httpauth

Documentation

Overview

Package httpauth bridges application-owned users and authenticators into net/http. The same authentication middleware can serve JSON APIs or redirecting browser pages.

Index

• func Authorize[User any](allowed func(*http.Request, User) bool, onFailure OnFailure) func(http.Handler) http.Handler
• func AuthorizeWithError[User any](allowed func(*http.Request, User) (bool, error), onFailure OnFailure, ...) func(http.Handler) http.Handler
• func CurrentUser[User any](r *http.Request) (User, bool)
• func CurrentUserFromContext[User any](ctx context.Context) (User, bool)
• func JSONFailure(w http.ResponseWriter, _ *http.Request, status int)
• func Require[User any](onFailure OnFailure, authenticators ...auth.Authenticator[User]) func(http.Handler) http.Handler
• func WithUser[User any](r *http.Request, user User) *http.Request
• type OnFailure
  • func RedirectFailure(loginPath string) OnFailure
• type OnPolicyError

Functions

func Authorize

func Authorize[User any](
	allowed func(*http.Request, User) bool,
	onFailure OnFailure,
) func(http.Handler) http.Handler

Authorize applies application-owned authorization policy to the resolved user.

func AuthorizeWithError

func AuthorizeWithError[User any](
	allowed func(*http.Request, User) (bool, error),
	onFailure OnFailure,
	onError OnPolicyError,
) func(http.Handler) http.Handler

AuthorizeWithError applies persisted authorization policy without hiding database failures. Denial returns HTTP 403 while unexpected failures are handled separately.

func CurrentUser

func CurrentUser[User any](r *http.Request) (User, bool)

CurrentUser returns the current authenticated application user.

func CurrentUserFromContext

func CurrentUserFromContext[User any](ctx context.Context) (User, bool)

CurrentUserFromContext returns the authenticated application user in ctx.

func JSONFailure

func JSONFailure(w http.ResponseWriter, _ *http.Request, status int)

JSONFailure sends a small, consistent JSON error without redirecting clients.

func Require

func Require[User any](
	onFailure OnFailure,
	authenticators ...auth.Authenticator[User],
) func(http.Handler) http.Handler

Require tries authenticators in order, passes the resolved user to the next handler, and distinguishes expected denial from unexpected authentication failure.

func WithUser

func WithUser[User any](r *http.Request, user User) *http.Request

WithUser attaches a resolved application user to the request context.

Types

type OnFailure

type OnFailure func(http.ResponseWriter, *http.Request, int)

OnFailure selects the browser or API response for unsuccessful authentication. Implementations must not expose internal authentication errors to clients.

func RedirectFailure

func RedirectFailure(loginPath string) OnFailure

RedirectFailure redirects unauthenticated browser requests to a local login path. Forbidden and internal errors are never redirected.

type OnPolicyError

type OnPolicyError func(http.ResponseWriter, *http.Request, error)

OnPolicyError reports an authorization infrastructure failure without exposing its cause to clients.