auth

Documentation

Index

• func CheckBasicAuth(cred ServiceCred, username, password string) bool
• func HostGlobsOverlap(a, b string) bool
• func HostMatches(hostGlob, host string) bool
• func LoadServicesFromEnv() (map[string]ServiceCred, error)
• func OriginAllowed(originHeader string, allowed []string) bool
• func OverlappingHostGlobPairs(services map[string]ServiceCred) [][2]string
• func SortedServiceNames(services map[string]ServiceCred) []string
• type ServiceCred
  • func CheckBasicAuthAgainstServices(creds []ServiceCred, username, password string) (ServiceCred, bool)
  • func FindServicesForHost(services map[string]ServiceCred, host string) []ServiceCred

Functions

func CheckBasicAuth

func CheckBasicAuth(cred ServiceCred, username, password string) bool

CheckBasicAuth verifies username/password against a single service credential. Returns true only when the username matches and the password verifies against the stored bcrypt hash.

func HostGlobsOverlap

func HostGlobsOverlap(a, b string) bool

HostGlobsOverlap reports whether two host globs can both match the same host under HostMatches rules (case-insensitive; '*' is one DNS label; bare '*' is any host).

func HostMatches

func HostMatches(hostGlob, host string) bool

HostMatches reports whether host matches a host glob (SERVICE_* hostGlob or ALLOWED_ORIGINS entries). Matching is case-insensitive. '*' matches exactly one DNS label (e.g. "*.intern.example.com" matches "foo.intern.example.com" but not "a.b.intern.example.com").

func LoadServicesFromEnv

func LoadServicesFromEnv() (map[string]ServiceCred, error)

LoadServicesFromEnv scans SERVICE_* environment variables, parses each value as hostGlob/username/passwordHash (SplitN; hash may contain '/'), validates bcrypt hashes, rejects duplicate usernames, and requires at least one service.

func OriginAllowed

func OriginAllowed(originHeader string, allowed []string) bool

OriginAllowed reports whether the request Origin header is permitted. Rules:

• empty allowed list => no Origin enforcement (always true)
• empty Origin header => allowed (non-browser / Caddy probes)
• otherwise the Origin URL hostname must match an allowed entry (case-insensitive; ports stripped; bare host, absolute URL, or HostMatches glob such as "*.intern.example.com" / "*")

func OverlappingHostGlobPairs

func OverlappingHostGlobPairs(services map[string]ServiceCred) [][2]string

OverlappingHostGlobPairs returns sorted service-name pairs whose host globs overlap.

func SortedServiceNames

func SortedServiceNames(services map[string]ServiceCred) []string

SortedServiceNames returns service map keys in ascending order.

Types

type ServiceCred

type ServiceCred struct {
	Name         string
	HostGlob     string
	Username     string
	PasswordHash string
}

ServiceCred is one SERVICE_* entry: host glob, username, and bcrypt password hash.

func CheckBasicAuthAgainstServices

func CheckBasicAuthAgainstServices(creds []ServiceCred, username, password string) (ServiceCred, bool)

CheckBasicAuthAgainstServices returns the first matching service credential for which username/password are valid. ok is false when none match.

func FindServicesForHost

func FindServicesForHost(services map[string]ServiceCred, host string) []ServiceCred

FindServicesForHost returns every configured service whose host glob matches host. Matches are ordered by service name so callers (logs, flood service hints) are stable when multiple overlapping globs match the same host.