Documentation
¶
Overview ¶
Package auth bridges the buildoor web UI to a remote authenticatoor service. When --auth-provider-url is configured, tokens are validated against that service's JWKS. When it's not set, the API runs open — buildoor is typically deployed in a restricted environment, so this is a deliberate choice for the operator.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthHandler ¶
type AuthHandler struct {
// contains filtered or unexported fields
}
AuthHandler validates incoming bearer tokens. When verifier is nil the API is treated as open (no authentication required); CheckAuthToken always returns a non-nil token.
func NewAuthHandler ¶
func NewAuthHandler(ctx context.Context, authProviderURL string) (*AuthHandler, error)
NewAuthHandler returns a handler. When authProviderURL is empty the returned handler operates in open mode (no token verification, all calls allowed). When set, it bootstraps a JWKS verifier from the service's OIDC discovery doc, falling back to <url>/jwks.json.
func (*AuthHandler) CheckAuthToken ¶
func (h *AuthHandler) CheckAuthToken(tokenStr string) *jwt.Token
CheckAuthToken validates a bearer token (with or without the "Bearer " prefix). In open mode it always returns a valid token; in remote mode it delegates to the JWKS verifier and returns nil on any failure.
func (*AuthHandler) IsOpen ¶
func (h *AuthHandler) IsOpen() bool
IsOpen reports whether this handler is running in open mode (no auth provider configured).
Source Files