auth

Mar 3, 2026

Changes in this version

+ type MiddlewareOption func(*middlewareConfig)

+ func WithSkipPaths(paths ...string) MiddlewareOption

type PermissionArtifactType

+ const PermissionArtifactTypePrompt

Jan 28, 2026

Changes in this version

+ var BlockedNamespaces = []string

+ var ErrForbidden = errors.New("forbidden")

+ var ErrUnauthenticated = errors.New("unauthenticated")

+ var PublicActions = map[PermissionAction]bool

+ func AuthSessionTo(ctx context.Context, session Session) context.Context

+ func AuthnMiddleware(authn AuthnProvider) func(ctx huma.Context, next func(huma.Context))

+ func IsSystemSession(s Session) bool

+ func WithSystemContext(ctx context.Context) context.Context

+ type AuthnProvider interface

+ Authenticate func(ctx context.Context, reqHeaders func(name string) string, query url.Values) (Session, error)

+ type Authorizer struct

+ Authz AuthzProvider

+ func (a *Authorizer) Check(ctx context.Context, verb PermissionAction, resource Resource) error

+ func (a *Authorizer) IsRegistryAdmin(ctx context.Context) bool

+ type AuthzProvider interface

+ Check func(ctx context.Context, s Session, verb PermissionAction, resource Resource) error

+ IsRegistryAdmin func(ctx context.Context, s Session) bool

+ type JWTClaims struct

+ AuthMethod Method

+ AuthMethodSubject string

+ Permissions []Permission

+ type JWTManager struct

+ func NewJWTManager(cfg *config.Config) *JWTManager

+ func (j *JWTManager) Authenticate(ctx context.Context, reqHeaders func(name string) string, query url.Values) (Session, error)

+ func (j *JWTManager) Check(ctx context.Context, s Session, verb PermissionAction, resource Resource) error

+ func (j *JWTManager) GenerateTokenResponse(_ context.Context, claims JWTClaims) (*TokenResponse, error)

+ func (j *JWTManager) HasPermission(resource string, action PermissionAction, permissions []Permission) bool

+ func (j *JWTManager) ValidateToken(_ context.Context, tokenString string) (*JWTClaims, error)

+ type Method string

+ const MethodDNS

+ const MethodGitHubAT

+ const MethodGitHubOIDC

+ const MethodHTTP

+ const MethodNone

+ const MethodOIDC

+ type Permission struct

+ Action PermissionAction

+ ResourcePattern string

+ type PermissionAction string

+ const PermissionActionDelete

+ const PermissionActionDeploy

+ const PermissionActionEdit

+ const PermissionActionPublish

+ const PermissionActionPush

+ const PermissionActionRead

+ type PermissionArtifactType string

+ const PermissionArtifactTypeAgent

+ const PermissionArtifactTypeServer

+ const PermissionArtifactTypeSkill

+ type Principal struct

+ User User

+ type PublicAuthzProvider struct

+ func NewPublicAuthzProvider(jwtManager *JWTManager) *PublicAuthzProvider

+ func (o *PublicAuthzProvider) Check(ctx context.Context, s Session, verb PermissionAction, resource Resource) error

+ func (o *PublicAuthzProvider) IsRegistryAdmin(ctx context.Context, s Session) bool

+ type Resource struct

+ Name string

+ Type PermissionArtifactType

+ type Session interface

+ Principal func() Principal

+ func AuthSessionFrom(ctx context.Context) (Session, bool)

+ type SystemSession struct

+ func (s *SystemSession) Principal() Principal

+ type TokenResponse struct

+ ExpiresAt int

+ RegistryToken string

+ type User struct

+ Permissions []Permission