From e38fa792ee8919222877e657b562e5cf570f7d8e Mon Sep 17 00:00:00 2001 From: Mathias Date: Tue, 2 Jun 2026 23:39:04 +0200 Subject: [PATCH] feat(web): add Auth seam (interface + StubAuth) for parallel UI build Lets the Dex session layer (lane B) and page handlers (lane C) build independently: handlers depend only on web.Auth; oidc.DexAuth (B) and StubAuth (dev) implement it. Co-Authored-By: Claude Opus 4.8 (1M context) --- internal/web/auth.go | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 internal/web/auth.go diff --git a/internal/web/auth.go b/internal/web/auth.go new file mode 100644 index 0000000..571be25 --- /dev/null +++ b/internal/web/auth.go @@ -0,0 +1,39 @@ +// Package web is the Stage-0 HTTP read/write surface (ADR-011, docs/ui-spec.md). +// It serves the summary reader over the existing store; the engine and ports are +// untouched (ADR-003). +// +// This file defines the auth SEAM so the Dex session layer (internal/web/oidc) +// and the page/handler layer can be built independently: handlers depend only on +// the Auth interface, never on a concrete provider. StubAuth is the allow-all +// dev/test impl; oidc.DexAuth is the production impl wired in cmd/tapir. +package web + +import "net/http" + +// User is the authenticated principal. Subject is the Dex subject used for the +// single-user allowlist (ADR-011); store operations key off the configured +// tapir user_id (UUID), not this subject. +type User struct { + Subject string + Email string +} + +// Auth gates routes and exposes the current user. Implementations: StubAuth +// (dev/test, allow-all) and oidc.DexAuth (Dex OIDC session, lane B). +type Auth interface { + // Middleware wraps h, redirecting/refusing unauthenticated requests. + Middleware(h http.Handler) http.Handler + // CurrentUser returns the authenticated user for a request. + CurrentUser(r *http.Request) (User, bool) + // Routes returns the auth endpoints to mount under /auth/ (login, callback, + // logout). StubAuth returns an empty mux. + Routes() http.Handler +} + +// StubAuth allows every request as a fixed user. Default for local dev/tests; +// replaced by oidc.DexAuth when Dex config is present (decided in cmd/tapir). +type StubAuth struct{ U User } + +func (s StubAuth) Middleware(h http.Handler) http.Handler { return h } +func (s StubAuth) CurrentUser(*http.Request) (User, bool) { return s.U, true } +func (s StubAuth) Routes() http.Handler { return http.NewServeMux() }