go-authcrunch: Skill for Codex

Claims Enrichment

Ownership and integration

pkg/authz/enrichment owns the Backend.Lookup(context.Context, Request) interface, Config, Identity, Result, and New(config, backend) constructor. plugins/claims-enrichment/static adds configured JSON claims in the root Go module. Its New and Lookup APIs require no external service, credential, host framework, registration side effect, or cleanup. It supplies the same configured values to each identity accepted by the consumer's binding.

Construct a backend and enricher, then call Gatekeeper.SetClaimsEnricher(*enrichment.Enricher) or TokenValidator.SetClaimsEnricher(*enrichment.Enricher) before serving requests. A nil attachment fails without changing the active attachment. Closed validators reject attachment. Nil validators and nil/unconstructed gatekeepers return an error without panicking, so failed host provisioning cannot crash attachment. The host owns backend cleanup; drain requests before replacing an attachment or closing the backend. Construct a new detached runtime for reload. There is no global registry or JSON backend loader in root Config or authdb.

The validator invokes enrichment after authentication and before all eight ACL request guardians, once per decision even when a path has multiple interpretations. JWT and credential cache hits and public AuthorizeUser evaluations take this path. Direct OAuth policy sessions use AuthorizeUser; its input must still satisfy this feature's explicit issuer, realm, subject, tenant and audience binding. An OAuth provider that does not produce those claims cannot use the hook without a trusted adapter supplying them. Explicit gatekeeper bypass routes remain bypasses.

Enriched claims are only used by the ACL decision. The returned authenticated user, cache, identity headers, request identity, and original JWT retain their original claims. Neither initial portal issuance, refresh issuance nor downstream OIDC issuance runs this hook. Renewed tokens are enriched when subsequently used on an attached protected route. Do not describe this as token revocation or an issuance-time enrichment feature.