Module service_commons.auth
commons/service_commons.auth
Functions
callerOf
function callerOf(RequestContext ctx) returns CallerIdentity|errorReturns the caller resolved by AuthInterceptor.
Parameters
- ctx RequestContext - The request context
Return Type
- CallerIdentity|error - The caller, or an error if the interceptor did not run
holdsScope
function holdsScope(CallerIdentity caller, string scope) returns booleanChecks that the caller holds a scope whether or not enforceScopes is on. Use it for privileged overrides such
as reading another user's data or acting as an agent.
Return Type
- boolean -
trueif the caller's scopes include it or*
Classes
service_commons.auth: Authenticator
Resolves the caller of a request from a bearer JWT, an API key or trusted headers.
Constructor
Creates an authenticator.
init (AuthConfig config)- config AuthConfig - Auth settings
authenticate
function authenticate(Request req) returns CallerIdentity|UnauthorizedResolves the caller.
Parameters
- req Request - The request
Return Type
- CallerIdentity|Unauthorized - The caller, or
401when no enabled scheme accepts the credentials
hasScope
function hasScope(CallerIdentity caller, string scope) returns booleanChecks that the caller holds a scope. Passes when enforceScopes is off.
Return Type
- boolean -
trueif the caller may proceed
service_commons.auth: AuthInterceptor
Request interceptor that resolves the caller and stores it in the request context.
A ticket query parameter authenticates as the caller the ticket was issued to.
Constructor
Creates the interceptor.
init (Authenticator authenticator, TicketStore tickets)- authenticator Authenticator - Resolves callers from credentials
- tickets TicketStore - Redeems SSE stream tickets
'default [string... path]
function 'default [string... path](RequestContext ctx, Request req) returns NextService|Unauthorized|error?service_commons.auth: TicketStore
Single-use, short-lived tickets that let EventSource authenticate an SSE stream through the URL.
Constructor
Creates a ticket store.
init (int ttlSeconds)- ttlSeconds int 60 - How long an unredeemed ticket stays valid
issue
function issue(CallerIdentity caller) returns stringIssues a ticket for a caller.
Parameters
- caller CallerIdentity - The authenticated caller the ticket stands for
Return Type
- string - The ticket
redeem
function redeem(string ticket) returns CallerIdentity?Redeems a ticket; a ticket works once.
Parameters
- ticket string - The ticket
Return Type
- CallerIdentity? - The caller it was issued for, or
()if it is unknown, used or expired
ttlSeconds
function ttlSeconds() returns intTicket lifetime in seconds.
Return Type
- int - The lifetime
Constants
service_commons.auth: ALL_SCOPES
Scope that grants every operation.
service_commons.auth: HEADER_USER_ID
Header carrying the user ID in trusted-header mode and for API-key callers.
service_commons.auth: HEADER_USER_ROLES
Header carrying comma-separated roles in trusted-header mode and for API-key callers.
service_commons.auth: HEADER_USER_SCOPES
Header carrying space-separated scopes in trusted-header mode; absent grants none.
service_commons.auth: TICKET_PARAM
Query parameter carrying an SSE stream ticket.
Records
service_commons.auth: AuthConfig
Listener auth settings, mirroring the workflow module's management.rest configurables.
With neither JWT nor API key enabled, the service trusts the x-user-* headers (development only).
Fields
- enableJwtAuth boolean(default false) - Validates bearer JWTs
- jwtIssuer string(default "") - Expected
issclaim; empty skips the check
- jwtAudience string(default "") - Expected
audclaim; empty skips the check
- jwksUrl string(default "") - JWKS endpoint of the IdP
- jwksVerifyTls boolean(default true) - Verifies the JWKS endpoint's TLS certificate; turn off only for a self-signed demo IdP
- jwtCertFile string(default "") - PEM certificate to validate signatures with instead of
jwksUrl
- userIdClaim string(default "sub") - Claim holding the user ID; dotted paths address nested claims
- rolesClaim string(default "groups") - Claim holding the roles, e.g.
groupsorrealm_access.roles
- enforceScopes boolean(default false) - Requires the operation's scope in the
scope/scpclaim
- enableApiKey boolean(default false) - Accepts a static API key for service accounts; the caller then acts with every scope
- apiKeyHeader string(default "x-api-key") - Header carrying the API key
- apiKeyValue string(default "") - Expected API key value
service_commons.auth: CallerIdentity
The caller resolved from a request's credentials.
Fields
- userId string - User ID from
userIdClaim
- roles string[](default []) - Roles from
rolesClaim
- scopes string[](default []) - Granted OAuth scopes;
*grants all (API-key callers)
Import
import commons/service_commons.auth;Other versions
0.1.0