Documentation
¶
Overview ¶
Package authz calls auth-api's POST /authz/check to verify a caller's bearer token and resolve their roles, and provides Gin middleware that gates a route on holding one of a set of allowed roles. See platform's api-client-auth spec (openspec/changes/api-client-auth in sweetrpg/platform).
Index ¶
Constants ¶
const ( RoleUser = "user" RoleSubmitter = "submitter" RoleEditor = "editor" RoleModerator = "moderator" RoleApprover = "approver" RoleAdmin = "admin" )
Platform role names, matching auth-api's fixed role model exactly (see openspec/specs/user-authorization/spec.md's "Role model" requirement).
Variables ¶
This section is empty.
Functions ¶
Types ¶
type CheckResponse ¶
type CheckResponse struct {
Allowed bool `json:"allowed"`
Roles []string `json:"roles"`
Sub string `json:"sub"`
Reason string `json:"reason"`
}
CheckResponse is the union of auth-api's allowed/denied /authz/check response shapes.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client calls auth-api's /authz/check endpoint.
func NewClient ¶
NewClient builds a Client against auth-api's base URL (e.g. http://api-v1.sweetrpg-auth.svc.cluster.local:8000). An empty baseURL is accepted so the service can still start when AUTH_API_URL isn't configured; every Check call will then fail with a transport error, which RequireAnyRole surfaces as a 503.
type InvalidTokenError ¶
type InvalidTokenError struct{}
InvalidTokenError means auth-api rejected the bearer token itself (missing, expired, unverifiable) - distinct from a service-level deny (Allowed: false with a Reason) or a transport/backend failure.
func (InvalidTokenError) Error ¶
func (InvalidTokenError) Error() string
Source Files