oauth2

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ContextKeySkipStatelessIntrospection is utilzed to communicate skipping StatelessJWTValidator which is useful for
	// the UserInfo endpoint.
	ContextKeySkipStatelessIntrospection = contextKey(0)
)

Functions

func AccessTokenJWTToRequest 

func AccessTokenJWTToRequest(token *jwt.Token) oauth2.Requester

AccessTokenJWTToRequest tries to reconstruct oauth2.Request from a JWT.

func SetSkipStatelessIntrospection added in v0.2.6 

func SetSkipStatelessIntrospection(ctx context.Context) context.Context

SetSkipStatelessIntrospection sets the ContextKeySkipStatelessIntrospection to true.

Types

type AccessTokenStorage 

type AccessTokenStorage interface {
	// CreateAccessTokenSession stores the request for a given access token signature.
	CreateAccessTokenSession(ctx context.Context, signature string, request oauth2.Requester) (err error)

	// GetAccessTokenSession hydrates the session based on the given access token signature and returns the request.
	// This method should return the oauth2.ErrNotFound error if no session exists for the given signature.
	GetAccessTokenSession(ctx context.Context, signature string, session oauth2.Session) (request oauth2.Requester, err error)

	// DeleteAccessTokenSession removes the session stored against the given access token signature.
	DeleteAccessTokenSession(ctx context.Context, signature string) (err error)
}

AccessTokenStorage handles storage requests related to access tokens.

type AccessTokenStrategy 

type AccessTokenStrategy interface {
	// IsOpaqueAccessToken returns true if the provided token is possibly an opaque Access Token.
	//
	// This function is only effective if the token provided has a deterministic characteristic such as a prefix.
	IsOpaqueAccessToken(ctx context.Context, token string) (is bool)

	// AccessTokenSignature returns the signature of the provided Access Token.
	AccessTokenSignature(ctx context.Context, token string) (signature string)

	// GenerateAccessToken generates a new Access Token.
	GenerateAccessToken(ctx context.Context, request oauth2.Requester) (token string, signature string, err error)

	// ValidateAccessToken validates the provided Access Token.
	ValidateAccessToken(ctx context.Context, request oauth2.Requester, token string) (err error)
}

type AuthorizeCodeStorage 

type AuthorizeCodeStorage interface {
	// CreateAuthorizeCodeSession stores the authorization request for a given authorization code.
	CreateAuthorizeCodeSession(ctx context.Context, code string, request oauth2.Requester) (err error)

	// GetAuthorizeCodeSession hydrates the session based on the given code and returns the authorization request.
	// If the authorization code has been invalidated with `InvalidateAuthorizeCodeSession`, this
	// method should return the ErrInvalidatedAuthorizeCode error.
	//
	// Make sure to also return the oauth2.Requester value when returning the oauth2.ErrInvalidatedAuthorizeCode error!
	GetAuthorizeCodeSession(ctx context.Context, code string, session oauth2.Session) (request oauth2.Requester, err error)

	// InvalidateAuthorizeCodeSession is called when an authorize code is being used. The state of the authorization
	// code should be set to invalid and consecutive requests to GetAuthorizeCodeSession should return the
	// ErrInvalidatedAuthorizeCode error.
	InvalidateAuthorizeCodeSession(ctx context.Context, code string) (err error)
}

AuthorizeCodeStorage handles storage requests related to authorization codes.

type AuthorizeCodeStrategy 

type AuthorizeCodeStrategy interface {
	// IsOpaqueAuthorizeCode returns true if the provided token is possibly an opaque Authorize Code.
	//
	// This function is only effective if the token provided has a deterministic characteristic such as a prefix.
	IsOpaqueAuthorizeCode(ctx context.Context, token string) bool

	// AuthorizeCodeSignature returns the signature of the provided Authorize Code.
	AuthorizeCodeSignature(ctx context.Context, token string) (signature string)

	// GenerateAuthorizeCode generates a new Authorize Code.
	GenerateAuthorizeCode(ctx context.Context, request oauth2.Requester) (token string, signature string, err error)

	// ValidateAuthorizeCode validates the provided Authorize Code.
	ValidateAuthorizeCode(ctx context.Context, request oauth2.Requester, token string) (err error)
}

type AuthorizeExplicitGrantHandler 

type AuthorizeExplicitGrantHandler struct {
	AccessTokenStrategy    AccessTokenStrategy
	RefreshTokenStrategy   RefreshTokenStrategy
	AuthorizeCodeStrategy  AuthorizeCodeStrategy
	CoreStorage            CoreStorage
	TokenRevocationStorage TokenRevocationStorage
	Config                 interface {
		oauth2.AuthorizeCodeLifespanProvider
		oauth2.AccessTokenLifespanProvider
		oauth2.RefreshTokenLifespanProvider
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
		oauth2.RedirectSecureCheckerProvider
		oauth2.RefreshTokenScopesProvider
		oauth2.OmitRedirectScopeParamProvider
		oauth2.SanitationAllowedProvider
	}
}

AuthorizeExplicitGrantHandler is a response handler for the Authorize Code grant using the explicit grant type as defined in https://datatracker.ietf.org/doc/html/rfc6749#section-4.1

func (*AuthorizeExplicitGrantHandler) CanHandleTokenEndpointRequest 

func (c *AuthorizeExplicitGrantHandler) CanHandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (handle bool)

func (*AuthorizeExplicitGrantHandler) CanSkipClientAuth 

func (c *AuthorizeExplicitGrantHandler) CanSkipClientAuth(ctx context.Context, request oauth2.AccessRequester) (skip bool)

func (*AuthorizeExplicitGrantHandler) GetRedirectSecureChecker added in v0.1.19 

func (c *AuthorizeExplicitGrantHandler) GetRedirectSecureChecker(ctx context.Context) (checker func(context.Context, *url.URL) (secure bool))

func (*AuthorizeExplicitGrantHandler) GetSanitationWhiteList 

func (c *AuthorizeExplicitGrantHandler) GetSanitationWhiteList(ctx context.Context) (whitelist []string)

func (*AuthorizeExplicitGrantHandler) HandleAuthorizeEndpointRequest 

func (c *AuthorizeExplicitGrantHandler) HandleAuthorizeEndpointRequest(ctx context.Context, request oauth2.AuthorizeRequester, response oauth2.AuthorizeResponder) (err error)

func (*AuthorizeExplicitGrantHandler) HandleTokenEndpointRequest 

func (c *AuthorizeExplicitGrantHandler) HandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (err error)

HandleTokenEndpointRequest implements * https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3 (everything)

func (*AuthorizeExplicitGrantHandler) IssueAuthorizeCode 

func (c *AuthorizeExplicitGrantHandler) IssueAuthorizeCode(ctx context.Context, request oauth2.AuthorizeRequester, response oauth2.AuthorizeResponder) (err error)

func (*AuthorizeExplicitGrantHandler) PopulateTokenEndpointResponse 

func (c *AuthorizeExplicitGrantHandler) PopulateTokenEndpointResponse(ctx context.Context, request oauth2.AccessRequester, response oauth2.AccessResponder) (err error)

PopulateTokenEndpointResponse implements oauth2.TokenEndpointHandler.

TODO: Refactor time permitting.

type AuthorizeImplicitGrantTypeHandler 

type AuthorizeImplicitGrantTypeHandler struct {
	AccessTokenStrategy AccessTokenStrategy
	// AccessTokenStorage is used to persist session data across requests.
	AccessTokenStorage AccessTokenStorage

	Config interface {
		oauth2.AccessTokenLifespanProvider
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
	}
}

AuthorizeImplicitGrantTypeHandler is a response handler for the Authorize Code grant using the implicit grant type as defined in https://datatracker.ietf.org/doc/html/rfc6749#section-4.2

func (*AuthorizeImplicitGrantTypeHandler) HandleAuthorizeEndpointRequest 

func (c *AuthorizeImplicitGrantTypeHandler) HandleAuthorizeEndpointRequest(ctx context.Context, request oauth2.AuthorizeRequester, response oauth2.AuthorizeResponder) (err error)

func (*AuthorizeImplicitGrantTypeHandler) IssueImplicitAccessToken 

func (c *AuthorizeImplicitGrantTypeHandler) IssueImplicitAccessToken(ctx context.Context, request oauth2.AuthorizeRequester, response oauth2.AuthorizeResponder) (err error)

type ClientCredentialsGrantHandler 

type ClientCredentialsGrantHandler struct {
	*HandleHelper
	Config interface {
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
		oauth2.AccessTokenLifespanProvider
		oauth2.ClientCredentialsImplicitProvider
	}
}

func (*ClientCredentialsGrantHandler) CanHandleTokenEndpointRequest 

func (c *ClientCredentialsGrantHandler) CanHandleTokenEndpointRequest(_ context.Context, request oauth2.AccessRequester) (handle bool)

func (*ClientCredentialsGrantHandler) CanSkipClientAuth 

func (c *ClientCredentialsGrantHandler) CanSkipClientAuth(_ context.Context, _ oauth2.AccessRequester) (skip bool)

func (*ClientCredentialsGrantHandler) HandleTokenEndpointRequest 

func (c *ClientCredentialsGrantHandler) HandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (err error)

HandleTokenEndpointRequest implements https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2

func (*ClientCredentialsGrantHandler) PopulateTokenEndpointResponse 

func (c *ClientCredentialsGrantHandler) PopulateTokenEndpointResponse(ctx context.Context, request oauth2.AccessRequester, response oauth2.AccessResponder) (err error)

PopulateTokenEndpointResponse implements https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.3

type ClientCredentialsGrantStorage 

type ClientCredentialsGrantStorage interface {
	AccessTokenStorage
}

type CodeTokenEndpointHandler 

type CodeTokenEndpointHandler interface {
	ValidateGrantTypes(ctx context.Context, request oauth2.AccessRequester) (err error)
	ValidateCodeAndSession(ctx context.Context, request oauth2.AccessRequester, authorizeRequest oauth2.Requester, code string) (err error)
	GetCodeAndSession(ctx context.Context, request oauth2.AccessRequester) (code string, signature string, r oauth2.Requester, err error)
	UpdateLastChecked(ctx context.Context, request oauth2.AccessRequester, authorizeRequest oauth2.Requester) (err error)
	InvalidateSession(ctx context.Context, signature string, request oauth2.Requester) error
	CanSkipClientAuth(ctx context.Context, request oauth2.AccessRequester) bool
	CanHandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) bool
	DeviceCodeSignature(ctx context.Context, code string) (signature string, err error)
}

type CoreStorage 

type CoreStorage interface {
	AuthorizeCodeStorage
	AccessTokenStorage
	RefreshTokenStorage
}

CoreStorage is the composite storage required by the core OAuth 2.0 grant handlers.

type CoreStrategy 

type CoreStrategy interface {
	AccessTokenStrategy
	RefreshTokenStrategy
	AuthorizeCodeStrategy
	DeviceCodeStrategy
	UserCodeStrategy
}

CoreStrategy performs the major elements of token generation and validation.

func NewCoreStrategy 

func NewCoreStrategy(config CoreStrategyConfigurator, prefix string, strategy jwt.Strategy) (core CoreStrategy)

NewCoreStrategy is a special constructor that if provided a signer will automatically decorate the HMACCoreStrategy with a JWTProfileCoreStrategy, otherwise it just returns the HMACCoreStrategy.

type CoreStrategyConfigurator 

type CoreStrategyConfigurator interface {
	HMACCoreStrategyConfigurator

	oauth2.AccessTokenIssuerProvider
	oauth2.JWTScopeFieldProvider
	oauth2.JWTProfileAccessTokensProvider
	oauth2.ConfirmationConfigProvider
}

type CoreValidator 

type CoreValidator struct {
	CoreStrategy
	CoreStorage
	Config CoreValidatorConfigProvider
}

func (*CoreValidator) IntrospectToken 

func (c *CoreValidator) IntrospectToken(ctx context.Context, token string, tokenUseHint oauth2.TokenUse, request oauth2.AccessRequester, scopes []string) (use oauth2.TokenUse, err error)

type CoreValidatorConfigProvider added in v0.3.0 

type CoreValidatorConfigProvider interface {
	oauth2.ScopeStrategyProvider
	oauth2.DisableRefreshTokenValidationProvider
}

type DeviceCodeStrategy 

type DeviceCodeStrategy interface {
	// IsOpaqueRFC8628DeviceCode returns true if the provided token is possibly an opaque RFC8628 Device Code.
	//
	// This function is only effective if the token provided has a deterministic characteristic such as a prefix.
	IsOpaqueRFC8628DeviceCode(ctx context.Context, token string) (is bool)

	// RFC8628DeviceCodeSignature returns the signature of the provided RFC8628 Device Code.
	RFC8628DeviceCodeSignature(ctx context.Context, code string) (signature string, err error)

	// GenerateRFC8628DeviceCode generates a new RFC8628 Device Code.
	GenerateRFC8628DeviceCode(ctx context.Context) (code string, signature string, err error)

	// ValidateRFC8628DeviceCode validates the provided RFC8628 Device Code.
	ValidateRFC8628DeviceCode(ctx context.Context, r oauth2.Requester, code string) (err error)
}

type GenericCodeTokenEndpointHandler 

type GenericCodeTokenEndpointHandler struct {
	CodeTokenEndpointHandler

	AccessTokenStrategy    AccessTokenStrategy
	RefreshTokenStrategy   RefreshTokenStrategy
	CoreStorage            CoreStorage
	TokenRevocationStorage TokenRevocationStorage
	Config                 interface {
		oauth2.AccessTokenLifespanProvider
		oauth2.RefreshTokenLifespanProvider
		oauth2.RefreshTokenScopesProvider
	}
}

func (*GenericCodeTokenEndpointHandler) CanHandleTokenEndpointRequest 

func (c *GenericCodeTokenEndpointHandler) CanHandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (handle bool)

func (*GenericCodeTokenEndpointHandler) CanSkipClientAuth 

func (c *GenericCodeTokenEndpointHandler) CanSkipClientAuth(ctx context.Context, request oauth2.AccessRequester) (skip bool)

func (*GenericCodeTokenEndpointHandler) HandleTokenEndpointRequest 

func (c *GenericCodeTokenEndpointHandler) HandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (err error)

HandleTokenEndpointRequest handles verifying the access request.

func (*GenericCodeTokenEndpointHandler) PopulateTokenEndpointResponse 

func (c *GenericCodeTokenEndpointHandler) PopulateTokenEndpointResponse(ctx context.Context, request oauth2.AccessRequester, response oauth2.AccessResponder) (err error)

PopulateTokenEndpointResponse handles populating the access response.

type HMACCoreStrategy 

type HMACCoreStrategy struct {
	Enigma *hmac.HMACStrategy

	Config interface {
		oauth2.AccessTokenLifespanProvider
		oauth2.RefreshTokenLifespanProvider
		oauth2.AuthorizeCodeLifespanProvider
		oauth2.RFC8628DeviceAuthorizeConfigProvider
	}
	// contains filtered or unexported fields
}

HMACCoreStrategy implements the OAuth 2.0 and RFC 7591/7592 opaque token strategies backed by HMAC-signed tokens.

Construct it with NewHMACCoreStrategy, not a struct literal: NewHMACCoreStrategy is the only place that initialises enigmaClientRegistration, the unexported strategy client registration tokens are signed and verified with on their own secret, and a struct literal leaves it nil.

func NewHMACCoreStrategy 

func NewHMACCoreStrategy(config HMACCoreStrategyConfigurator, prefix string) (strategy *HMACCoreStrategy)

NewHMACCoreStrategy creates a new HMACCoreStrategy with the potential to include the prefix format. The prefix must include a single '%s' for the purpose of adding the token part (ac, dc, at, rt, and cr; for the Authorize Code, Device Code, Access Token, Refresh Token, and Client Registration Token; respectively).

This is the required way to construct a HMACCoreStrategy, not merely a convenience: it is the only place that initialises the unexported strategy client registration tokens are signed and verified with, kept on its own secret so that rotating the global secret never invalidates a client management token, which cannot be re-issued. A struct literal compiles - the other collaborators, Enigma and Config, are exported - but leaves that strategy nil, and GenerateClientRegistrationToken/ValidateClientRegistrationToken then return an error naming this constructor rather than panicking or silently falling back to Enigma's global secret.

func (*HMACCoreStrategy) AccessTokenSignature 

func (s *HMACCoreStrategy) AccessTokenSignature(ctx context.Context, tokenString string) (signature string)

AccessTokenSignature implements oauth2.AccessTokenStrategy.

func (*HMACCoreStrategy) AuthorizeCodeSignature 

func (s *HMACCoreStrategy) AuthorizeCodeSignature(ctx context.Context, tokenString string) (signature string)

AuthorizeCodeSignature implements oauth2.AuthorizeCodeStrategy.

func (*HMACCoreStrategy) ClientRegistrationTokenSignature added in v0.3.0 

func (s *HMACCoreStrategy) ClientRegistrationTokenSignature(ctx context.Context, tokenString string) (signature string)

ClientRegistrationTokenSignature returns the signature of an RFC 7591 / RFC 7592 client registration token, or an empty string when the token is not one. An empty signature can never be a legitimate storage key, so a caller may reject on it without a storage round trip.

A nil enigmaClientRegistration - this HMACCoreStrategy was assembled with a struct literal instead of NewHMACCoreStrategy - is one such case, and is answered here rather than one layer down: no client registration token can have been minted without that strategy, so no signature it computed could resolve to anything, and the same condition already turns GenerateClientRegistrationToken and ValidateClientRegistrationToken into a diagnosable error.

func (*HMACCoreStrategy) GenerateAccessToken 

func (s *HMACCoreStrategy) GenerateAccessToken(ctx context.Context, _ oauth2.Requester) (tokenString string, signature string, err error)

GenerateAccessToken implements oauth2.AccessTokenStrategy.

func (*HMACCoreStrategy) GenerateAuthorizeCode 

func (s *HMACCoreStrategy) GenerateAuthorizeCode(ctx context.Context, _ oauth2.Requester) (tokenString string, signature string, err error)

GenerateAuthorizeCode implements oauth2.AuthorizeCodeStrategy.

func (*HMACCoreStrategy) GenerateClientRegistrationToken added in v0.3.0 

func (s *HMACCoreStrategy) GenerateClientRegistrationToken(ctx context.Context, _ oauth2.Requester) (tokenString string, signature string, err error)

GenerateClientRegistrationToken mints an RFC 7591 / RFC 7592 client registration token.

func (*HMACCoreStrategy) GenerateRFC8628DeviceCode 

func (s *HMACCoreStrategy) GenerateRFC8628DeviceCode(ctx context.Context) (tokenString string, signature string, err error)

GenerateRFC8628DeviceCode implements rfc8628.DeviceCodeStrategy.

func (*HMACCoreStrategy) GenerateRFC8628UserCode 

func (s *HMACCoreStrategy) GenerateRFC8628UserCode(ctx context.Context) (tokenString string, signature string, err error)

GenerateRFC8628UserCode implements rfc8628.UserCodeStrategy.

func (*HMACCoreStrategy) GenerateRefreshToken 

func (s *HMACCoreStrategy) GenerateRefreshToken(ctx context.Context, _ oauth2.Requester) (tokenString string, signature string, err error)

GenerateRefreshToken implements oauth2.RefreshTokenStrategy.

func (*HMACCoreStrategy) IsOpaqueAccessToken added in v0.2.6 

func (s *HMACCoreStrategy) IsOpaqueAccessToken(ctx context.Context, tokenString string) bool

IsOpaqueAccessToken implements oauth2.AccessTokenStrategy.

func (*HMACCoreStrategy) IsOpaqueAuthorizeCode added in v0.2.6 

func (s *HMACCoreStrategy) IsOpaqueAuthorizeCode(ctx context.Context, tokenString string) bool

IsOpaqueAuthorizeCode implements oauth2.AuthorizeCodeStrategy.

func (*HMACCoreStrategy) IsOpaqueClientRegistrationToken added in v0.3.0 

func (s *HMACCoreStrategy) IsOpaqueClientRegistrationToken(ctx context.Context, tokenString string) bool

IsOpaqueClientRegistrationToken returns true when the token carries this strategy's client registration token prefix. Client registration tokens are always opaque, so unlike access tokens there is no JWT alternative.

func (*HMACCoreStrategy) IsOpaqueRFC8628DeviceCode added in v0.2.6 

func (s *HMACCoreStrategy) IsOpaqueRFC8628DeviceCode(ctx context.Context, tokenString string) bool

IsOpaqueRFC8628DeviceCode implements rfc8628.DeviceCodeStrategy.

func (*HMACCoreStrategy) IsOpaqueRefreshToken added in v0.2.6 

func (s *HMACCoreStrategy) IsOpaqueRefreshToken(ctx context.Context, tokenString string) bool

IsOpaqueRefreshToken implements oauth2.RefreshTokenStrategy.

func (*HMACCoreStrategy) RFC8628DeviceCodeSignature 

func (s *HMACCoreStrategy) RFC8628DeviceCodeSignature(ctx context.Context, tokenString string) (signature string, err error)

RFC8628DeviceCodeSignature implements rfc8628.DeviceCodeStrategy.

func (*HMACCoreStrategy) RFC8628UserCodeSignature 

func (s *HMACCoreStrategy) RFC8628UserCodeSignature(ctx context.Context, tokenString string) (signature string, err error)

func (*HMACCoreStrategy) RefreshTokenSignature 

func (s *HMACCoreStrategy) RefreshTokenSignature(ctx context.Context, tokenString string) (signature string)

RefreshTokenSignature implements oauth2.RefreshTokenStrategy.

func (*HMACCoreStrategy) ValidateAccessToken 

func (s *HMACCoreStrategy) ValidateAccessToken(ctx context.Context, r oauth2.Requester, tokenString string) (err error)

ValidateAccessToken implements oauth2.AccessTokenStrategy.

func (*HMACCoreStrategy) ValidateAuthorizeCode 

func (s *HMACCoreStrategy) ValidateAuthorizeCode(ctx context.Context, r oauth2.Requester, tokenString string) (err error)

ValidateAuthorizeCode implements oauth2.AuthorizeCodeStrategy.

func (*HMACCoreStrategy) ValidateClientRegistrationToken added in v0.3.0 

func (s *HMACCoreStrategy) ValidateClientRegistrationToken(ctx context.Context, r oauth2.Requester, tokenString string) (err error)

ValidateClientRegistrationToken validates an RFC 7591 / RFC 7592 client registration token against its session.

Unlike ValidateAccessToken there is no fallback to the configured access token lifespan when the session carries no expiry. newClientRegistrationToken always records one - substituting NonExpiringTokenLifespan for a lifespan of zero rather than leaving it unset - so a session reaching here without an expiry is malformed, and treating that as "never expires" is exactly the silent failure that fallback caused for these tokens before.

func (*HMACCoreStrategy) ValidateRFC8628DeviceCode 

func (s *HMACCoreStrategy) ValidateRFC8628DeviceCode(ctx context.Context, r oauth2.Requester, code string) (err error)

ValidateRFC8628DeviceCode implements rfc8628.DeviceCodeStrategy.

func (*HMACCoreStrategy) ValidateRFC8628UserCode 

func (s *HMACCoreStrategy) ValidateRFC8628UserCode(ctx context.Context, r oauth2.Requester, code string) (err error)

ValidateRFC8628UserCode implements rfc8628.UserCodeStrategy.

func (*HMACCoreStrategy) ValidateRefreshToken 

func (s *HMACCoreStrategy) ValidateRefreshToken(ctx context.Context, r oauth2.Requester, tokenString string) (err error)

ValidateRefreshToken implements oauth2.RefreshTokenStrategy.

type HMACCoreStrategyConfigurator 

type HMACCoreStrategyConfigurator interface {
	oauth2.AccessTokenLifespanProvider
	oauth2.RefreshTokenLifespanProvider
	oauth2.AuthorizeCodeLifespanProvider
	oauth2.TokenEntropyProvider
	oauth2.GlobalSecretProvider
	oauth2.RotatedGlobalSecretsProvider
	oauth2.HMACHashingProvider
	oauth2.RFC8628DeviceAuthorizeConfigProvider
	oauth2.RFC7591ClientRegistrationTokenSecretProvider
}

type HandleHelper 

type HandleHelper struct {
	AccessTokenStrategy AccessTokenStrategy
	AccessTokenStorage  AccessTokenStorage
	Config              HandleHelperConfigProvider
}

func (*HandleHelper) IssueAccessToken 

func (h *HandleHelper) IssueAccessToken(ctx context.Context, defaultLifespan time.Duration, request oauth2.AccessRequester, response oauth2.AccessResponder) (signature string, err error)

IssueAccessToken generates an access token, persists its session, and populates the response. It returns the signature of the issued access token so callers can associate a refresh token with it.

type HandleHelperConfigProvider 

type HandleHelperConfigProvider interface {
	oauth2.AccessTokenLifespanProvider
	oauth2.RefreshTokenLifespanProvider
}

type JWTProfileCoreStrategy 

type JWTProfileCoreStrategy struct {
	jwt.Strategy

	HMACCoreStrategy *HMACCoreStrategy
	Config           interface {
		oauth2.AccessTokenIssuerProvider
		oauth2.JWTScopeFieldProvider
		oauth2.JWTProfileAccessTokensProvider
		oauth2.ConfirmationConfigProvider
	}
}

JWTProfileCoreStrategy is a JWT RS256 strategy.

func (*JWTProfileCoreStrategy) AccessTokenSignature 

func (s *JWTProfileCoreStrategy) AccessTokenSignature(ctx context.Context, tokenString string) (signature string)

func (*JWTProfileCoreStrategy) AuthorizeCodeSignature 

func (s *JWTProfileCoreStrategy) AuthorizeCodeSignature(ctx context.Context, tokenString string) string

func (*JWTProfileCoreStrategy) ClientRegistrationTokenSignature added in v0.3.0 

func (s *JWTProfileCoreStrategy) ClientRegistrationTokenSignature(ctx context.Context, tokenString string) (signature string)

func (*JWTProfileCoreStrategy) GenerateAccessToken 

func (s *JWTProfileCoreStrategy) GenerateAccessToken(ctx context.Context, request oauth2.Requester) (token string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateAuthorizeCode 

func (s *JWTProfileCoreStrategy) GenerateAuthorizeCode(ctx context.Context, request oauth2.Requester) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateClientRegistrationToken added in v0.3.0 

func (s *JWTProfileCoreStrategy) GenerateClientRegistrationToken(ctx context.Context, requester oauth2.Requester) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateJWT 

func (s *JWTProfileCoreStrategy) GenerateJWT(ctx context.Context, tokenType oauth2.TokenType, request oauth2.Requester, client oauth2.JWTProfileClient) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateRFC8628DeviceCode 

func (s *JWTProfileCoreStrategy) GenerateRFC8628DeviceCode(ctx context.Context) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateRFC8628UserCode 

func (s *JWTProfileCoreStrategy) GenerateRFC8628UserCode(ctx context.Context) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) GenerateRefreshToken 

func (s *JWTProfileCoreStrategy) GenerateRefreshToken(ctx context.Context, request oauth2.Requester) (tokenString string, signature string, err error)

func (*JWTProfileCoreStrategy) IsOpaqueAccessToken added in v0.2.6 

func (s *JWTProfileCoreStrategy) IsOpaqueAccessToken(ctx context.Context, tokenString string) bool

func (*JWTProfileCoreStrategy) IsOpaqueAuthorizeCode added in v0.2.6 

func (s *JWTProfileCoreStrategy) IsOpaqueAuthorizeCode(ctx context.Context, tokenString string) bool

func (*JWTProfileCoreStrategy) IsOpaqueClientRegistrationToken added in v0.3.0 

func (s *JWTProfileCoreStrategy) IsOpaqueClientRegistrationToken(ctx context.Context, tokenString string) bool

IsOpaqueClientRegistrationToken implements the client registration token strategy by delegation. Client registration tokens are always opaque and never follow the JWT profile, so every method here defers to the HMAC strategy unconditionally rather than branching on GetEnforceJWTProfileAccessTokens the way the access token methods do.

func (*JWTProfileCoreStrategy) IsOpaqueRFC8628DeviceCode added in v0.2.6 

func (s *JWTProfileCoreStrategy) IsOpaqueRFC8628DeviceCode(ctx context.Context, tokenString string) bool

func (*JWTProfileCoreStrategy) IsOpaqueRefreshToken added in v0.2.6 

func (s *JWTProfileCoreStrategy) IsOpaqueRefreshToken(ctx context.Context, tokenString string) bool

func (*JWTProfileCoreStrategy) IsPossiblyJWTProfileAccessToken 

func (s *JWTProfileCoreStrategy) IsPossiblyJWTProfileAccessToken(ctx context.Context, tokenString string) (jwt bool, signature string)

func (*JWTProfileCoreStrategy) RFC8628DeviceCodeSignature 

func (s *JWTProfileCoreStrategy) RFC8628DeviceCodeSignature(ctx context.Context, tokenString string) (signature string, err error)

func (*JWTProfileCoreStrategy) RFC8628UserCodeSignature 

func (s *JWTProfileCoreStrategy) RFC8628UserCodeSignature(ctx context.Context, tokenString string) (signature string, err error)

func (*JWTProfileCoreStrategy) RefreshTokenSignature 

func (s *JWTProfileCoreStrategy) RefreshTokenSignature(ctx context.Context, tokenString string) string

func (*JWTProfileCoreStrategy) ValidateAccessToken 

func (s *JWTProfileCoreStrategy) ValidateAccessToken(ctx context.Context, request oauth2.Requester, tokenString string) (err error)

func (*JWTProfileCoreStrategy) ValidateAuthorizeCode 

func (s *JWTProfileCoreStrategy) ValidateAuthorizeCode(ctx context.Context, request oauth2.Requester, tokenString string) error

func (*JWTProfileCoreStrategy) ValidateClientRegistrationToken added in v0.3.0 

func (s *JWTProfileCoreStrategy) ValidateClientRegistrationToken(ctx context.Context, r oauth2.Requester, tokenString string) (err error)

func (*JWTProfileCoreStrategy) ValidateRFC8628DeviceCode 

func (s *JWTProfileCoreStrategy) ValidateRFC8628DeviceCode(ctx context.Context, request oauth2.Requester, tokenString string) (err error)

func (*JWTProfileCoreStrategy) ValidateRFC8628UserCode 

func (s *JWTProfileCoreStrategy) ValidateRFC8628UserCode(ctx context.Context, request oauth2.Requester, tokenString string) (err error)

func (*JWTProfileCoreStrategy) ValidateRefreshToken 

func (s *JWTProfileCoreStrategy) ValidateRefreshToken(ctx context.Context, request oauth2.Requester, tokenString string) (err error)

type JWTSession 

type JWTSession struct {
	JWTClaims                   *jwt.JWTClaims
	JWTHeader                   *jwt.Headers
	ExpiresAt                   map[oauth2.TokenType]time.Time
	Username                    string
	Subject                     string
	JWKThumbprint               string
	ClientCertificateThumbprint string
}

JWTSession Container for the JWT session.

func (*JWTSession) Clone 

func (j *JWTSession) Clone() oauth2.Session

func (*JWTSession) GetClientCertificateSHA256Thumbprint added in v0.3.0 

func (j *JWTSession) GetClientCertificateSHA256Thumbprint() string

func (*JWTSession) GetDPoPJWKThumbprint added in v0.2.37 

func (j *JWTSession) GetDPoPJWKThumbprint() string

func (*JWTSession) GetExpiresAt 

func (j *JWTSession) GetExpiresAt(key oauth2.TokenType) time.Time

func (*JWTSession) GetExtraClaims 

func (j *JWTSession) GetExtraClaims() map[string]any

GetExtraClaims implements ExtraClaimsSession for JWTSession. The returned value is a copy of JWTSession claims.

func (*JWTSession) GetJWTClaims 

func (j *JWTSession) GetJWTClaims() jwt.JWTClaimsContainer

func (*JWTSession) GetJWTHeader 

func (j *JWTSession) GetJWTHeader() *jwt.Headers

func (*JWTSession) GetSubject 

func (j *JWTSession) GetSubject() string

func (*JWTSession) GetUsername 

func (j *JWTSession) GetUsername() string

func (*JWTSession) SetClientCertificateSHA256Thumbprint added in v0.3.0 

func (j *JWTSession) SetClientCertificateSHA256Thumbprint(x5t string)

func (*JWTSession) SetDPoPJWKThumbprint added in v0.2.37 

func (j *JWTSession) SetDPoPJWKThumbprint(jkt string)

func (*JWTSession) SetExpiresAt 

func (j *JWTSession) SetExpiresAt(key oauth2.TokenType, exp time.Time)

func (*JWTSession) SetSubject 

func (j *JWTSession) SetSubject(subject string)

type JWTSessionContainer 

type JWTSessionContainer interface {
	// GetJWTClaims returns the claims.
	GetJWTClaims() jwt.JWTClaimsContainer

	// GetJWTHeader returns the header.
	GetJWTHeader() *jwt.Headers

	oauth2.Session
}

type NoneResponseTypeHandler 

type NoneResponseTypeHandler struct {
	Config interface {
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
		oauth2.RedirectSecureCheckerProvider
		oauth2.OmitRedirectScopeParamProvider
	}
}

NoneResponseTypeHandler is a response handler for when the None response type is requested as defined in https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#none

func (*NoneResponseTypeHandler) GetRedirectSecureChecker 

func (c *NoneResponseTypeHandler) GetRedirectSecureChecker(ctx context.Context) func(context.Context, *url.URL) (secure bool)

func (*NoneResponseTypeHandler) HandleAuthorizeEndpointRequest 

func (c *NoneResponseTypeHandler) HandleAuthorizeEndpointRequest(ctx context.Context, request oauth2.AuthorizeRequester, response oauth2.AuthorizeResponder) (err error)

type RefreshTokenGrantHandler 

type RefreshTokenGrantHandler struct {
	AccessTokenStrategy    AccessTokenStrategy
	RefreshTokenStrategy   RefreshTokenStrategy
	TokenRevocationStorage TokenRevocationStorage
	Config                 interface {
		oauth2.AccessTokenLifespanProvider
		oauth2.RefreshTokenLifespanProvider
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
		oauth2.RefreshTokenScopesProvider
	}
}

RefreshTokenGrantHandler handles access requests for the Refresh Token Flow.

func (*RefreshTokenGrantHandler) CanHandleTokenEndpointRequest 

func (c *RefreshTokenGrantHandler) CanHandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) bool

func (*RefreshTokenGrantHandler) CanSkipClientAuth 

func (c *RefreshTokenGrantHandler) CanSkipClientAuth(ctx context.Context, request oauth2.AccessRequester) bool

func (*RefreshTokenGrantHandler) HandleTokenEndpointRequest 

func (c *RefreshTokenGrantHandler) HandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (err error)

HandleTokenEndpointRequest implements https://datatracker.ietf.org/doc/html/rfc6749#section-6

TODO: Refactor time permitting.

func (*RefreshTokenGrantHandler) PopulateTokenEndpointResponse 

func (c *RefreshTokenGrantHandler) PopulateTokenEndpointResponse(ctx context.Context, request oauth2.AccessRequester, response oauth2.AccessResponder) (err error)

PopulateTokenEndpointResponse implements https://datatracker.ietf.org/doc/html/rfc6749#section-6

type RefreshTokenStorage 

type RefreshTokenStorage interface {
	// CreateRefreshTokenSession stores the request for a given refresh token signature. The accessSignature is the
	// signature of the access token issued alongside this refresh token and allows the store to keep track of the
	// refresh/access token pair so both can be revoked together during rotation. It may be empty when no access token
	// was issued in the same operation.
	CreateRefreshTokenSession(ctx context.Context, signature string, accessSignature string, request oauth2.Requester) (err error)

	// GetRefreshTokenSession hydrates the session based on the given refresh token signature and returns the request.
	// This method should return the oauth2.ErrNotFound error if no session exists for the given signature, and the
	// oauth2.ErrInactiveToken error if the session exists but the refresh token has been deactivated by
	// RotateRefreshToken or revoked.
	//
	// Make sure to also return the oauth2.Requester value when returning the oauth2.ErrInactiveToken error! The refresh
	// token grant handler uses it to revoke every token derived from the same authorization grant when it detects that
	// a refresh token has been reused.
	GetRefreshTokenSession(ctx context.Context, signature string, session oauth2.Session) (request oauth2.Requester, err error)

	// DeleteRefreshTokenSession removes the session stored against the given refresh token signature.
	DeleteRefreshTokenSession(ctx context.Context, signature string) (err error)

	// RotateRefreshToken deactivates the refresh token with the given signature and revokes the access tokens
	// associated with the given request ID. Consecutive requests to GetRefreshTokenSession for that signature should
	// return the oauth2.ErrInactiveToken error.
	//
	// Implementations that support a refresh token grace period should instead mark the refresh token as expiring
	// after the grace period rather than deactivating it immediately, so that concurrent requests made by the same
	// client within that window continue to succeed.
	RotateRefreshToken(ctx context.Context, requestID string, signature string) (err error)
}

RefreshTokenStorage handles storage requests related to refresh tokens.

type RefreshTokenStrategy 

type RefreshTokenStrategy interface {
	// IsOpaqueRefreshToken returns true if the provided token is possibly an opaque Refresh Token.
	//
	// This function is only effective if the token provided has a deterministic characteristic such as a prefix.
	IsOpaqueRefreshToken(ctx context.Context, token string) (is bool)

	// RefreshTokenSignature returns the signature of the provided Refresh Token.
	RefreshTokenSignature(ctx context.Context, token string) (signature string)

	// GenerateRefreshToken generates a new Refresh Token.
	GenerateRefreshToken(ctx context.Context, request oauth2.Requester) (token string, signature string, err error)

	// ValidateRefreshToken validates the provided Refresh Token.
	ValidateRefreshToken(ctx context.Context, request oauth2.Requester, token string) (err error)
}

type ResourceOwnerPasswordCredentialsGrantHandler deprecated 

type ResourceOwnerPasswordCredentialsGrantHandler struct {
	*HandleHelper
	// ResourceOwnerPasswordCredentialsGrantStorage is used to persist session data across requests.
	ResourceOwnerPasswordCredentialsGrantStorage ResourceOwnerPasswordCredentialsGrantStorage
	RefreshTokenStrategy                         RefreshTokenStrategy
	Config                                       interface {
		oauth2.ScopeStrategyProvider
		oauth2.AudienceStrategyProvider
		oauth2.ResourceStrategyProvider
		oauth2.RefreshTokenScopesProvider
		oauth2.RefreshTokenLifespanProvider
		oauth2.AccessTokenLifespanProvider
	}
}

Deprecated: This handler is deprecated as a means to communicate that the ROPC grant type is widely discouraged and is at the time of this writing going to be omitted in the OAuth 2.1 spec. For more information on why this grant type is discouraged see: https://www.scottbrady91.com/oauth/why-the-resource-owner-password-credentials-grant-type-is-not-authentication-nor-suitable-for-modern-applications

func (*ResourceOwnerPasswordCredentialsGrantHandler) CanHandleTokenEndpointRequest 

func (c *ResourceOwnerPasswordCredentialsGrantHandler) CanHandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (handle bool)

func (*ResourceOwnerPasswordCredentialsGrantHandler) CanSkipClientAuth 

func (c *ResourceOwnerPasswordCredentialsGrantHandler) CanSkipClientAuth(ctx context.Context, _ oauth2.AccessRequester) (skip bool)

func (*ResourceOwnerPasswordCredentialsGrantHandler) HandleTokenEndpointRequest 

func (c *ResourceOwnerPasswordCredentialsGrantHandler) HandleTokenEndpointRequest(ctx context.Context, request oauth2.AccessRequester) (err error)

HandleTokenEndpointRequest implements https://datatracker.ietf.org/doc/html/rfc6749#section-4.3.2

func (*ResourceOwnerPasswordCredentialsGrantHandler) PopulateTokenEndpointResponse 

func (c *ResourceOwnerPasswordCredentialsGrantHandler) PopulateTokenEndpointResponse(ctx context.Context, request oauth2.AccessRequester, response oauth2.AccessResponder) (err error)

PopulateTokenEndpointResponse implements https://datatracker.ietf.org/doc/html/rfc6749#section-4.3.3

type ResourceOwnerPasswordCredentialsGrantStorage 

type ResourceOwnerPasswordCredentialsGrantStorage interface {
	AccessTokenStorage
	RefreshTokenStorage

	Authenticate(ctx context.Context, name string, secret string) (subject string, err error)
}

type ResourceOwnerSession added in v0.2.37 

type ResourceOwnerSession interface {
	SetSubject(subject string)
}

type RevocationTokenLookupFunc 

type RevocationTokenLookupFunc func(ctx context.Context, token string) (request oauth2.Requester, tokenType oauth2.TokenType, err error)

type StatelessJWTStrategy added in v0.2.6 

type StatelessJWTStrategy interface {
	jwt.Strategy
	AccessTokenStrategy
	RefreshTokenStrategy
}

type StatelessJWTValidator 

type StatelessJWTValidator struct {
	StatelessJWTStrategy
	Config interface {
		oauth2.ScopeStrategyProvider
	}
}

func (*StatelessJWTValidator) IntrospectToken 

func (v *StatelessJWTValidator) IntrospectToken(ctx context.Context, tokenString string, tokenUse oauth2.TokenUse, request oauth2.AccessRequester, scopes []string) (use oauth2.TokenUse, err error)

type TokenRevocationHandler 

type TokenRevocationHandler struct {
	TokenRevocationStorage TokenRevocationStorage
	RefreshTokenStrategy   RefreshTokenStrategy
	AccessTokenStrategy    AccessTokenStrategy
	Config                 interface {
		oauth2.RevokeRefreshTokensExplicitlyProvider
	}
}

func (*TokenRevocationHandler) RevokeToken 

func (r *TokenRevocationHandler) RevokeToken(ctx context.Context, token string, tokenType oauth2.TokenType, client oauth2.Client) (err error)

RevokeToken implements https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 The token type hint indicates which token type check should be performed first.

type TokenRevocationStorage 

type TokenRevocationStorage interface {
	RefreshTokenStorage
	AccessTokenStorage

	// RevokeRefreshToken revokes a refresh token as specified in:
	// https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
	// If the particular
	// token is a refresh token and the authorization server supports the
	// revocation of access tokens, then the authorization server SHOULD
	// also invalidate all access tokens based on the same authorization
	// grant (see Implementation Note).
	RevokeRefreshToken(ctx context.Context, requestID string) error

	// RevokeAccessToken revokes an access token as specified in:
	// https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
	// If the token passed to the request
	// is an access token, the server MAY revoke the respective refresh
	// token as well.
	RevokeAccessToken(ctx context.Context, requestID string) error
}

TokenRevocationStorage provides the storage implementation as specified in: https://datatracker.ietf.org/doc/html/rfc7009

type UserCodeStrategy 

type UserCodeStrategy interface {
	// RFC8628UserCodeSignature returns the signature of the provided RFC8628 User Code.
	RFC8628UserCodeSignature(ctx context.Context, code string) (signature string, err error)

	// GenerateRFC8628UserCode generates a new RFC8628 User Code.
	GenerateRFC8628UserCode(ctx context.Context) (code string, signature string, err error)

	// ValidateRFC8628UserCode validates the provided RFC8628 User Code.
	ValidateRFC8628UserCode(ctx context.Context, r oauth2.Requester, code string) (err error)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.