GoAuthTagger
Inherits GoRpcProcedureGate < GoBeegoCasbinFilter < GoRouteGroupScope < PrefixScope < FrameworkTagger < FileHelper < Tagger < Reference < Object
Constants
A condition that a request-supplied value is absent (!ok, token == "", len(sudo) == 0) or present (token != "", len(sudo) > 0).
A statement that opens with an assignment (authed := r.Group(...)).
A name that reads as a guard, applied to a middleware argument
(gin.BasicAuth, echojwt.WithConfig) only when its definition is not in
the scan: a library constructor or an interface method. A definition that
is found decides on its body, so LoginLogger() / TokenRefresher() that
only pass the request on are not guards whatever they are called.
sessions.Sessions(store) is a session store, not a check.
A refusal whose condition asks what the caller may do
(!ctx.IsUserSiteAdmin(), !ctx.Repo.Permission.CanRead(...),
!isMember) is an authorization check; any other is an authentication
one.
PocketBase: sg := rg.Group("/sql").Bind(mw) / sg.Bind(mw).
An unqualified call inside a middleware body, for the one-hop lookup.
What a local is bound to: a struct literal or a call, by type or callee.
A control-flow line: a refusal under it is conditional.
name := F(, name, err := pkg.F(, name = F(: the call that binds a
guard's receiver variable.
A closure handed to a call that is still open at the end of the line:
m.Group("/user", func() {, r.Group(func(r chi.Router) {.
The router parameter of a closure opened at the end of a line:
s.Group("/api", func(group *ghttp.RouterGroup) { -> group.
Lines worth walking for closure-scoped middleware.
A closure handed to a call on a router, taking the router:
r.Route("/x", func(r chi.Router) {.
Middleware added inside a closure group on its router: .Use( /
.Pre(, or, on the closure's own router parameter only, GoFrame's
group.Middleware( and .Bind( (a PocketBase middleware, or a GoFrame
controller whose routes the closure's middleware then guards);
group.ALLMap(g.Map{"/x": ctrl.Profile}) binds handlers like .Bind.
The request keys that carry the caller's credential, lowercased without
- / _ (api_key, X-Auth-Token). A request is stopped for lack of
one only as authentication; a stop for lack of an Idempotency-Key or
a page_token is not.
token != secret: the credential compared against an expected value.
apiKey := r.FormValue("api_key"): a request value bound to a local.
A test of the caller's credential or session, as written.
A test of a CSRF token: a call named for it (!csrfOK(r)) or a read of
a request key named for it (Header.Get("X-CSRF-Token")).
required / !required: a bare (flag) parameter.
A parameter typed as a function, with its parameter list and the start
of its result (a type, ( for several, or none).
a.Use(mw) on a group the function was handed (vikunja's
func registerAPIRoutesV2(e *echo.Echo, a *echo.Group)). The group's
prefix scope resolves a by name, which can be another function's group
(RegisterRoutes' /api/v1 one), so the routes the middleware does reach
are also recorded by lineage: those registered on a (or a group derived
from it) below the .Use, here or in a helper handed a below it
(m.Register(a)), whatever their URL.
The parameter list of a func name(...) / func (r T) name(...) head.
A one-line signature: the function name and its parameter list.
A replace of a module by a local directory, in a block or on its own
line: example.com/lib => ../lib.
The call a guard condition makes: s.Abort(c), !authorized(c), and
the chained Auth(c, x).Abort(c) (head call in groups 1-2).
if <init>; <cond> { on one line.
The registrars of a router that takes a bare handler (gorilla's
r.Handle("/x", auth(h)).Methods("GET")).
The route call's last argument when it is a bare handler reference
(r.POST("/login", AuthHandler)), plus any chained calls after it
(mux's .Methods("GET")). Only the arguments between path and handler
are middleware; a wrapped handler (authMiddleware(h)) is a call, so it
stays.
token := c.Request().Header.Get("Authorization"), c.GetHeader(…):
a request header a handler binds to a local. Headers only: a token
query or form value is as often a one-time reset/confirm token the
handler checks as the caller's credential.
A parameter typed as a handler: next http.Handler, h http.HandlerFunc.
if <cond> { then return next and }.
if cond { / } else if x := f(); cond { and } else { on their own line.
A call into another scanned package: response.JSONUnauthorized(.
Auth middleware in route definition (inline middleware)
JWT library patterns
A call's callee at the start of an expression.
Field: value inside a call-site struct literal.
name = / name :=: a local (re)bound.
name := expr / name = expr, for a middleware held in a variable
(reqSignIn := verifyAuth(&Options{SignInRequired: true})).
A local typed with a struct, so its methods resolve: authentication := auth.Auth{, var mw = &middleware.JWT{, mw *auth.Middleware.
A redirect to the login page (ctx.RedirectForLogin(...),
c.Redirect(302, "/login"), response.HTMLRedirect(w, r, loginURL)),
matched with string literals kept.
A method head's receiver type: func (m *Session) Abort( -> Session.
func (a *Auth) Name(: the receiver's name and type.
Where the middleware arguments start on a code_only line (string
literals blanked to ""): right after .Use( / .Pre( (GoFrame's
.Middleware(), or after the path literal of a Group("/seg", ...)
constructor or a route call.
One middleware argument's head: AuthMiddleWare() -> {"", "AuthMiddleWare"},
auth.Required() -> {"auth", "Required"}, gin.BasicAuth(gin.Accounts{ ->
{"gin", "BasicAuth"}. A closure (func(c *gin.Context) {) is excluded.
A statement binding its right-hand side: h := x, h = x, var h T = x.
mux.Handle( / mux.HandleFunc( at a statement start, with the mux.
options.SignInRequired / !options.SignOutRequired read off a parameter.
pkg.Var.Field with no call: a package-level (configuration) value.
An if block that only lets the request through: return, optionally
after handing it on (c.Next(), next.ServeHTTP(w, r)).
Routers whose group middleware runs for every route under the group's path, whatever group registered it.
A statement that calls a method on a value: a.evaluateOr401(ctx, ...).
The group variable a registration line credits: authV1 for both
authV1.Use(auth) and authV1 := apiV1.Group("/", auth).
A middleware body line that refuses the request: a 401/403 status handed
to a reply or abort call (AbortWithStatus(http.StatusUnauthorized),
c.JSON(403, ...), http.Error(w, "", 401), WriteHeader(403)) or a
framework sentinel error (echo.ErrUnauthorized, fiber.ErrForbidden).
Matched on code_only source, so a 401 in a comment or log string does
not count, and == http.StatusUnauthorized (a comparison, as in a
logging middleware) does not either.
PocketBase replies with e.UnauthorizedError(...) / e.ForbiddenError(...)
(before 0.23, apis.NewUnauthorizedError(...)), GoFrame with
r.SetError(gerror.NewCode(gcode.CodeNotAuthorized, ...)).
The URL prefix of a group the caller builds from its engine
(g := e.Group("/admin"), with e *echo.Echo), read up from row;
nil for anything else, a group handed in included.
PocketBase: sub.GET("", h).Bind(apis.RequireSuperuserAuth()).
A route call on a line: m.Post(, .GET(, or a chained Delete(.
The variable a route line registers on: authV1 for authV1.POST(...).
A library's router constructor: gin.Default(), chi.NewRouter(),
fiber.New(...).
The parameters a request handler takes: the router's context
(echo.Context, *gin.Context, *fiber.Ctx), not a context.Context,
or both halves of a net/http handler.
A router read off another variable: r.Group("/x"), r.PathPrefix("/api"). Subrouter(), r.With(mw), or r itself.
A call on a value: session.Require(c), a.V.Verify(c).
Kratos: the http.Middleware(...) server option (under whatever alias
the file imports Kratos' transport/http as), run for every route the
server serves.
A middleware config's Skipper: set to anything but the default.
A scope is only ever recorded for a line resolve_use_scope or
resolve_group_middleware_scope resolves: a .Use( / .Pre( call or a
Group("/seg", mw...) constructor — so a file with neither anywhere
registers nothing, and the pre-scan can skip its per-line group tracking
outright.
Also GoFrame's group.Middleware( and Kratos' http.Middleware(
server option. (PocketBase's .Bind( is gated on the file importing
PocketBase: c.Bind(&req) is in every gin / echo handler file.)
Middleware handed to r.With(mw...) ahead of a route or group.
Constructors
Class methods
Instance methods
The per-endpoint shape: look at each endpoint, tag in place, hand the
array back. Taggers declare only check_endpoint; those that need a
pass over the whole set first (a project pre-scan, mcp's legacy
prefixes) override perform and call super or loop themselves.