21 lines
733 B
Go
21 lines
733 B
Go
|
package authmw
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
|
||
|
|
"code.nochebuena.dev/einherjar/contracts/security"
|
||
|
|
)
|
||
|
|
|
||
|
|
// BagEnricher enriches the request-scoped SecurityBag.
|
||
|
|
//
|
||
|
|
// Called sequentially by [EnrichmentMiddleware] after the base Identity is
|
||
|
|
// built from uid+claims. Each enricher receives the current bag and must
|
||
|
|
// return a new bag — the receiver is never modified.
|
||
|
|
//
|
||
|
|
// Typical uses: setting TenantID from a request header, attaching a hardware
|
||
|
|
// ID to the bag, injecting a grant code from an out-of-band lookup.
|
||
|
|
//
|
||
|
|
// Register enrichers via [WithBagEnricher]. [WithTenantHeader] is a
|
||
|
|
// convenience constructor for the most common single-header case.
|
||
|
|
type BagEnricher func(bag security.SecurityBag, r *http.Request) security.SecurityBag
|