Documentation
¶
Index ¶
- Constants
- Variables
- func GenerateAPIKey() (string, error)
- func GinMiddleware(validate KeyValidator) gin.HandlerFunc
- func HashKey(key string) string
- func IsLegacy(userID string) bool
- func ValidateKey(rawKey, storedHash string) bool
- type GoogleClaims
- type GoogleVerifier
- type KeyValidator
- type Resolver
- type SessionClaims
- type SessionSigner
- type Verifier
Constants ¶
const GoogleJWKSURL = "https://www.googleapis.com/oauth2/v3/certs"
GoogleJWKSURL serves Google's RS256 public keys for ID tokens.
const LegacyAdminID = "legacy:admin"
LegacyAdminID is the sentinel user_id assigned when a request authenticates with the deprecated CONTEXO_API_KEY shared secret. Handlers may use this to bypass per-user membership checks while phase-1 ships ahead of the CLI and dashboard rewrites.
const SessionIssuer = "contexo"
SessionIssuer identifies sessions minted by this server (claim "iss").
const SessionTTL = 30 * 24 * time.Hour
SessionTTL is how long a session JWT stays valid after mint.
Variables ¶
var GoogleIssuers = map[string]bool{ "https://accounts.google.com": true, "accounts.google.com": true, }
GoogleIssuers are the values Google may set as `iss` on ID tokens.
Functions ¶
func GenerateAPIKey ¶
GenerateAPIKey produces a 32-byte random key encoded as base64url.
func GinMiddleware ¶
func GinMiddleware(validate KeyValidator) gin.HandlerFunc
GinMiddleware returns Gin middleware that validates API keys.
func ValidateKey ¶
ValidateKey checks if a raw key matches its stored hash using constant-time comparison.
Types ¶
type GoogleClaims ¶
type GoogleClaims struct {
Email string `json:"email"`
EmailVerified bool `json:"email_verified"`
Name string `json:"name"`
Subject string `json:"sub"`
}
GoogleClaims is the subset of an ID token we care about.
type GoogleVerifier ¶
type GoogleVerifier struct {
// contains filtered or unexported fields
}
GoogleVerifier verifies Google ID tokens for a configured OAuth client.
func NewGoogleVerifier ¶
func NewGoogleVerifier(clientID string) *GoogleVerifier
NewGoogleVerifier constructs a verifier for the given OAuth Client ID.
func (*GoogleVerifier) Verify ¶
func (v *GoogleVerifier) Verify(idToken string) (*GoogleClaims, error)
Verify parses idToken, checks the signature against Google's JWKS, and validates issuer/audience/expiry/email_verified. Returns the trusted claims.
type KeyValidator ¶
KeyValidator is a function that checks if a key is valid and returns the user ID.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver turns a Bearer token into a user_id. It accepts three flavors:
- Session JWT (HS256, issued by SessionSigner) — for dashboard sessions
- Personal Access Token (prefix "ctxp_") — for CLI/MCP
- Legacy API key (matches CONTEXO_API_KEY env var) — for back-compat
func NewResolver ¶
func NewResolver(session *SessionSigner, users *userstore.Store, legacyKey string) *Resolver
NewResolver constructs a Resolver. Any of session/users may be nil to disable a flavor. legacyKey may be "" to disable legacy auth.
func (*Resolver) Validator ¶
func (r *Resolver) Validator() KeyValidator
Validator returns a KeyValidator suitable for GinMiddleware.
type SessionClaims ¶
type SessionClaims struct {
UserID string `json:"sub"`
Email string `json:"email"`
jwt.RegisteredClaims
}
SessionClaims are the contents of a session JWT minted by MintSession.
type SessionSigner ¶
type SessionSigner struct {
// contains filtered or unexported fields
}
SessionSigner mints and verifies HS256 session JWTs using a shared secret.
func NewSessionSigner ¶
func NewSessionSigner(secret string) (*SessionSigner, error)
NewSessionSigner constructs a signer from a server secret.
type Verifier ¶
type Verifier interface {
Verify(idToken string) (*GoogleClaims, error)
}
Verifier produces trusted GoogleClaims from a raw ID token. The production implementation is *GoogleVerifier; tests can substitute a fake.
Source Files