import "github.com/kinorai/omnifeed/internal/auth"
Package auth defines an Authenticator interface for inbound transports. v0.1 ships a single shared bearer-token implementation, but the interface leaves room for multi-key, JWT, or DB-backed implementations later without touching transport code.
var (
// ErrUnauthenticated is returned when no valid credential is present.
ErrUnauthenticated = errors.New("unauthenticated")
)
func OriginGuard(allowed []string) func(http.Handler) http.Handler
OriginGuard returns middleware that blocks cross-origin browser requests — the DNS-rebinding guard the MCP Streamable HTTP transport spec requires. It wraps every HTTP mux in main (not just the MCP one) because the loader and search transports are reachable by the same rebinding trick.
Native clients send no Origin header and always pass. Browsers do send one: loopback origins pass (browser-based tools like the MCP inspector run there), origins in allowed pass (exact value match, expected lowercase — config.Load lowercases them), everything else is 403 before auth runs.
AlwaysAllow is the dev-mode authenticator: no credential required, every request runs as the self-tenant. Intended for local docker-run tryouts.
type AlwaysAllow struct{}
func (AlwaysAllow) Authenticate(*http.Request) (TenantID, error)
Authenticate always returns SelfTenant and no error.
Authenticator validates an HTTP request and returns the caller’s tenant.
type Authenticator interface {
Authenticate(r *http.Request) (TenantID, error)
}
SharedBearer accepts a single shared bearer token and compares it in constant time to avoid timing side-channels.
type SharedBearer struct {
// contains filtered or unexported fields
}
func NewSharedBearer(token string) *SharedBearer
NewSharedBearer returns an authenticator that accepts exactly the given token. If token is empty, callers should use AlwaysAllow instead.
func (s *SharedBearer) Authenticate(r *http.Request) (TenantID, error)
Authenticate validates the Authorization: Bearer <token> header against the configured shared token in constant time.
TenantID identifies the caller. Single-tenant deployments use “self”.
type TenantID string
SelfTenant is the default tenant used in single-tenant deployments.
const SelfTenant TenantID = "self"
Generated by gomarkdoc