HTTP-level interceptors for user module authentication, authorization, and audit.
These interceptors work with the HTTP interceptor architecture (ADR-010) and operate on HTTP contexts with enter/leave/error semantics.
Key Differences from Domain Interceptors:
HTTP Context Shape: {:request Ring request map :response Ring response map :route Route metadata :system {:logger :metrics-emitter :error-reporter} :attrs Additional attributes :correlation-id UUID :started-at Instant}
Usage: ["/users" {:post {:handler create-user-handler :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-action]}}]
HTTP-level interceptors for user module authentication, authorization, and audit.
These interceptors work with the HTTP interceptor architecture (ADR-010) and operate
on HTTP contexts with enter/leave/error semantics.
Key Differences from Domain Interceptors:
- Domain interceptors (user.shell.interceptors) handle validation/transformation pipelines
- HTTP interceptors (this namespace) handle cross-cutting HTTP concerns (auth, audit, rate-limit)
HTTP Context Shape:
{:request Ring request map
:response Ring response map
:route Route metadata
:system {:logger :metrics-emitter :error-reporter}
:attrs Additional attributes
:correlation-id UUID
:started-at Instant}
Usage:
["/users"
{:post {:handler create-user-handler
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-action]}}]Standard interceptor stack for admin-only endpoints.
Applies authentication, admin authorization, and audit logging.
Usage: ["/users" {:post {:handler create-user :interceptors user.http-interceptors/admin-endpoint-stack}}]
Standard interceptor stack for admin-only endpoints.
Applies authentication, admin authorization, and audit logging.
Usage:
["/users"
{:post {:handler create-user
:interceptors user.http-interceptors/admin-endpoint-stack}}](create-custom-stack {:keys [auth authz audit]})Creates a custom interceptor stack from components.
Args: components: Map of interceptor components - :auth - Authentication interceptor (optional) - :authz - Authorization interceptor (optional) - :audit - Audit interceptor (optional)
Returns: Vector of interceptors in correct order
Example: (create-custom-stack {:auth require-authenticated :authz (require-role "manager") :audit log-all-actions})
Creates a custom interceptor stack from components.
Args:
components: Map of interceptor components
- :auth - Authentication interceptor (optional)
- :authz - Authorization interceptor (optional)
- :audit - Audit interceptor (optional)
Returns:
Vector of interceptors in correct order
Example:
(create-custom-stack {:auth require-authenticated
:authz (require-role "manager")
:audit log-all-actions})Logs successful actions in leave phase for audit trail.
Only logs successful actions (2xx responses). Failures are already logged by error-reporting interceptors.
Usage: ["/users" {:post {:handler create-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-action]}}]
Logs successful actions in leave phase for audit trail.
Only logs successful actions (2xx responses). Failures are already
logged by error-reporting interceptors.
Usage:
["/users"
{:post {:handler create-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-action]}}]Logs ALL actions (success and failure) in leave phase.
More verbose than log-action. Use for high-security endpoints.
Usage: ["/admin/users/:id/hard-delete" {:post {:handler hard-delete-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-all-actions]}}]
Logs ALL actions (success and failure) in leave phase.
More verbose than log-action. Use for high-security endpoints.
Usage:
["/admin/users/:id/hard-delete"
{:post {:handler hard-delete-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-all-actions]}}]Interceptor stack for public endpoints (no auth required).
Only applies audit logging for successful actions.
Usage: ["/health" {:get {:handler health-check :interceptors user.http-interceptors/public-endpoint-stack}}]
Interceptor stack for public endpoints (no auth required).
Only applies audit logging for successful actions.
Usage:
["/health"
{:get {:handler health-check
:interceptors user.http-interceptors/public-endpoint-stack}}]Requires user to have 'admin' role.
Assumes require-authenticated has already run (should be earlier in chain).
Usage: ["/users" {:post {:handler create-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin]}}]
Requires user to have 'admin' role.
Assumes require-authenticated has already run (should be earlier in chain).
Usage:
["/users"
{:post {:handler create-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin]}}]Requires an authenticated user on the request.
Checks for user in the normalized request shape. If not present, short-circuits with 401 Unauthorized response.
Usage: ["/users" {:get {:handler list-users :interceptors ['user.http-interceptors/require-authenticated]}}]
Requires an authenticated user on the request.
Checks for user in the normalized request shape. If not present, short-circuits
with 401 Unauthorized response.
Usage:
["/users"
{:get {:handler list-users
:interceptors ['user.http-interceptors/require-authenticated]}}]Requires the current user to be a platform-level admin without tenant context.
Requires the current user to be a platform-level admin without tenant context.
(require-role required-role)Factory function to create role-checking interceptor.
Args: required-role: Role keyword or string to check (e.g., :admin or "admin")
Returns: Interceptor that checks for the required role
Usage: ["/manager-reports" {:get {:handler manager-reports :interceptors ['user.http-interceptors/require-authenticated (user.http-interceptors/require-role "manager")]}}]
Factory function to create role-checking interceptor.
Args:
required-role: Role keyword or string to check (e.g., :admin or "admin")
Returns:
Interceptor that checks for the required role
Usage:
["/manager-reports"
{:get {:handler manager-reports
:interceptors ['user.http-interceptors/require-authenticated
(user.http-interceptors/require-role "manager")]}}]Requires user to be accessing their own resource OR be an admin.
Checks if :id path parameter matches session user ID, or if user is admin.
Usage: ["/users/:id" {:put {:handler update-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-self-or-admin]}}]
Requires user to be accessing their own resource OR be an admin.
Checks if :id path parameter matches session user ID, or if user is admin.
Usage:
["/users/:id"
{:put {:handler update-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-self-or-admin]}}]Requires the current user to have the :admin role in the active tenant membership.
Shorthand for (require-tenant-role #{:admin}).
Usage: ["/api/tenants/:tenant-id/settings" {:put {:handler update-settings :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-tenant-admin]}}]
Requires the current user to have the :admin role in the active tenant membership.
Shorthand for (require-tenant-role #{:admin}).
Usage:
["/api/tenants/:tenant-id/settings"
{:put {:handler update-settings
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-tenant-admin]}}]Requires an active tenant membership to be present on the request.
Reads :tenant-membership set by wrap-tenant-membership middleware. Short-circuits with 403 when no active membership is found.
Usage: ["/api/tenants/:tenant-id/documents" {:get {:handler list-documents :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-tenant-member]}}]
Requires an active tenant membership to be present on the request.
Reads :tenant-membership set by wrap-tenant-membership middleware.
Short-circuits with 403 when no active membership is found.
Usage:
["/api/tenants/:tenant-id/documents"
{:get {:handler list-documents
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-tenant-member]}}](require-tenant-role allowed-roles)Factory function: returns an interceptor that requires the given tenant role(s).
Reads :tenant-membership set by wrap-tenant-membership middleware. Short-circuits with 403 when the membership is absent or has insufficient role.
Args: allowed-roles - set of allowed role keywords, e.g. #{:admin}
Returns: Interceptor map.
Factory function: returns an interceptor that requires the given tenant role(s).
Reads :tenant-membership set by wrap-tenant-membership middleware.
Short-circuits with 403 when the membership is absent or has insufficient role.
Args:
allowed-roles - set of allowed role keywords, e.g. #{:admin}
Returns:
Interceptor map.Requires NO authenticated user in session.
Useful for routes like /register or /login where being logged in should redirect or prevent access.
Usage: ["/register" {:get {:handler register-page :interceptors ['user.http-interceptors/require-unauthenticated]}}]
Requires NO authenticated user in session.
Useful for routes like /register or /login where being logged in
should redirect or prevent access.
Usage:
["/register"
{:get {:handler register-page
:interceptors ['user.http-interceptors/require-unauthenticated]}}]Requires the current user to have the :admin role in the active tenant membership.
Like require-tenant-admin, but web-aware: when the request URI starts with /web it redirects to /web/login (302) instead of returning a JSON 403. Use this on HTML routes so the browser lands on the login page rather than a bare error body.
Usage: ["/web/tenants/:tenant-id/settings" {:get {:handler settings-page :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-web-tenant-admin]}}]
Requires the current user to have the :admin role in the active tenant membership.
Like require-tenant-admin, but web-aware: when the request URI starts with /web
it redirects to /web/login (302) instead of returning a JSON 403. Use this on
HTML routes so the browser lands on the login page rather than a bare error body.
Usage:
["/web/tenants/:tenant-id/settings"
{:get {:handler settings-page
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-web-tenant-admin]}}]Standard interceptor stack for authenticated user endpoints.
Applies authentication and audit logging (no role check).
Usage: ["/users/:id" {:get {:handler get-user :interceptors user.http-interceptors/user-endpoint-stack}}]
Standard interceptor stack for authenticated user endpoints.
Applies authentication and audit logging (no role check).
Usage:
["/users/:id"
{:get {:handler get-user
:interceptors user.http-interceptors/user-endpoint-stack}}]cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |