Function AuthHandler

wrapper/auth/server.go:44–110

AuthHandler returns a server HandlerWrapper that enforces authentication and authorization. For each incoming request: 1. Extracts Bearer token from metadata 2. Verifies token using auth.Inspect() 3. Checks authorization using rules.Verify() 4. Adds account to context 5. Calls the handler if author

(opts HandlerOptions)

//	    })),
//	)
func AuthHandler(opts HandlerOptions) server.HandlerWrapper {
	return func(h server.HandlerFunc) server.HandlerFunc {
		return func(ctx context.Context, req server.Request, rsp interface{}) error {
			// Get endpoint name
			endpoint := req.Endpoint()

			// Check if this endpoint should skip auth
			for _, skip := range opts.SkipEndpoints {
				if skip == endpoint {
					// Skip auth, proceed to handler
					return h(ctx, req, rsp)
				}
			}

			// Extract metadata from context
			md, ok := metadata.FromContext(ctx)
			if !ok {
				return errors.Unauthorized(req.Service(), "missing metadata")
			}

			// Extract and verify token
			token, err := TokenFromMetadata(md)
			if err != nil {
				if err == ErrMissingToken {
					return errors.Unauthorized(req.Service(), "missing authorization token")
				}
				return errors.Unauthorized(req.Service(), "invalid authorization token: %v", err)
			}

			// Verify token and get account
			var account *auth.Account
			if opts.Auth != nil {
				account, err = opts.Auth.Inspect(token)
				if err != nil {
					if err == auth.ErrInvalidToken {
						return errors.Unauthorized(req.Service(), "invalid token")
					}
					return errors.Unauthorized(req.Service(), "token verification failed: %v", err)
				}
			}

			// Check authorization if rules are provided
			if opts.Rules != nil && account != nil {
				resource := &auth.Resource{
					Name:     req.Service(),
					Type:     "service",
					Endpoint: endpoint,
				}

				if err := opts.Rules.Verify(account, resource); err != nil {
					if err == auth.ErrForbidden {
						return errors.Forbidden(req.Service(), "access denied to %s", endpoint)
					}
					return errors.Forbidden(req.Service(), "authorization failed: %v", err)
				}
			}

			// Add account to context for handler to use