5e555bac
authn: cookie, PAT, and dolt-JWT caller resolution
Add the authn package resolving the SourceHut caller across dolt.sr.ht's
three auth flows, producing core-go *auth.AuthContext values mapped onto the
pure core.Caller domain type:
- ctx.go: WithCaller/CallerFromContext (nil for anonymous, never panics) and
AsCoreCaller (maps UserType, derives Suspended).
- cookie.go: OptionalCookieMiddleware, the never-rejecting unified-login
cookie reader (fernet decrypt -> {name} -> LookupUser); any failure degrades
to anonymous so public browsing keeps working.
- token.go: ResolveBasic, the meta personal-access-token trio (offline
DecodeBearerToken -> username match -> LookupUser + revocation) with a 60s
positive cache keyed by sha512(password); TokenGrantsAllow gates
dolt.sr.ht/repos RO/RW grants (empty grants pass).
- jwt.go: ResolveDoltJWT, EdDSA JWS verification for dolt keypair auth (kid ->
KeyStore pubkey, alg=EdDSA, aud/exp/sub checked, iss ignored), reusing
dolt's creds.PubKeyToKIDStr for the kid<->pubkey integrity check.
- grpc.go: ResolveGRPCAuth dispatching Basic/Bearer/anonymous.
Meta lookup + revocation sit behind the MetaBackend interface and JWT keys
behind the KeyStore interface (implemented later by db/), so tests forge
cookies (fernet), PATs (BearerToken.Encode) and real Ed25519 JWTs against
in-memory stubs with no network or Postgres.
Eugene Blikh <bigbes@gmail.com> — 2026-07-18 17:40:18 UTC
Commit 5e555bac101b4a9a43a25941bc8c0fd9f8aecd03 —
view raw patch
Parent(s):
6efd2748
| File | Status | + | − |
|---|---|---|---|
authn/authn_test.go
|
A | +187 | |
authn/backend.go
|
A | +59 | |
authn/cookie.go
|
A | +75 | |
authn/cookie_test.go
|
A | +129 | |
authn/ctx.go
|
A | +69 | |
authn/ctx_test.go
|
A | +63 | |
authn/grpc.go
|
A | +49 | |
authn/grpc_test.go
|
A | +91 | |
authn/jwt.go
|
A | +116 | |
authn/jwt_test.go
|
A | +228 | |
authn/token.go
|
A | +143 | |
authn/token_test.go
|
A | +235 |