main.go

func (srv *tokenServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	username, password, ok := r.BasicAuth()
	if !ok {
		http.Error(w, "auth credentials not found", http.StatusUnauthorized)
		return
	}
	// compare username and password against your datasets
	// our example only allows foo:bar
	if username != "foo" || password != "bar" {
		http.Error(w, "invalid auth credentials", http.StatusUnauthorized)
		return
	}
	// do authorization check
	opt := srv.createTokenOption(r)
	actions := srv.authorize(opt)
	tk, err := srv.createToken(opt, actions)
	if err != nil {
		http.Error(w, "server error", http.StatusInternalServerError)
		return
	}
	srv.ok(w, tk)
}

func (srv *tokenServer) authorize(opt *Option) []string {
	// do proper comparison to check for user's access
	// against the requested actions
	if opt.account == "foo" {
		return []string{"pull", "push"}
	}
	if opt.account == "bar" {
		return []string{"pull"}
	}
	// unauthorized, no permission is granted
	return []string{}
}

func (srv *tokenServer) run() error {
	addr := fmt.Sprintf(":%s", os.Getenv("PORT"))
	http.Handle("/auth", srv)
	return http.ListenAndServeTLS(addr, srv.crt, srv.key, nil)
}