tag/v1.0.2/go.mod

module code.nochebuena.dev/go/httpauth

go 1.26

require (
	code.nochebuena.dev/go/rbac v1.0.0
	code.nochebuena.dev/go/xerrors v1.0.1
)
feat(httpauth): initial release — provider-agnostic HTTP auth middleware Provides SetTokenData for upstream AuthMiddleware implementations, EnrichmentMiddleware and AuthzMiddleware compatible with any provider that calls SetTokenData, ClaimsPermissionProvider for JWT-embedded permissions, and CachedPermissionProvider for TTL-backed runtime resolution via any Cache implementation. 2026-05-07 21:37:25 -06:00			`module code.nochebuena.dev/go/httpauth`

chore: bump go directive from 1.25 to 1.26 2026-05-12 02:06:46 +00:00			`go 1.26`
feat(httpauth): initial release — provider-agnostic HTTP auth middleware Provides SetTokenData for upstream AuthMiddleware implementations, EnrichmentMiddleware and AuthzMiddleware compatible with any provider that calls SetTokenData, ClaimsPermissionProvider for JWT-embedded permissions, and CachedPermissionProvider for TTL-backed runtime resolution via any Cache implementation. 2026-05-07 21:37:25 -06:00
fix(httpauth): wildcard resource fallback, json.Number precision, xerrors JSON error bodies (#1) ClaimsPermissionProvider.ResolveMask now falls back to the "" resource key when the exact resource is absent in the JWT masks claim. Specific resource takes precedence; wildcard is the fallback. Enables ADMIN wildcard masks ({"": MaxInt64}) to pass every endpoint guard without per-resource entries. Add json.Number handling alongside existing int64/float64 paths. json.Number is produced by jwt.WithJSONNumber() (httpauth-jwt) and preserves math.MaxInt64 exactly — float64 would round to 2^63 and overflow on cast back to int64. Export WriteJSONError(w, status, code, message) — shared JSON error helper for all httpauth-* provider packages. Ensures a consistent {"code":"...","message":"..."} body and Content-Type: application/json across the full middleware stack. AuthzMiddleware and EnrichmentMiddleware now use WriteJSONError with xerrors code constants (UNAUTHENTICATED, PERMISSION_DENIED, INTERNAL) instead of http.Error which writes text/plain. AuthzMiddleware also fixes a wrong code string: UNAUTHORIZED → UNAUTHENTICATED (stable gRPC-aligned name, matching xerrors.ErrUnauthorized). Add xerrors v1.0.1 as a direct dependency for the code constants. Reviewed-on: https://code.nochebuena.dev/go/httpauth/pulls/1 Co-authored-by: Rene Nochebuena Guerrero <rene@nochebuena.dev> Co-committed-by: Rene Nochebuena Guerrero <rene@nochebuena.dev> 2026-05-18 14:15:12 -06:00			`require (`
			`code.nochebuena.dev/go/rbac v1.0.0`
			`code.nochebuena.dev/go/xerrors v1.0.1`
			`)`