---

Class ::nsmcp::BearerAuthenticator

::nsmcp::BearerAuthenticator create ... \
           [ -store:required store:required ]

Only the table name enters the blueprint. Credential records live in nsv.

Defined in /usr/local/ns/tcl/nsmcp/security.tcl

Class Relations

• class: ::nx::Class
• superclass: ::nsmcp::Authenticator

::nx::Class create ::nsmcp::BearerAuthenticator \
     -superclass ::nsmcp::Authenticator

Methods (to be applied on instances)

• authenticate (scripted, public)

   <instance of nsmcp::BearerAuthenticator> authenticate \
      authorization server

  Authenticate a bearer header for the selected server. Validate token syntax, resolve its digest and check expiry before creating a request-owned context.

  Parameters:

  authorization (required)

  Authorization header supplied by the caller.

  server (required)

  Selected NaviServer virtual-server name.

  Returns:

  A RequestContext object, or an HTTP 401 error on rejection.

  Testcases:

  No testcase defined.

  if {![regexp {^Bearer ([A-Za-z0-9._~+/-]+=*)$} $authorization -> token]} {
      return [next]
  }
  set digest [ns_crypto::md string -digest sha256 -- $token]
  if {![nsv_get ${:store} $digest record] ||
      ([dict get $record expires] != 0 && [dict get $record expires] <= [clock seconds])} {
      return [next]
  }
  return [::nsmcp::RequestContext new  -principal [dict get $record principal]  -permissions [dict get $record permissions]  -targets [dict get $record targets] -server $server]

• credentialInfo (scripted, public)

   <instance of nsmcp::BearerAuthenticator> credentialInfo digest

  Read retained metadata for a credential digest. Return only the digest-indexed grant record, never a bearer token.

  Parameters:

  digest (required)

  Hexadecimal SHA-256 credential digest.

  Returns:

  The credential record, or an empty result when it is absent.

  Testcases:

  No testcase defined.

  if {![nsv_get ${:store} $digest record]} {
      return {}
  }
  return $record

• grant (scripted, public)

   <instance of nsmcp::BearerAuthenticator> grant token principal \
      permissions targets expires

  Grant a supplied bearer token to a principal and target set. Validate token length and expiry, then store the digest-indexed grant without retaining the token itself.

  Parameters:

  token (required)

  High-entropy bearer token; only its digest is retained.

  principal (required)

  Authenticated principal identifier.

  permissions (required)

  Explicit permission names granted to the credential.

  targets (required)

  Server names which the credential may target.

  expires (required)

  Expiry timestamp in epoch seconds, or zero for no expiry.

  Returns:

  The hexadecimal token digest.

  Testcases:

  No testcase defined.

  if {[string length $token] < 32 || $principal eq "" ||
      ![string is wideinteger -strict $expires] || ($expires != 0 && $expires <= [clock seconds])} {
      error "expected a high-entropy token, named principal and expiry of zero or a future timestamp"
  }
  set digest [ns_crypto::md string -digest sha256 -- $token]
  nsv_set ${:store} $digest [dict create principal $principal  permissions $permissions targets $targets expires $expires]
  return $digest

• issue (scripted, public)

   <instance of nsmcp::BearerAuthenticator> issue principal \
      permissions targets expires

  Create and grant a new bearer credential. Generate a high-entropy token, store only its digest and grants, and return the secret to the administrator once.

  Parameters:

  principal (required)

  Authenticated principal identifier.

  permissions (required)

  Explicit permission names granted to the credential.

  targets (required)

  Server names which the credential may target.

  expires (required)

  Expiry timestamp in epoch seconds, or zero for no expiry.

  Returns:

  A dictionary containing token, digest and expires.

  Testcases:

  No testcase defined.

  # Explicit administrative operation; never called automatically at init.
  # Return the secret once, without logging it or storing it in nsv.
  set token [ns_crypto::randombytes -encoding hex 32]
  set digest [:grant $token $principal $permissions $targets $expires]
  return [dict create token $token digest $digest expires $expires]

• revoke (scripted, public)

   <instance of nsmcp::BearerAuthenticator> revoke digest

  Revoke a digest-indexed credential. Remove the retained grant if present; do not require the original bearer token.

  Parameters:

  digest (required)

  Hexadecimal SHA-256 credential digest.

  Returns:

  The shared-store deletion result.

  Testcases:

  No testcase defined.

  nsv_unset -nocomplain ${:store} $digest

---