auth

type Authenticator ¶

type Authenticator interface {
	Verify(ctx context.Context, m proto.Message, auth *commonpb.Auth) error
}

Authenticator authenticates a message with the provided auth.

It is not usually sufficient to rely purely on authentication for permissions, as a lookup must be completed. However, if a message is not authentic, we can short circuit authorization.

In general, users should use an Authorizer, and Authorizer's should use an Authenticator.

func NewKeyPairAuthenticator(log *zap.Logger) Authenticator

type Authorizer ¶

type Authorizer interface {
	Authorize(ctx context.Context, m proto.Message, authField **commonpb.Auth) (*commonpb.UserId, error)
}

Authorizer authorizes an action for a UserId with the given auth.

If the auth is authorized, it is also authenticated. Authorization is more expensive than authentication as lookups must be performed.

type StaticAuthorizer ¶

type StaticAuthorizer struct {
	// contains filtered or unexported fields
}

func NewStaticAuthorizer(log *zap.Logger) *StaticAuthorizer

func (a *StaticAuthorizer) Add(userID *commonpb.UserId, pair model.KeyPair)

func (a *StaticAuthorizer) Authorize(ctx context.Context, m proto.Message, authField **commonpb.Auth) (*commonpb.UserId, error)