Documentation
¶
Overview ¶
Package impersonation provides middleware for handling user impersonation in HTTP requests. It supports JWT-based impersonation tokens with scope validation and audit logging.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowOnlyImpersonationType ¶
func AllowOnlyImpersonationType(allowedTypes ...auth.ImpersonationType) echo.MiddlewareFunc
AllowOnlyImpersonationType creates middleware that only allows specific impersonation types
func BlockImpersonation ¶
func BlockImpersonation() echo.MiddlewareFunc
BlockImpersonation creates middleware that blocks impersonated users from certain endpoints
func SystemAdminUserContextMiddleware ¶
func SystemAdminUserContextMiddleware() echo.MiddlewareFunc
SystemAdminUserContextMiddleware handles system admin tokens with user context headers It detects when a system admin token is used with X-User-ID and X-Organization-ID headers and sets up the user context to run GraphQL as that specific user
Types ¶
type Middleware ¶
type Middleware struct {
// contains filtered or unexported fields
}
Middleware handles detection and processing of impersonation tokens
func New ¶
func New(tokenManager *tokens.TokenManager, supportSubjectID, supportName string) *Middleware
New creates a new impersonation middleware. supportSubjectID and supportName come from the support access configuration so support sessions can be recognized and attributed without hardcoded values
func (*Middleware) Process ¶
func (m *Middleware) Process(next echo.HandlerFunc) echo.HandlerFunc
Process is the middleware function that processes impersonation tokens. An impersonation token may be presented either with the dedicated Impersonation authorization scheme or, for clients that only send Bearer (such as the web UI), as a Bearer token. A normal access token fails impersonation validation because it lacks the required impersonation claims, so the request falls through to the normal authentication middleware in that case
Source Files