Documentation
¶
Overview ¶
Package serviceauth provides constant-time validation of shared service-to-service tokens. It is a standalone module usable by any service edge that needs it (auth ↔ caller, dataaccess ↔ caller, ...) and answers the question "is the calling process a trusted peer service". It does NOT establish end-user identity — see pkg/userauth for that.
Each service owns its own metadata header name and interceptor; this package only owns the comparison logic.
Index ¶
Constants ¶
This section is empty.
Variables ¶
ErrUnauthorized is returned when the presented token does not match any of the configured tokens.
Functions ¶
func UnaryServerInterceptor ¶
func UnaryServerInterceptor(cfg Config, headerNames []string, publicMethods map[string]bool) grpc.UnaryServerInterceptor
UnaryServerInterceptor returns a gRPC unary server interceptor that validates the service token presented under one of headerNames for all RPCs not in publicMethods. The first name a caller sent is the one checked; a token under a later name is not consulted. The accepted tokens are derived from cfg (Config.Tokens()).
On any failure — missing metadata, missing or empty header, or token rejection — the interceptor returns codes.Unauthenticated with an opaque "Unauthorized" message. Distinguishing the cause would leak whether a token was provided, providing an oracle to attackers.
Types ¶
type Config ¶
type Config struct {
ServiceToken string `mapstructure:"service_token"`
NextServiceToken string `mapstructure:"next_service_token"`
}
Config is the subset of a service's configuration that controls service-to-service shared-secret authentication. Services embed this with the mapstructure squash tag so the TOML keys sit at the top level of the service's table, e.g.:
[services.data-access] service_token = "..." next_service_token = ""
During rotation, NextServiceToken holds the new token alongside the current one; a Validator built from Tokens() accepts either.
type Validator ¶
type Validator struct {
// contains filtered or unexported fields
}
Validator performs constant-time token validation against a set of pre-computed SHA-512 hashes. It is safe for concurrent use.
func NewValidator ¶
NewValidator creates a Validator that accepts the given tokens. Empty token strings are silently ignored so callers can pass an optional next-token slot without conditional logic.
Source Files