gocached: support namespaces (#34)

Remove the special-case concept of "global writes" and instead allow
callers to provide a namespace mapping function that makes policy
decisions about which clients are globally trusted and which clients
should be isolated from each other. As a result, all clients are now
able to write, but not necessarily into the shared global namespace. All
clients can still read from the global namespace, as well as their own.
The Namespaces table already existed in the schema, but we drop the
lowercase constraint.

However, there are some breaking changes in the package API, WithJWTAuth
now takes issuer URLs only and policy moves into the new
WithNamespaceMapping option. cmd/gocached implements the spirit of the
old API in terms of a namespace mapping function, with the main
difference that it now allows writes if you don't have the global
claims, but just into your own isolated namespace.

Updates tailscale/corp#38092

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>

Author: tomhjp

cmd/gocached/gocached.go

@@ -9,7 +9,6 @@ import (
 	"flag"
 	"fmt"
 	"log"
-	"maps"
 	"net"
 	"net/http"
 	"os"
@@ -77,15 +76,27 @@ func main() {
 			log.Fatal("must specify --jwt-claim at least once when --jwt-issuer is set")
 		}
 
-		globalClaims := map[string]string{}
-		maps.Copy(globalClaims, jwtClaims)
-		maps.Copy(globalClaims, globalJWTClaims)
-
-		opts = append(opts, gocached.WithJWTAuth(gocached.JWTIssuerConfig{
-			Issuer:            *jwtIssuer,
-			RequiredClaims:    jwtClaims,
-			GlobalWriteClaims: globalClaims,
-		}))
+		opts = append(opts,
+			gocached.WithJWTAuth(*jwtIssuer),
+			gocached.WithNamespaceMapping(func(claims map[string]any) (gocached.Namespace, error) {
+				var ns gocached.Namespace
+				for k, want := range jwtClaims {
+					if got := claims[k]; got != want {
+						return "", fmt.Errorf("claim %q = %v, want %v", k, got, want)
+					}
+					if ns != "" {
+						ns += ","
+					}
+					ns += gocached.Namespace(fmt.Sprintf("%s=%s", k, want))
+				}
+				for k, want := range globalJWTClaims {
+					if got := claims[k]; got != want {
+						return ns, nil
+					}
+				}
+				return gocached.GlobalNamespace, nil
+			}),
+		)
 	}
 
 	srv, err := gocached.NewServer(opts...)