Documentation
¶
Overview ¶
Package authprovider implements forge auth providers for authsome's authentication methods (session, JWT, API key). These providers integrate with the forge auth extension's registry so routes can use declarative auth options like forge.WithAuth("session").
Index ¶
- Constants
- func BridgeToContext(ctx forge.Context, data *SessionData)
- func RegistryMiddleware(registry auth.Registry, providers ...string) forge.Middleware
- type CookieNameResolver
- type CookieSessionProvider
- type SessionData
- type SessionProvider
- func (p *SessionProvider) Authenticate(ctx context.Context, r *http.Request) (*auth.AuthContext, error)
- func (p *SessionProvider) Middleware() forge.Middleware
- func (p *SessionProvider) Name() string
- func (p *SessionProvider) OpenAPIScheme() auth.SecurityScheme
- func (p *SessionProvider) Type() auth.SecuritySchemeType
- func (p *SessionProvider) WithDPoP(cfg authmw.SessionBindingConfig) *SessionProvider
Constants ¶
const DefaultSessionCookieName = "authsome_session_token"
DefaultSessionCookieName is the cookie SessionProvider falls back to when no resolver is configured, and the name the cookie security scheme declares.
Deployments can rename it through the session.cookie_name setting, which is why Authenticate resolves it per request. An OpenAPI document has nowhere to put "whatever this app configured", so the scheme below declares the default and a renamed deployment regenerates its clients.
Variables ¶
This section is empty.
Functions ¶
func BridgeToContext ¶
func BridgeToContext(ctx forge.Context, data *SessionData)
BridgeToContext sets authsome middleware context values from a SessionData. This bridges the forge auth system to authsome's middleware context so existing handlers using middleware.UserIDFrom() etc. continue to work.
func RegistryMiddleware ¶
func RegistryMiddleware(registry auth.Registry, providers ...string) forge.Middleware
RegistryMiddleware creates a registry-backed auth middleware that skips CORS preflight (OPTIONS) requests. Use this instead of calling registry.Middleware() directly to avoid noisy "failed for all providers" warnings from preflight requests.
Types ¶
type CookieNameResolver ¶
CookieNameResolver returns the session cookie name for the current request context. Implementations should resolve from dynamic settings (per-app) and fall back to the default "authsome_session_token".
type CookieSessionProvider ¶
type CookieSessionProvider struct {
*SessionProvider
}
CookieSessionProvider declares the cookie half of session authentication.
SessionProvider accepts either an Authorization: Bearer header or the session cookie, but a single provider yields a single OpenAPI security scheme, and its scheme says bearer. A generated client therefore only ever sent the header, and the browser flow the server has always supported was invisible to every client built from the document.
Registering this alongside SessionProvider declares the other half: {apiKey, cookie, authsome_session_token}. Forge's Go generator turns that into a typed AuthConfig field plus an opt-in cookie jar, and the TypeScript generator into a credentials-carrying transport.
It delegates authentication wholesale, so there is one implementation and the two schemes cannot drift into disagreeing about what a valid session is.
func NewCookieSessionProvider ¶
func NewCookieSessionProvider(p *SessionProvider) *CookieSessionProvider
NewCookieSessionProvider wraps p to declare its cookie scheme.
func (*CookieSessionProvider) Name ¶
func (p *CookieSessionProvider) Name() string
Name returns the provider name used in forge.WithAuth("session-cookie").
func (*CookieSessionProvider) OpenAPIScheme ¶
func (p *CookieSessionProvider) OpenAPIScheme() auth.SecurityScheme
OpenAPIScheme declares the session cookie by name and location.
func (*CookieSessionProvider) Type ¶
func (p *CookieSessionProvider) Type() auth.SecuritySchemeType
Type returns the OpenAPI security scheme type.
type SessionData ¶
SessionData holds the resolved session and user for bridge middleware that converts auth.AuthContext into authsome's context values.
type SessionProvider ¶
type SessionProvider struct {
// contains filtered or unexported fields
}
SessionProvider implements auth.AuthProvider for authsome session-based authentication. It resolves bearer tokens (from Authorization header or session cookie) into sessions and users.
func NewSessionProvider ¶
func NewSessionProvider( resolveSession authmw.SessionResolver, resolveUser authmw.UserResolver, logger log.Logger, cookieNameResolver ...CookieNameResolver, ) *SessionProvider
NewSessionProvider creates a new session auth provider. cookieNameResolver is optional — if nil, defaults to "authsome_session_token".
func (*SessionProvider) Authenticate ¶
func (p *SessionProvider) Authenticate(ctx context.Context, r *http.Request) (*auth.AuthContext, error)
Authenticate validates the request and returns the authenticated user. It checks the Authorization header first, then falls back to the session cookie (resolved from dynamic settings per app).
func (*SessionProvider) Middleware ¶
func (p *SessionProvider) Middleware() forge.Middleware
Middleware returns HTTP middleware for this provider. The middleware resolves authentication and sets both the forge auth context AND the authsome middleware context values (UserID, AppID, Session, etc.) so existing handlers continue to work unchanged.
func (*SessionProvider) Name ¶
func (p *SessionProvider) Name() string
Name returns the provider name used in forge.WithAuth("session").
func (*SessionProvider) OpenAPIScheme ¶
func (p *SessionProvider) OpenAPIScheme() auth.SecurityScheme
OpenAPIScheme returns the OpenAPI security scheme definition.
func (*SessionProvider) Type ¶
func (p *SessionProvider) Type() auth.SecuritySchemeType
Type returns the OpenAPI security scheme type.
func (*SessionProvider) WithDPoP ¶
func (p *SessionProvider) WithDPoP(cfg authmw.SessionBindingConfig) *SessionProvider
WithDPoP sets the RFC 9449 enforcement config and returns the provider, so engine wiring reads as one expression.
This provider is a second path from a token to an authenticated context. In a standard deployment the global auth middleware runs first and rejects a bad presentation before this is reached, but enforcement is a property of the token rather than of which chain happened to be assembled, so the rule is applied here rather than assumed to have run somewhere upstream.
Source Files