authz

Documentation

Overview

Package authz calls auth-api's POST /authz/check to resolve a caller's identity (subject). Unlike catalog-api's role-gated authz, Game Room endpoints aren't role-based - every user manages their own library/wishlist/tables, and other users' collections are filtered by visibility rather than by role. This package only ever needs the caller's subject, and treats a missing or invalid token as an anonymous viewer rather than an error, since most Game Room reads are legitimately anonymous-accessible (anything public).

Index

• func RequireOwner() gin.HandlerFunc
• func ResolveViewer(client *Client) gin.HandlerFunc
• func Viewer(c *gin.Context) string
• type CheckResponse
• type Client
  • func NewClient(baseURL string) *Client
  • func (c *Client) Check(ctx context.Context, token, service string) (*CheckResponse, error)
• type InvalidTokenError
  • func (InvalidTokenError) Error() string

Functions

func RequireOwner

func RequireOwner() gin.HandlerFunc

RequireOwner aborts with 403 unless the resolved viewer matches the :user_id path param - every Game Room write endpoint is scoped to the caller's own collection.

func ResolveViewer

func ResolveViewer(client *Client) gin.HandlerFunc

ResolveViewer returns Gin middleware that resolves the caller's identity from a bearer token, when present, and stashes it in the Gin context (read via Viewer(c)) for handlers to use in visibility filtering and ownership checks. A missing token, or one auth-api rejects, resolves to an anonymous viewer ("") rather than aborting the request - reads must stay accessible to anonymous callers for anything public.

func Viewer

func Viewer(c *gin.Context) string

Viewer returns the caller's resolved subject, or "" for an anonymous viewer.

Types

type CheckResponse

type CheckResponse struct {
	Allowed bool     `json:"allowed"`
	Roles   []string `json:"roles"`
	Sub     string   `json:"sub"`
	Reason  string   `json:"reason"`
}

CheckResponse is the union of auth-api's allowed/denied /authz/check response shapes.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client calls auth-api's /authz/check endpoint.

func NewClient

func NewClient(baseURL string) *Client

NewClient builds a Client against auth-api's base URL. An empty baseURL is accepted so the service can still start when AUTH_API_URL isn't configured - every Check call then fails, which ResolveViewer treats as anonymous.

func (*Client) Check

func (c *Client) Check(ctx context.Context, token, service string) (*CheckResponse, error)

Check verifies token against auth-api and returns the caller's allowed/roles/subject.

type InvalidTokenError

type InvalidTokenError struct{}

InvalidTokenError means auth-api rejected the bearer token itself.

func (InvalidTokenError) Error

func (InvalidTokenError) Error() string