SyntropyWeb.ApiAuth (syntropy v0.2.0)

Runtime auth policy for Syntropy's external REST and channel surface.

Two token kinds are accepted:

the environment root token (SYNTROPY_API_TOKEN), which carries the :admin scope, and
database-backed scoped tokens (see Syntropy.Persistence.ApiToken), stored as SHA-256 digests with a read, write, or admin scope.

Scopes are hierarchical: admin > write > read.

Summary

scope()

required?()

token()

Validates the request bearer token and enforces the scope class required by the route (:read, :write, or :admin).

@type scope() :: :read | :write | :admin

@type validation_error() ::
  :missing_token | :invalid_token | {:insufficient_scope, scope()}

@type validation_result() :: {:ok, scope()} | {:error, validation_error()}

@spec error_message(validation_error()) :: String.t()

@spec hash_token(String.t()) :: String.t()

@spec required?() :: boolean()

@spec scope_allows?(scope(), scope()) :: boolean()

@spec token() :: String.t() | nil

@spec validate_conn(Plug.Conn.t(), scope()) :: validation_result()

Validates the request bearer token and enforces the scope class required by the route (:read, :write, or :admin).

@spec validate_socket(map()) :: validation_result()