62 lines
1.6 KiB
Go
62 lines
1.6 KiB
Go
package bouncer
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
)
|
|
|
|
type userKey struct{}
|
|
|
|
// Principal is the authenticated identity stored on the request context.
|
|
// PreferredLocale empty means no override. TokensValidAfter zero means no cutoff.
|
|
// IsSuperuser and PermissionGrants are set only for backend-admin principals.
|
|
// A grant ending in ".*" matches permission codes by prefix.
|
|
type Principal struct {
|
|
ID uint
|
|
MustChangePassword bool
|
|
PreferredLocale string
|
|
TokensValidAfter time.Time
|
|
Backend bool `json:"-"`
|
|
IsSuperuser bool `json:"-"`
|
|
PermissionGrants map[string]bool `json:"-"`
|
|
}
|
|
|
|
// WithUser stores the verified principal on ctx.
|
|
func WithUser(ctx context.Context, user *Principal) context.Context {
|
|
if ctx == nil {
|
|
ctx = context.Background()
|
|
}
|
|
return context.WithValue(ctx, userKey{}, user)
|
|
}
|
|
|
|
// User returns the verified principal from ctx.
|
|
func User(ctx context.Context) (*Principal, bool) {
|
|
if ctx == nil {
|
|
return nil, false
|
|
}
|
|
u, ok := ctx.Value(userKey{}).(*Principal)
|
|
return u, ok && u != nil
|
|
}
|
|
|
|
type credentialKey struct{}
|
|
|
|
// WithCredential stores the resolved credential (e.g. *ApiToken) on ctx.
|
|
func WithCredential(ctx context.Context, cred any) context.Context {
|
|
if ctx == nil {
|
|
ctx = context.Background()
|
|
}
|
|
return context.WithValue(ctx, credentialKey{}, cred)
|
|
}
|
|
|
|
// Credential returns the resolved credential from ctx.
|
|
func Credential(ctx context.Context) (any, bool) {
|
|
if ctx == nil {
|
|
return nil, false
|
|
}
|
|
c := ctx.Value(credentialKey{})
|
|
if c == nil {
|
|
return nil, false
|
|
}
|
|
return c, true
|
|
}
|