Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AnonymousUser = &User{
ID: "anonymous",
Name: "Anonymous",
Provider: "none",
}
AnonymousUser is the default user when no authentication is configured.
Functions ¶
func AuthMiddleware ¶
func AuthMiddleware(auth Authenticator) func(http.Handler) http.Handler
AuthMiddleware returns HTTP middleware that authenticates each request using the provided Authenticator and stores the user in the request context.
Types ¶
type Authenticator ¶
type Authenticator interface {
// Authenticate inspects the request (headers, cookies, tokens) and returns
// the authenticated user. Return a non-nil error to reject the request
// with 401 Unauthorized.
Authenticate(r *http.Request) (*User, error)
}
Authenticator validates incoming requests and returns user identity. The default NoOpAuthenticator always returns AnonymousUser. Enterprise implementations can provide SAML, OIDC, or other SSO providers.
type Authorizer ¶
type Authorizer interface {
// CanAccessRepo checks if the user can view a repository.
CanAccessRepo(ctx context.Context, user *User, repoName string) bool
// FilterRepos filters a list of repos to only those the user can access.
FilterRepos(ctx context.Context, user *User, repos []string) []string
}
Authorizer controls access to resources based on user identity. The default NoOpAuthorizer allows all access. Enterprise implementations can provide RBAC or other access control.
type NoOpAuthenticator ¶
type NoOpAuthenticator struct{}
NoOpAuthenticator is the default authenticator that allows all requests and assigns AnonymousUser identity. Used in the open-source core.
func (*NoOpAuthenticator) Authenticate ¶
func (n *NoOpAuthenticator) Authenticate(_ *http.Request) (*User, error)
Authenticate always returns AnonymousUser with no error.
type NoOpAuthorizer ¶
type NoOpAuthorizer struct{}
NoOpAuthorizer is the default authorizer that allows all access. Used in the open-source core.
func (*NoOpAuthorizer) CanAccessRepo ¶
CanAccessRepo always returns true.
func (*NoOpAuthorizer) FilterRepos ¶
FilterRepos returns all repos unfiltered.
type User ¶
type User struct {
ID string
Email string
Name string
Groups []string
Provider string // "saml", "oidc", "local", "anonymous"
}
User represents an authenticated user.
func UserFromContext ¶
UserFromContext retrieves the authenticated user from the request context. Returns AnonymousUser if no user is set.
Source Files