jleung
b3aae800bf
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lx9FNLG2CqeBbVGGd9bFsP
16 lines
907 B
Go
16 lines
907 B
Go
// Package auth authenticates and authorises every request to nmon's API and UI.
|
|
//
|
|
// Three kinds of credential reach a handler, and each becomes the same Principal:
|
|
//
|
|
// - a cookie session created by the OIDC login (ViaSession) or the break-glass login (ViaBreakGlass);
|
|
// - an API token "nma_<id>_<secret>" in an Authorization: Bearer header (ViaToken);
|
|
//
|
|
// Push tokens ("nmp_...") belong to ingest alone. Middleware answers 403 to one used anywhere
|
|
// else, and leaves ingest paths to ingest's own authenticator.
|
|
//
|
|
// The pieces are separate so each can be tested alone: Sessions and the signing keys (session.go,
|
|
// signer.go), Tokens (tokens.go), OIDC (oidc.go), BreakGlass (breakglass.go), the trusted-proxy
|
|
// resolver (proxy.go), the per-route Policy (policy.go) and the Middleware that ties them together
|
|
// (middleware.go). Auth (auth.go) builds them from one Options value.
|
|
package auth
|