Rene Nochebuena
8a306abed0
Introduces code.nochebuena.dev/einherjar/auth — the provider-agnostic HTTP
authentication and authorization layer of the Einherjar framework. Absorbs
two micro-lib packages (httpauth, rbac) as sub-packages, replacing the
Identity-only context model with a SecurityBag-native design and adding a
composable enrichment chain.
authmw:
- BagEnricher function type — enriches the request-scoped SecurityBag after
the base Identity is built; registered via WithBagEnricher; multiple
enrichers run in order, each receiving the bag from the previous
- IdentityEnricher interface — application-layer contract for loading user
data from uid+claims
- EnrichmentMiddleware — builds SecurityBag from uid+claims, runs enricher
chain, stores via security.SetBagInContext; 401 on missing uid, 500 on
enricher error; routes all errors through httputil.Error
- AuthzMiddleware — per-route permission gate; 401 on missing identity,
403 on provider error (fail-closed) or insufficient permissions
- EnrichOpt type + WithTenantHeader (reads TenantID from header, implemented
as a BagEnricher) + WithBagEnricher (registers custom enrichers for
hardware IDs, grant codes, or any bag attribute)
- SetTokenData / GetClaims — integration contract for auth-jwt / auth-firebase
rbac:
- NewClaimsPermissionProvider — reads flat JWT claim bitmasks from context;
wildcard "*" fallback; handles int64/float64/json.Number; zero DB calls
- NewCachedPermissionProvider — TTL cache wrapping any PermissionProvider;
default key "rbac:{uid}:{resource}" or "rbac:{tenantID}:{uid}:{resource}";
TenantID sourced from SecurityBag automatically; accepts ...CachedOpt
- CachedOpt type + WithCacheKey — overrides the key function for extra
dimensions (hardware IDs, grant codes read from bag attributes)
- NewChainPermissionProvider — tries providers in order; first non-zero wins;
errors short-circuit; typical pattern: claims → cached DB fallback
- Cache interface — pluggable backend satisfied by cache-valkey via duck typing
Compliance test (package auth_test) enforces CT-6 (≤1 exported TypeSpec/file),
compile-time interface satisfaction, and behavioural coverage across the full
middleware and provider surface: enrichment success/failure, tenant header,
custom BagEnricher, bag-in-context, authz allowed/denied/error, claims
hit/wildcard/missing/float64, cached hit/miss/error/tenant-key/custom-key,
chain first-non-zero/fallthrough/error.
Depends on contracts v1.0.0, core v1.0.0, web v1.0.0.
- identifiable.go: package-level Module variable (observability.Identifiable) for version
identification — auth is middleware-only; not registered with the launcher
39 lines
1.3 KiB
Go
39 lines
1.3 KiB
Go
package authmw
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"code.nochebuena.dev/einherjar/contracts/logging"
|
|
"code.nochebuena.dev/einherjar/contracts/security"
|
|
"code.nochebuena.dev/einherjar/core/xerrors"
|
|
"code.nochebuena.dev/einherjar/web/httputil"
|
|
)
|
|
|
|
// AuthzMiddleware gates the request against a single required permission on a named resource.
|
|
// Returns 401 if no identity is in context; 403 if the permission check fails or the
|
|
// provider returns an error (fail-closed: provider failure denies access).
|
|
func AuthzMiddleware(logger logging.Logger, provider security.PermissionProvider, resource string, required security.Permission) func(http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
identity, ok := security.FromContext(r.Context())
|
|
if !ok {
|
|
httputil.Error(logger, w, r, xerrors.Unauthorized("missing identity"))
|
|
return
|
|
}
|
|
|
|
mask, err := provider.ResolveMask(r.Context(), identity.UID, resource)
|
|
if err != nil {
|
|
httputil.Error(logger, w, r, xerrors.PermissionDenied("permission check failed").WithError(err))
|
|
return
|
|
}
|
|
|
|
if !mask.Has(required) {
|
|
httputil.Error(logger, w, r, xerrors.PermissionDenied("insufficient permissions"))
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|