auth

Documentation

Overview

Package auth configures the original Datly JWT verification contract for explicitly declared input codecs. It never injects an ambient principal.

Index

• Constants
• func VerifiesJWT(instance xcodec.Instance) bool
• type ClaimPolicy
• type Config
• type Service
  • func New(ctx context.Context, config *Config) (*Service, error)
  • func (s *Service) New(config *xcodec.Config, _ ...xcodec.Option) (xcodec.Instance, error)

Constants

const JwtClaim = "JwtClaim"

Functions

func VerifiesJWT

func VerifiesJWT(instance xcodec.Instance) bool

VerifiesJWT recognizes the configured codec actually constructed by Service. Names, marker interfaces, and unrelated codec implementations cannot assert this authority. No keys or verifier configuration are exposed.

Types

type ClaimPolicy

type ClaimPolicy struct {
	Issuer         string `json:"Issuer,omitempty" yaml:"Issuer,omitempty"`
	Audience       string `json:"Audience,omitempty" yaml:"Audience,omitempty"`
	RequireSubject bool   `json:"RequireSubject,omitempty" yaml:"RequireSubject,omitempty"`
}

ClaimPolicy binds a successfully verified JWT to the intended issuer, audience and principal. It is optional so existing Datly deployments retain their current verifier contract until they opt in.

type Config

type Config struct {
	JWTValidator *verifier.Config
	ClaimPolicy  *ClaimPolicy
}

Config retains the original Datly JWTValidator configuration, including CertURL and RSA public-key resources. Verification policy stays with Scy.

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service is an application-configured codec factory. Pass it through the existing bootstrap CodecFactory input; only declared JwtClaim inputs use it.

func New

func New(ctx context.Context, config *Config) (*Service, error)

func (*Service) New

func (s *Service) New(config *xcodec.Config, _ ...xcodec.Option) (xcodec.Instance, error)