serverauth

Documentation

Index

• Constants
• func AuthSourceFromRequest(r *http.Request) string
• func EndpointAllowsRole(method, path, role string) bool
• func HasTailscaleIdentityHeader(r *http.Request) bool
• func NewMiddleware(opts Options, logOut io.Writer) func(http.Handler) http.Handler
• func NormalizeMode(raw string) string
• func RoleFromContext(ctx context.Context) string
• func RoleFromRequest(r *http.Request) string
• func WithWorkspaceID(ctx context.Context, workspaceID string) context.Context
• func WorkspaceIDFromContext(ctx context.Context) string
• func WorkspaceIDFromRequest(r *http.Request) string
• type EndpointAccess
  • func ResolveEndpointAccess(method, path string) EndpointAccess
• type EndpointPolicyRule
  • func DefaultEndpointPolicyRules() []EndpointPolicyRule
• type Options

Constants

const (
	ModeOff              = "off"
	ModeExternalRequired = "external-required"
	ModeRequired         = "required"

	DefaultWorkspaceHeader          = "Tars-Workspace-Id"
	DefaultBrowserSessionCookieName = "tars_session"
	TailscaleUserLoginHeader        = "Tailscale-User-Login"
)

const (
	RoleUser  = "user"
	RoleAdmin = "admin"
)

Functions

func AuthSourceFromRequest

func AuthSourceFromRequest(r *http.Request) string

func EndpointAllowsRole

func EndpointAllowsRole(method, path, role string) bool

func HasTailscaleIdentityHeader

func HasTailscaleIdentityHeader(r *http.Request) bool

func NewMiddleware

func NewMiddleware(opts Options, logOut io.Writer) func(http.Handler) http.Handler

func NormalizeMode

func NormalizeMode(raw string) string

func RoleFromContext

func RoleFromContext(ctx context.Context) string

func RoleFromRequest

func RoleFromRequest(r *http.Request) string

func WithWorkspaceID

func WithWorkspaceID(ctx context.Context, workspaceID string) context.Context

func WorkspaceIDFromContext

func WorkspaceIDFromContext(ctx context.Context) string

func WorkspaceIDFromRequest

func WorkspaceIDFromRequest(r *http.Request) string

Types

type EndpointAccess

type EndpointAccess string

EndpointAccess describes the minimum browser-session role needed for an API endpoint. Unknown endpoints default to admin so the remote user surface is fail-closed as new routes are added.

const (
	EndpointAccessPublic EndpointAccess = "public"
	EndpointAccessUser   EndpointAccess = "user"
	EndpointAccessAdmin  EndpointAccess = "admin"
)

func ResolveEndpointAccess

func ResolveEndpointAccess(method, path string) EndpointAccess

type EndpointPolicyRule

type EndpointPolicyRule struct {
	Methods []string
	Pattern string
	Access  EndpointAccess
	Note    string
}

EndpointPolicyRule is the remote browser allowlist skeleton. It is not wired into middleware yet; PR1b will use this table when cookie auth lands.

func DefaultEndpointPolicyRules

func DefaultEndpointPolicyRules() []EndpointPolicyRule

type Options

type Options struct {
	Mode                          string
	BearerToken                   string
	UserToken                     string
	AdminToken                    string
	WorkspaceHeader               string
	RequireWorkspaceForAuthorized bool
	UserWorkspaceAllowlist        []string
	AdminWorkspaceAllowlist       []string
	SkipPaths                     []string
	LoopbackSkipPaths             []string
	AdminPaths                    []string
	BrowserSessionCookieName      string
	BrowserSessionRoleResolver    func(sessionID string) (string, bool)
}