mathiasandClaude Opus 4.8
e38fa792ee
Lets the Dex session layer (lane B) and page handlers (lane C) build independently: handlers depend only on web.Auth; oidc.DexAuth (B) and StubAuth (dev) implement it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
1.7 KiB
Go
40 lines
1.7 KiB
Go
// Package web is the Stage-0 HTTP read/write surface (ADR-011, docs/ui-spec.md).
|
|
// It serves the summary reader over the existing store; the engine and ports are
|
|
// untouched (ADR-003).
|
|
//
|
|
// This file defines the auth SEAM so the Dex session layer (internal/web/oidc)
|
|
// and the page/handler layer can be built independently: handlers depend only on
|
|
// the Auth interface, never on a concrete provider. StubAuth is the allow-all
|
|
// dev/test impl; oidc.DexAuth is the production impl wired in cmd/tapir.
|
|
package web
|
|
|
|
import "net/http"
|
|
|
|
// User is the authenticated principal. Subject is the Dex subject used for the
|
|
// single-user allowlist (ADR-011); store operations key off the configured
|
|
// tapir user_id (UUID), not this subject.
|
|
type User struct {
|
|
Subject string
|
|
Email string
|
|
}
|
|
|
|
// Auth gates routes and exposes the current user. Implementations: StubAuth
|
|
// (dev/test, allow-all) and oidc.DexAuth (Dex OIDC session, lane B).
|
|
type Auth interface {
|
|
// Middleware wraps h, redirecting/refusing unauthenticated requests.
|
|
Middleware(h http.Handler) http.Handler
|
|
// CurrentUser returns the authenticated user for a request.
|
|
CurrentUser(r *http.Request) (User, bool)
|
|
// Routes returns the auth endpoints to mount under /auth/ (login, callback,
|
|
// logout). StubAuth returns an empty mux.
|
|
Routes() http.Handler
|
|
}
|
|
|
|
// StubAuth allows every request as a fixed user. Default for local dev/tests;
|
|
// replaced by oidc.DexAuth when Dex config is present (decided in cmd/tapir).
|
|
type StubAuth struct{ U User }
|
|
|
|
func (s StubAuth) Middleware(h http.Handler) http.Handler { return h }
|
|
func (s StubAuth) CurrentUser(*http.Request) (User, bool) { return s.U, true }
|
|
func (s StubAuth) Routes() http.Handler { return http.NewServeMux() }
|