go-authcrunch: Skill for Codex

External Authorization

Ownership and integration

pkg/authz/external owns the public Backend.Decide(context.Context, Request) (*Result, error) interface, identity/policy binding, bounded request snapshots, and Authorizer. plugins/external-authorization/httpjson implements the HTTP transport. Core production packages must not import the plugin.

An embedding host parses both configurations, constructs httpjson.New(config, client), constructs external.New(binding, backend), and calls Gatekeeper.SetExternalAuthorizer or TokenValidator.SetExternalAuthorizer before serving. Nil/unconstructed gatekeepers and closed validators reject attachment without panic. An invalid/nil attachment cannot disable enforcement. Hosts own backend lifetime and must drain requests before replacement or disposal. There is no root JSON plugin loader, process-global registry, or automatic host module registration. The runtime hook is opt-in; omitted attachment preserves existing authorization behavior.

Local credential verification, source/path restrictions, enrichment and every local ACL check must pass before consulting the backend. An external allow is an additional requirement and cannot override local denial. Enforcement covers fresh JWTs, authentication-cache hits, Basic/API-key authentication and AuthorizeUser, including OAuth callback admission and existing OAuth sessions. AuthorizeUser and Authorizer.Authorize require an already authenticated identity; neither authenticates arbitrary caller claims.

Explicit bypass routes retain their existing behavior and do not invoke the backend. OAuth protocol endpoints retain their separate admission rules. Denial, transport/protocol failure and cancellation map to ErrAccessNotAllowed through the validator, using the existing forbidden response (normally HTTP 403, or a configured forbidden redirect), without disclosing service details or clearing valid credentials merely because the service denied access.

Policy configuration