Function NewTokenAuthInterceptor

server/auth.go:42–59

NewTokenAuthInterceptor creates a new auth interceptor. If token is empty and no JWT config is set, authentication is disabled. JWT is configured via CHATCLI_JWT_SECRET environment variable.

(token string, logger *zap.Logger)

// If token is empty and no JWT config is set, authentication is disabled.
// JWT is configured via CHATCLI_JWT_SECRET environment variable.
func NewTokenAuthInterceptor(token string, logger *zap.Logger) *TokenAuthInterceptor {
	ai := &TokenAuthInterceptor{
		token:           token,
		logger:          logger,
		failureLimiters: make(map[string]*rate.Limiter),
	}

	// Load JWT secret from environment if available
	if secret := os.Getenv("CHATCLI_JWT_SECRET"); secret != "" {
		ai.jwtSecret = []byte(secret)
		logger.Info("JWT authentication enabled (HS256)")
	}

	// Start background cleanup to prevent memory leak from auth failure limiters
	ai.startFailureLimiterCleanup()

	return ai
}

// Unary returns a grpc.UnaryServerInterceptor that validates credentials and
// injects UserInfo into the context for downstream access control.