auth

func AnonymousMiddleware ¶ added in v0.0.38

func AnonymousMiddleware(next http.Handler) http.Handler

AnonymousMiddleware creates an HTTP middleware that sets up anonymous claims. This is useful for testing and local environments where authorization policies need to work without requiring actual authentication.

The middleware sets up basic anonymous claims that can be used by authorization policies, allowing them to function even when authentication is disabled. This is heavily discouraged in production settings but is handy for testing and local development environments.

func CreateMiddleware ¶ added in v0.2.8

func CreateMiddleware(config *types.MiddlewareConfig, runner types.MiddlewareRunner) error

CreateMiddleware factory function for authentication middleware

func EscapeQuotes ¶ added in v0.2.13

func EscapeQuotes(s string) string

EscapeQuotes escapes quotes in a string for use in a quoted-string context.

func ExtractBearerToken ¶ added in v0.5.2

func ExtractBearerToken(r *http.Request) (string, error)

ExtractBearerToken extracts and validates a Bearer token from the Authorization header. It performs the following validations:

1. Verifies the Authorization header is present
2. Checks for the "Bearer " prefix (case-sensitive per RFC 6750)
3. Ensures the token is not empty after removing the prefix

The function returns the token string (without "Bearer " prefix) and any validation error. Callers are responsible for further token validation (JWT parsing, introspection, etc.) and for converting errors to appropriate HTTP responses.

This function implements RFC 6750 Section 2.1 (Bearer Token Authorization Header). See: https://datatracker.ietf.org/doc/html/rfc6750#section-2.1

func GetAuthenticationMiddleware ¶ added in v0.0.38

func GetAuthenticationMiddleware(ctx context.Context, oidcConfig *TokenValidatorConfig,
) (func(http.Handler) http.Handler, http.Handler, error)

GetAuthenticationMiddleware returns the appropriate authentication middleware based on the configuration. If OIDC config is provided, it returns JWT middleware. Otherwise, it returns local user middleware.

func GetClaimsFromContext ¶ added in v0.0.38

func GetClaimsFromContext(ctx context.Context) (jwt.MapClaims, bool)

GetClaimsFromContext retrieves the claims from the request context. This is a helper function that can be used by authorization policies to access the claims regardless of which middleware was used (JWT, anonymous, or local).

Returns the claims and a boolean indicating whether claims were found.

func LocalUserMiddleware ¶ added in v0.0.38

func LocalUserMiddleware(username string) func(http.Handler) http.Handler

LocalUserMiddleware creates an HTTP middleware that sets up local user claims. This allows specifying a local username while still bypassing authentication.

This middleware is useful for development and testing scenarios where you want to simulate a specific user without going through the full authentication flow. Like AnonymousMiddleware, this is heavily discouraged in production settings.

func NewAuthInfoHandler ¶ added in v0.2.4

func NewAuthInfoHandler(issuer, jwksURL, resourceURL string, scopes []string) http.Handler

NewAuthInfoHandler creates an HTTP handler that returns RFC-9728 compliant OAuth Protected Resource metadata

func NewWellKnownHandler ¶ added in v0.5.2

func NewWellKnownHandler(authInfoHandler http.Handler) http.Handler

NewWellKnownHandler creates an HTTP handler that routes requests under the /.well-known/ path space to the appropriate handler.

Per RFC 9728, the /.well-known/oauth-protected-resource endpoint and any subpaths under it must be accessible without authentication. This handler ensures proper routing of discovery requests while returning 404 for unknown paths.

If authInfoHandler is nil, this function returns nil (no handler registration needed).

Usage:

authInfoHandler := auth.NewAuthInfoHandler(issuer, jwksURL, resourceURL, scopes)
wellKnownHandler := auth.NewWellKnownHandler(authInfoHandler)
if wellKnownHandler != nil {
    mux.Handle("/.well-known/", wellKnownHandler)
}

This handler matches:

• /.well-known/oauth-protected-resource (exact)
• /.well-known/oauth-protected-resource/* (subpaths)

Returns 404 for other /.well-known/* paths.