some

auth/auth.go

@@ -36,6 +36,7 @@ var ErrNoCredentials = errors.New("auth: no credentials")
 type Principal struct {
 	Subject string   `json:"subject"`          // OIDC sub or API key id
 	Scopes  []string `json:"scopes,omitempty"` // e.g. ["write","admin"]
+	Roles   []string `json:"roles,omitempty"`  // e.g. ["editor","publisher","admin"]
 	Kind    string   `json:"kind"`             // KindOIDC | KindAPIKey | KindAnonymous
 }
 
@@ -44,6 +45,32 @@ func (p *Principal) HasScope(scope string) bool {
 	return slices.Contains(p.Scopes, scope)
 }
 
+// HasRole reports whether the principal carries the given role (or is an admin).
+func (p *Principal) HasRole(role string) bool {
+	if role == "" || role == "*" {
+		return true
+	}
+	for _, r := range p.Roles {
+		if r == "admin" || r == role {
+			return true
+		}
+	}
+	return false
+}
+
+// HasAnyRole reports whether the principal carries at least one of the given roles.
+func (p *Principal) HasAnyRole(roles ...string) bool {
+	if len(roles) == 0 {
+		return true
+	}
+	for _, r := range roles {
+		if p.HasRole(r) {
+			return true
+		}
+	}
+	return false
+}
+
 // Authenticator inspects request credentials and returns the caller, or an
 // error if authentication fails.
 type Authenticator interface {