39 lines
1.3 KiB
Go
39 lines
1.3 KiB
Go
|
// Package auth holds authentication wiring for admin-api: Pocket-ID
|
||
|
|
// Authorization-Code / session-cookie middleware and the context accessors
|
||
|
|
// used by downstream handlers to read the authenticated principal.
|
||
|
|
package auth
|
||
|
|
|
||
|
|
import "context"
|
||
|
|
|
||
|
|
type principalKey struct{}
|
||
|
|
type sessionKey struct{}
|
||
|
|
|
||
|
|
// WithPrincipal attaches the authenticated admin user (`sub` claim) to ctx.
|
||
|
|
func WithPrincipal(ctx context.Context, sub string) context.Context {
|
||
|
|
return context.WithValue(ctx, principalKey{}, sub)
|
||
|
|
}
|
||
|
|
|
||
|
|
// WithSession attaches the Pocket-ID session identifier (`sid` claim or
|
||
|
|
// server-side session id) to ctx. Downstream code carries it into
|
||
|
|
// attestations so audits show which session triggered the change.
|
||
|
|
func WithSession(ctx context.Context, sessionID string) context.Context {
|
||
|
|
return context.WithValue(ctx, sessionKey{}, sessionID)
|
||
|
|
}
|
||
|
|
|
||
|
|
// PrincipalFrom returns the `sub` previously set by WithPrincipal, or
|
||
|
|
// "unknown" if the context never passed through the auth middleware.
|
||
|
|
func PrincipalFrom(ctx context.Context) string {
|
||
|
|
if v, ok := ctx.Value(principalKey{}).(string); ok {
|
||
|
|
return v
|
||
|
|
}
|
||
|
|
return "unknown"
|
||
|
|
}
|
||
|
|
|
||
|
|
// SessionFrom returns the session id previously set by WithSession, or "".
|
||
|
|
func SessionFrom(ctx context.Context) string {
|
||
|
|
if v, ok := ctx.Value(sessionKey{}).(string); ok {
|
||
|
|
return v
|
||
|
|
}
|
||
|
|
return ""
|
||
|
|
}
|