uuid.UUID) (roles, permissions []string, err error)

type Handler struct {
	// contains filtered or unexported fields
}