Documentation
¶
Overview ¶
Package auth turns an HTTP request into verified claims and a database role: a JWT (HS* via shared secret, RS*/ES* via a cached JWKS endpoint), trusted-gateway claim headers, or nothing. It is transport-neutral apart from reading *http.Request headers and RemoteAddr.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidToken = errors.New("invalid token")
ErrInvalidToken marks a present-but-unusable credential: malformed Authorization header, bad signature, expired, wrong issuer/audience, JWKS miss, or claim headers from an untrusted peer. Products map it to 401.
var ErrRoleNotAllowed = errors.New("role not allowed")
ErrRoleNotAllowed marks a valid credential whose role claim is outside the AllowedRoles policy. Products map it to 403 (or 401 for pdbq parity).
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator turns an HTTP request into (claims, role) per the configured claim source: verified JWT, trusted gateway headers, or none.
func New ¶
func New(cfg Config) *Authenticator
New builds an Authenticator. Invalid TrustedProxies entries cannot occur (they are typed); a nil slice means every peer is trusted.
func (*Authenticator) Authenticate ¶
Authenticate never fails open: a present-but-invalid credential is an error; an absent credential yields the anonymous role. Errors wrap ErrInvalidToken or ErrRoleNotAllowed.
type Config ¶
type Config struct {
// Enabled false makes Authenticate a no-op returning no claims and no
// role (the product runs as the connection role).
Enabled bool
// Mode is "jwt", "headers", or "none".
Mode string
// JWTSecret verifies HS256/384/512 tokens; ignored when JWKSURL is set.
JWTSecret string
// JWKSURL enables asymmetric verification (RS*/ES*) with a key cache.
JWKSURL string
JWKSCacheTTL time.Duration
// JWTIssuer / JWTAudience are checked when non-empty.
JWTIssuer string
JWTAudience string
// HeaderPrefix is the claim-header prefix in headers mode
// (pdbq: X-Pdbq-Claim-, pdbr: X-Pdbr-Claim-).
HeaderPrefix string
// TrustedProxies gates claim headers by peer address; nil trusts every
// peer, an empty non-nil slice trusts none.
TrustedProxies []netip.Prefix
// RoleClaim names the claim carrying the database role.
RoleClaim string
DefaultRole string
AnonymousRole string
// AllowedRoles restricts claim-supplied roles; empty allows any.
AllowedRoles []string
}
Config is the claim-source configuration; products fill it from their own config sections (see confx.RLS / confx.Auth).
Source Files