nmon/internal/auth/problem.go

package auth

import (
	"encoding/json"
	"errors"
	"net/http"
)

// Authentication failures. Middleware maps them to 401 and 403.
var (
	// ErrUnauthenticated covers missing, unknown, malformed, expired and revoked credentials alike.
	ErrUnauthenticated = errors.New("auth: missing, unknown, expired or revoked credential")
	// ErrForbidden is a valid credential that may not do this: a push token outside ingest, a viewer on an admin route.
	ErrForbidden = errors.New("auth: credential does not allow this")
	// ErrCSRF is a cookie-session mutation without the right X-CSRF-Token.
	ErrCSRF = errors.New("auth: missing or wrong CSRF token")
)

// writeProblem sends an RFC 9457 problem document.
func writeProblem(w http.ResponseWriter, status int, detail string) {
	w.Header().Set("Content-Type", "application/problem+json")
	w.Header().Set("Cache-Control", "no-store")
	w.WriteHeader(status)
	// The client may have gone; there is nobody to tell.
	_ = json.NewEncoder(w).Encode(map[string]any{"title": http.StatusText(status), "status": status, "detail": detail})
}