Documentation
¶
Overview ¶
Package authz calls auth-api's POST /authz/check to verify a caller's bearer token and resolve their roles, and provides Gin middleware that gates a route on holding one of a set of allowed roles. See platform's volume-edit-authorization spec (openspec/changes/volume-edit-with-approval-workflow in sweetrpg/platform).
Index ¶
Constants ¶
const ( RoleUser = "user" RoleSubmitter = "submitter" RoleEditor = "editor" RoleModerator = "moderator" RoleApprover = "approver" RoleAdmin = "admin" )
Platform role names, matching auth-api's fixed role model exactly (see openspec/specs/user-authorization/spec.md's "Role model" requirement).
Variables ¶
This section is empty.
Functions ¶
func RequireAnyRole ¶
func RequireAnyRole(client *Client, service string, allowedRoles ...string) gin.HandlerFunc
RequireAnyRole returns Gin middleware that verifies the caller's bearer token against auth-api's /authz/check for the given service name, then requires the caller hold at least one of allowedRoles. On success, the verified roles and subject are stashed in the Gin context (read via Roles(c) / Subject(c)) for the handler to use.
Types ¶
type CheckResponse ¶
type CheckResponse struct {
Allowed bool `json:"allowed"`
Roles []string `json:"roles"`
Sub string `json:"sub"`
Reason string `json:"reason"`
}
CheckResponse is the union of auth-api's allowed/denied /authz/check response shapes.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client calls auth-api's /authz/check endpoint.
func NewClient ¶
NewClient builds a Client against auth-api's base URL (e.g. http://api-v1.sweetrpg-auth.svc.cluster.local:8000). An empty baseURL is accepted so the service can still start when AUTH_API_URL isn't configured; every Check call will then fail with a transport error, which RequireAnyRole surfaces as a 503.
type InvalidTokenError ¶
type InvalidTokenError struct{}
InvalidTokenError means auth-api rejected the bearer token itself (missing, expired, unverifiable) - distinct from a service-level deny (Allowed: false with a Reason) or a transport/backend failure.
func (InvalidTokenError) Error ¶
func (InvalidTokenError) Error() string
Source Files