internal/api/context.go - master - t3/iam-server

internal/api/context.go
81 строка2 KB
Ivan Shibkikh
auth: phase 3
25 июл 2026, 22:51
25 июл 2026, 22:516be3f57
package api

import (
	"context"

	iamjwt "gitverse.ru/t3/iam-server/internal/auth/jwt"
)

type contextKey string

const (
	ctxKeyRequestID     contextKey = "request_id"
	ctxKeyActor         contextKey = "actor"
	ctxKeyClientCertCN  contextKey = "client_cert_cn"
	ctxKeyServiceClaims contextKey = "service_claims"
)

// Actor represents the entity performing an audited action.
type Actor struct {
	Type   string   // "admin" | "service" | "mtls"
	ID     string   // admin ID, service token hash, or client cert CN
	IP     string   // resolved client IP (real, not proxy)
	Scopes []string // admin scopes (empty for non-admin actors)
}

// RequestIDFromContext extracts the request ID from context, or returns "".
func RequestIDFromContext(ctx context.Context) string {
	v, ok := ctx.Value(ctxKeyRequestID).(string)
	if !ok {
		return ""
	}
	return v
}

// ActorFromContext extracts the actor from context, or returns a zero Actor.
func ActorFromContext(ctx context.Context) Actor {
	v, ok := ctx.Value(ctxKeyActor).(Actor)
	if !ok {
		return Actor{}
	}
	return v
}

// ClientCertCNFromContext returns the client certificate CommonName from context, or "".
func ClientCertCNFromContext(ctx context.Context) string {
	v, ok := ctx.Value(ctxKeyClientCertCN).(string)
	if !ok {
		return ""
	}
	return v
}

// WithRequestID returns a child context with the given request ID.
func WithRequestID(ctx context.Context, id string) context.Context {
	return context.WithValue(ctx, ctxKeyRequestID, id)
}

// WithActor returns a child context with the given actor.
func WithActor(ctx context.Context, actor Actor) context.Context {
	return context.WithValue(ctx, ctxKeyActor, actor)
}

// WithClientCertCN returns a child context with the client cert CommonName.
func WithClientCertCN(ctx context.Context, cn string) context.Context {
	return context.WithValue(ctx, ctxKeyClientCertCN, cn)
}

// WithServiceClaims returns a child context carrying the verified Service Token claims.
// Set by ServiceJWTMiddleware after successful RS256 verification.
func WithServiceClaims(ctx context.Context, claims *iamjwt.ServiceClaims) context.Context {
	return context.WithValue(ctx, ctxKeyServiceClaims, claims)
}

// ServiceClaimsFromContext returns the verified Service Token claims, or nil if absent.
func ServiceClaimsFromContext(ctx context.Context) *iamjwt.ServiceClaims {
	v, ok := ctx.Value(ctxKeyServiceClaims).(*iamjwt.ServiceClaims)
	if !ok {
		return nil
	}
	return v
}