HTTP-level interceptors for user module authentication, authorization, and audit.
These interceptors work with the HTTP interceptor architecture (ADR-010) and operate on HTTP contexts with enter/leave/error semantics.
Key Differences from Domain Interceptors:
HTTP Context Shape: {:request Ring request map :response Ring response map :route Route metadata :system {:logger :metrics-emitter :error-reporter} :attrs Additional attributes :correlation-id UUID :started-at Instant}
Usage in Normalized Routes: {:path "/users" :methods {:post {:handler create-user-handler :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-action]}}}
HTTP-level interceptors for user module authentication, authorization, and audit.
These interceptors work with the HTTP interceptor architecture (ADR-010) and operate
on HTTP contexts with enter/leave/error semantics.
Key Differences from Domain Interceptors:
- Domain interceptors (user.shell.interceptors) handle validation/transformation pipelines
- HTTP interceptors (this namespace) handle cross-cutting HTTP concerns (auth, audit, rate-limit)
HTTP Context Shape:
{:request Ring request map
:response Ring response map
:route Route metadata
:system {:logger :metrics-emitter :error-reporter}
:attrs Additional attributes
:correlation-id UUID
:started-at Instant}
Usage in Normalized Routes:
{:path "/users"
:methods {:post {:handler create-user-handler
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-action]}}}Standard interceptor stack for admin-only endpoints.
Applies authentication, admin authorization, and audit logging.
Usage: {:path "/users" :methods {:post {:handler create-user :interceptors user.http-interceptors/admin-endpoint-stack}}}
Standard interceptor stack for admin-only endpoints.
Applies authentication, admin authorization, and audit logging.
Usage:
{:path "/users"
:methods {:post {:handler create-user
:interceptors user.http-interceptors/admin-endpoint-stack}}}(create-custom-stack {:keys [auth authz audit]})Creates a custom interceptor stack from components.
Args: components: Map of interceptor components - :auth - Authentication interceptor (optional) - :authz - Authorization interceptor (optional) - :audit - Audit interceptor (optional)
Returns: Vector of interceptors in correct order
Example: (create-custom-stack {:auth require-authenticated :authz (require-role "manager") :audit log-all-actions})
Creates a custom interceptor stack from components.
Args:
components: Map of interceptor components
- :auth - Authentication interceptor (optional)
- :authz - Authorization interceptor (optional)
- :audit - Audit interceptor (optional)
Returns:
Vector of interceptors in correct order
Example:
(create-custom-stack {:auth require-authenticated
:authz (require-role "manager")
:audit log-all-actions})Logs successful actions in leave phase for audit trail.
Only logs successful actions (2xx responses). Failures are already logged by error-reporting interceptors.
Usage: {:path "/users" :methods {:post {:handler create-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-action]}}}
Logs successful actions in leave phase for audit trail.
Only logs successful actions (2xx responses). Failures are already
logged by error-reporting interceptors.
Usage:
{:path "/users"
:methods {:post {:handler create-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-action]}}}Logs ALL actions (success and failure) in leave phase.
More verbose than log-action. Use for high-security endpoints.
Usage: {:path "/admin/users/:id/hard-delete" :methods {:post {:handler hard-delete-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin 'user.http-interceptors/log-all-actions]}}}
Logs ALL actions (success and failure) in leave phase.
More verbose than log-action. Use for high-security endpoints.
Usage:
{:path "/admin/users/:id/hard-delete"
:methods {:post {:handler hard-delete-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin
'user.http-interceptors/log-all-actions]}}}Interceptor stack for public endpoints (no auth required).
Only applies audit logging for successful actions.
Usage: {:path "/health" :methods {:get {:handler health-check :interceptors user.http-interceptors/public-endpoint-stack}}}
Interceptor stack for public endpoints (no auth required).
Only applies audit logging for successful actions.
Usage:
{:path "/health"
:methods {:get {:handler health-check
:interceptors user.http-interceptors/public-endpoint-stack}}}Requires user to have 'admin' role.
Assumes require-authenticated has already run (should be earlier in chain).
Usage: {:path "/users" :methods {:post {:handler create-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-admin]}}}
Requires user to have 'admin' role.
Assumes require-authenticated has already run (should be earlier in chain).
Usage:
{:path "/users"
:methods {:post {:handler create-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-admin]}}}Requires an authenticated user on the request.
Checks for user in the normalized request shape. If not present, short-circuits with 401 Unauthorized response.
Usage: {:path "/users" :methods {:get {:handler list-users :interceptors ['user.http-interceptors/require-authenticated]}}}
Requires an authenticated user on the request.
Checks for user in the normalized request shape. If not present, short-circuits
with 401 Unauthorized response.
Usage:
{:path "/users"
:methods {:get {:handler list-users
:interceptors ['user.http-interceptors/require-authenticated]}}}Requires the current user to be a platform-level admin without tenant context.
Requires the current user to be a platform-level admin without tenant context.
(require-role required-role)Factory function to create role-checking interceptor.
Args: required-role: Role keyword or string to check (e.g., :admin or "admin")
Returns: Interceptor that checks for the required role
Usage: {:path "/manager-reports" :methods {:get {:handler manager-reports :interceptors ['user.http-interceptors/require-authenticated (user.http-interceptors/require-role "manager")]}}}
Factory function to create role-checking interceptor.
Args:
required-role: Role keyword or string to check (e.g., :admin or "admin")
Returns:
Interceptor that checks for the required role
Usage:
{:path "/manager-reports"
:methods {:get {:handler manager-reports
:interceptors ['user.http-interceptors/require-authenticated
(user.http-interceptors/require-role "manager")]}}}Requires user to be accessing their own resource OR be an admin.
Checks if :id path parameter matches session user ID, or if user is admin.
Usage: {:path "/users/:id" :methods {:put {:handler update-user :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-self-or-admin]}}}
Requires user to be accessing their own resource OR be an admin.
Checks if :id path parameter matches session user ID, or if user is admin.
Usage:
{:path "/users/:id"
:methods {:put {:handler update-user
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-self-or-admin]}}}Requires the current user to have the :admin role in the active tenant membership.
Shorthand for (require-tenant-role #{:admin}).
Usage: {:path "/api/tenants/:tenant-id/settings" :methods {:put {:handler update-settings :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-tenant-admin]}}}
Requires the current user to have the :admin role in the active tenant membership.
Shorthand for (require-tenant-role #{:admin}).
Usage:
{:path "/api/tenants/:tenant-id/settings"
:methods {:put {:handler update-settings
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-tenant-admin]}}}Requires an active tenant membership to be present on the request.
Reads :tenant-membership set by wrap-tenant-membership middleware. Short-circuits with 403 when no active membership is found.
Usage: {:path "/api/tenants/:tenant-id/documents" :methods {:get {:handler list-documents :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-tenant-member]}}}
Requires an active tenant membership to be present on the request.
Reads :tenant-membership set by wrap-tenant-membership middleware.
Short-circuits with 403 when no active membership is found.
Usage:
{:path "/api/tenants/:tenant-id/documents"
:methods {:get {:handler list-documents
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-tenant-member]}}}(require-tenant-role allowed-roles)Factory function: returns an interceptor that requires the given tenant role(s).
Reads :tenant-membership set by wrap-tenant-membership middleware. Short-circuits with 403 when the membership is absent or has insufficient role.
Args: allowed-roles - set of allowed role keywords, e.g. #{:admin}
Returns: Interceptor map.
Factory function: returns an interceptor that requires the given tenant role(s).
Reads :tenant-membership set by wrap-tenant-membership middleware.
Short-circuits with 403 when the membership is absent or has insufficient role.
Args:
allowed-roles - set of allowed role keywords, e.g. #{:admin}
Returns:
Interceptor map.Requires NO authenticated user in session.
Useful for routes like /register or /login where being logged in should redirect or prevent access.
Usage: {:path "/register" :methods {:get {:handler register-page :interceptors ['user.http-interceptors/require-unauthenticated]}}}
Requires NO authenticated user in session.
Useful for routes like /register or /login where being logged in
should redirect or prevent access.
Usage:
{:path "/register"
:methods {:get {:handler register-page
:interceptors ['user.http-interceptors/require-unauthenticated]}}}Requires the current user to have the :admin role in the active tenant membership.
Like require-tenant-admin, but web-aware: when the request URI starts with /web it redirects to /web/login (302) instead of returning a JSON 403. Use this on HTML routes so the browser lands on the login page rather than a bare error body.
Usage: {:path "/web/tenants/:tenant-id/settings" :methods {:get {:handler settings-page :interceptors ['user.http-interceptors/require-authenticated 'user.http-interceptors/require-web-tenant-admin]}}}
Requires the current user to have the :admin role in the active tenant membership.
Like require-tenant-admin, but web-aware: when the request URI starts with /web
it redirects to /web/login (302) instead of returning a JSON 403. Use this on
HTML routes so the browser lands on the login page rather than a bare error body.
Usage:
{:path "/web/tenants/:tenant-id/settings"
:methods {:get {:handler settings-page
:interceptors ['user.http-interceptors/require-authenticated
'user.http-interceptors/require-web-tenant-admin]}}}Standard interceptor stack for authenticated user endpoints.
Applies authentication and audit logging (no role check).
Usage: {:path "/users/:id" :methods {:get {:handler get-user :interceptors user.http-interceptors/user-endpoint-stack}}}
Standard interceptor stack for authenticated user endpoints.
Applies authentication and audit logging (no role check).
Usage:
{:path "/users/:id"
:methods {:get {:handler get-user
:interceptors user.http-interceptors/user-endpoint-stack}}}cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |