go-tokenauth

README

go-tokenauth

Shared token validation library for SIROS AS-issued access tokens. Provides a single Go module that any service in the SIROS ecosystem can import to validate tokens, replacing per-service middleware duplication.

Packages

Package	Import	Description
claims	github.com/sirosfoundation/go-tokenauth/claims	TAC type, AccessTokenClaims, Result, AuthMode
jwks	github.com/sirosfoundation/go-tokenauth/jwks	JWKS fetcher with background refresh and key rotation
validator	github.com/sirosfoundation/go-tokenauth/validator	Dual-mode validator (asymmetric + legacy HMAC)
revocation	github.com/sirosfoundation/go-tokenauth/revocation	Revocation checker interface
tokengin	github.com/sirosfoundation/go-tokenauth/tokengin	Gin middleware (TokenAuth, MustHaveTAC)

Usage

import (
    "github.com/sirosfoundation/go-tokenauth/validator"
    "github.com/sirosfoundation/go-tokenauth/tokengin"
)

// Create validator
v := validator.New(validator.Config{
    JWKSURL:   "https://as.example.com/.well-known/jwks.json",
    Issuer:    "https://as.example.com",
    Audiences: []string{"my-service"},
    Legacy: validator.LegacyConfig{
        Enabled:    true,
        HMACSecret: []byte(os.Getenv("HMAC_SECRET")),
        Issuers:    []string{"https://as.example.com"},
    },
})
v.Start(ctx)
defer v.Stop()

// Use as Gin middleware
router.Use(tokengin.TokenAuth(v))

// Require specific permissions
router.GET("/admin", tokengin.MustHaveTAC("a"), adminHandler)

// Access validated result in handlers
func handler(c *gin.Context) {
    result, _ := tokengin.GetResult(c)
    fmt.Println(result.UserID, result.TenantID, result.TAC)
}

Development

make test       # Run tests
make lint       # Run linter
make coverage   # Generate coverage report

License

BSD 2-Clause — see LICENSE.