Documentation
¶
Overview ¶
Package auth verifies bearer tokens and resolves them to a Principal that carries roles and permissions for authorization checks. It supports JWKS (OIDC), a static RSA public key, and an ephemeral development key.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewVerifier ¶
NewVerifier selects a verifier from settings. Precedence: JWKS (OIDC), then a static RSA public key, then an ephemeral development key. In any environment other than development, one of the first two must be configured.
Types ¶
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator verifies bearer tokens during OpenAPI request validation and publishes the resulting principal to the request context.
func NewAuthenticator ¶
func NewAuthenticator(v Verifier) *Authenticator
func (*Authenticator) Authenticate ¶
func (a *Authenticator) Authenticate(_ context.Context, input *openapi3filter.AuthenticationInput) error
Authenticate satisfies openapi3filter.AuthenticationFunc. The validator calls it for operations that declare the bearerAuth scheme.
func (*Authenticator) SeedContext ¶
func (a *Authenticator) SeedContext(next http.Handler) http.Handler
SeedContext prepares the request context to receive the authenticated principal. It must run before the OpenAPI request-validation middleware, which does not propagate a context modified inside Authenticate.
type Claims ¶
type Claims struct {
jwt.RegisteredClaims
Roles []string `json:"roles,omitempty"`
Scope string `json:"scope,omitempty"`
}
Claims is the JWT payload. roles drives RBAC; scope is an optional OAuth2 space-delimited scope string that is merged into the principal's scopes.
type DevIssuer ¶
type DevIssuer struct {
// contains filtered or unexported fields
}
DevIssuer mints tokens with the ephemeral key generated when no verifier is configured in development. It must never be enabled in production.
type Principal ¶
Principal is the authenticated caller derived from a verified token.
func PrincipalFrom ¶
PrincipalFrom returns the authenticated principal, or false if the request was not authenticated.
func (Principal) HasPermission ¶
HasPermission is true when any of the principal's roles grants the permission or the permission is present as an explicit token scope.
Source Files