auth

package

v0.1.0-rc.2 Latest Latest Go to latest Published: May 10, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/watzon/cypra

Links

Open Source Insights

Documentation ¶

Overview ¶

Package auth contains Phase 3 authorization scaffolding.

Index ¶

func Middleware(next http.Handler) http.Handler
func MiddlewareWithPAT(db *sql.DB, trustDevHeaders bool) func(http.Handler) http.Handler
func RequireInstanceAdmin(next http.Handler) http.Handler
func RequireTenantRole(next http.Handler) http.Handler
func RequireTenantRoleOrPATScope(scope string) func(http.Handler) http.Handler
type Actor
- func ActorFromContext(ctx context.Context) Actor

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Middleware ¶

func Middleware(next http.Handler) http.Handler

Middleware resolves an Actor from cookie session and (when permitted) test headers. It honors X-Cypra-Instance-Admin / X-Cypra-Tenant-Role; only use in tests or behind a trusted proxy.

func MiddlewareWithPAT ¶

func MiddlewareWithPAT(db *sql.DB, trustDevHeaders bool) func(http.Handler) http.Handler

MiddlewareWithPAT resolves the request actor.

trustDevHeaders gates whether X-Cypra-Instance-Admin / X-Cypra-Tenant-Role / X-Cypra-User-Id can elevate the actor. These headers exist for test fixtures and trusted reverse proxies; in normal production deployments they must be rejected so an attacker can't escalate by setting a header.

func RequireInstanceAdmin ¶

func RequireInstanceAdmin(next http.Handler) http.Handler

func RequireTenantRole ¶

func RequireTenantRole(next http.Handler) http.Handler

func RequireTenantRoleOrPATScope ¶

func RequireTenantRoleOrPATScope(scope string) func(http.Handler) http.Handler

Types ¶

type Actor ¶

type Actor struct {
	Kind            string
	InstanceAdmin   bool
	InstanceAdminID uuid.UUID
	TenantRole      string
	PersonalTokenID string
	TenantID        uuid.UUID
	UserID          uuid.UUID
	Scopes          []string
}

func ActorFromContext ¶

func ActorFromContext(ctx context.Context) Actor

Source Files ¶

View all Source files

auth.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
backupcodes Package backupcodes implements one-time recovery codes for users and instance admins.	Package backupcodes implements one-time recovery codes for users and instance admins.
invite Package invite implements tenant and instance-admin invitation flows.	Package invite implements tenant and instance-admin invitation flows.
magiclink Package magiclink implements magic-link token issuance and consumption.	Package magiclink implements magic-link token issuance and consumption.
password Package password implements password credentials and reset tokens.	Package password implements password credentials and reset tokens.
totp Package totp implements TOTP enrollment and verification.	Package totp implements TOTP enrollment and verification.
upstream Package upstream defines the Provider abstraction used by the social-SSO system and exposes a process-wide registry of registered providers.	Package upstream defines the Provider abstraction used by the social-SSO system and exposes a process-wide registry of registered providers.
apple Package apple implements the Sign-in-with-Apple social provider.	Package apple implements the Sign-in-with-Apple social provider.
discord Package discord implements the Discord social provider.	Package discord implements the Discord social provider.
github Package github implements the GitHub social provider.	Package github implements the GitHub social provider.
google Package google implements the Google upstream OAuth state and nonce checks.	Package google implements the Google upstream OAuth state and nonce checks.
microsoft Package microsoft implements the Microsoft (Azure AD / Entra) social provider.	Package microsoft implements the Microsoft (Azure AD / Entra) social provider.
oidcgeneric Package oidcgeneric implements a single-instance OIDC client used by Enterprise SSO connections.	Package oidcgeneric implements a single-instance OIDC client used by Enterprise SSO connections.
providers Package providers imports every social-SSO provider package so that their init() functions register them in the upstream registry.	Package providers imports every social-SSO provider package so that their init() functions register them in the upstream registry.
webauthn Package webauthn runs passkey ceremonies with per-tenant RP IDs.	Package webauthn runs passkey ceremonies with per-tenant RP IDs.
webauthn2fa Package webauthn2fa provides a WebAuthn-backed second-factor seam.	Package webauthn2fa provides a WebAuthn-backed second-factor seam.