Auth Overview

Zen's auth system is built around the Authenticator interface - any authentication strategy can be plugged in by implementing a single method.

Interface

type Authenticator interface {
    Authenticate(r *http.Request) (*User, error)
}

Return a *User on success or an error to trigger the configured error handler.

Usage

Apply authentication as middleware. Optionally skip routes with SkipPaths:

r.Use(auth.RequireAuth(jwtAuth))
r.Use(auth.RequireAuth(jwtAuth, auth.SkipPaths("/health")))

User Struct

type User struct {
    ID          string
    Username    string
    Authorities []string
    Claims      map[string]any
}

• Role-Based Access (RBAC) - RequireRole and user.RequireRole("admin")
• Permission-Based Access (PBAC) - RequirePermission, RequireAnyPermission, and RequireAllPermissions
• Claim-Based Access - RequireClaim for enforcing specific claim values
• Claims carry provider-specific data (e.g., OIDC claims).

Retrieving the User

user := auth.GetUser(c)

Returns the authenticated *User from the context, or nil if not authenticated.

Password Helpers

Use the built-in password helpers for hashing and validation:

hashed, err := auth.HashPassword("secret")
hashed, err := auth.HashPassword("secret", 12) // optional bcrypt cost

ok := auth.ValidatePassword(hashed, "secret")