auth

Documentation

Index

• Constants
• func NewMiddleware(client *JWKSClient, log Logger, validator *dpop.Validator) echo.MiddlewareFunc
• func RequireRole(roles ...string) echo.MiddlewareFunc
• func UserIDFromContext(c *echo.Context) (string, error)
• type CNF
• type Claims
  • func ClaimsFromContext(c *echo.Context) (*Claims, error)
• type JWKSClient
  • func NewJWKSClient(jwksURL string, cacheTTL time.Duration) *JWKSClient
  • func (c *JWKSClient) GetKey(kid string) (*ecdsa.PublicKey, error)
  • func (c *JWKSClient) Invalidate()
  • func (c *JWKSClient) KeyFunc() jwt.Keyfunc
  • func (c *JWKSClient) ParseToken(tokenString string, claims jwt.Claims) (*jwt.Token, error)
  • func (c *JWKSClient) SetLogger(logger Logger)
• type Logger

Constants

const (
	RoleUser    = "USER"
	RoleManager = "MANAGER"
	RoleAdmin   = "ADMIN"
)

Global user roles, mirroring services/auth/domain (User.Role). Kept here so shared middleware can enforce role checks without importing the auth module.

const ClaimsContextKey = "auth_claims"

Functions

func NewMiddleware

func NewMiddleware(client *JWKSClient, log Logger, validator *dpop.Validator) echo.MiddlewareFunc

NewMiddleware validates the DPoP bearer access token and requires a sender-constrained DPoP proof bound to the token's cnf.jkt claim (RFC 9449). The shared validator applies the same proof/nonce/replay checks used by the token-issuing endpoints. If validator is nil, DPoP validation is skipped with a warning — production deployments must always pass a validator.

func RequireRole

func RequireRole(roles ...string) echo.MiddlewareFunc

RequireRole returns a middleware that rejects requests whose authenticated user does not hold one of the given roles. It must be composed AFTER NewMiddleware (which stores the verified Claims in the echo context).

• no verified claims -> 401 Unauthorized
• valid claims, wrong role -> 403 Forbidden

func UserIDFromContext

func UserIDFromContext(c *echo.Context) (string, error)

Types

type CNF

type CNF struct {
	Jkt string `json:"jkt,omitempty"`
}

CNF carries the confirmation key (RFC 9449 section 3) that binds the access token to the DPoP proof key.

type Claims

type Claims struct {
	jwt.RegisteredClaims
	Role string `json:"role"`
	CNF  *CNF   `json:"cnf,omitempty"`
}

func ClaimsFromContext

func ClaimsFromContext(c *echo.Context) (*Claims, error)

type JWKSClient

type JWKSClient struct {
	// contains filtered or unexported fields
}

func NewJWKSClient

func NewJWKSClient(jwksURL string, cacheTTL time.Duration) *JWKSClient

func (*JWKSClient) GetKey

func (c *JWKSClient) GetKey(kid string) (*ecdsa.PublicKey, error)

func (*JWKSClient) Invalidate

func (c *JWKSClient) Invalidate()

func (*JWKSClient) KeyFunc

func (c *JWKSClient) KeyFunc() jwt.Keyfunc

func (*JWKSClient) ParseToken

func (c *JWKSClient) ParseToken(tokenString string, claims jwt.Claims) (*jwt.Token, error)

func (*JWKSClient) SetLogger

func (c *JWKSClient) SetLogger(logger Logger)

type Logger

type Logger interface {
	Info(msg string, args ...any)
	Error(msg string, args ...any)
}