client

Documentation

Overview

Package client defines the OAuth client model and the Registry that resolves client metadata.

Index

• Constants
• Variables
• type AccessTokenType
• type Client
  • func (c *Client) AuthMethodAllowed(method string) bool
  • func (c *Client) GrantTypeAllowed(grantType string) bool
• type MFAPolicy
• type MemoryRegistry
  • func NewMemoryRegistry(clients ...*Client) *MemoryRegistry
  • func (r *MemoryRegistry) Add(c *Client)
  • func (r *MemoryRegistry) GetClient(_ context.Context, clientID string) (*Client, error)
• type Registry
• type ResponseMode
• type TokenEndpointAuthMethod

Constants

const AuthMethodPassword = "password"

AuthMethodPassword is the method name for internal username/password login.

const GrantTypePassword = "password"

GrantTypePassword is the RFC 6749 grant_type value for the password grant.

Variables

var ErrNotFound = errors.New("client not found")

ErrNotFound is returned by Registry.GetClient when no client matches the given ID.

Types

type AccessTokenType

type AccessTokenType string

AccessTokenType controls which kind of access token is issued to a client.

const (
	// AccessTokenTypeIntrospect issues an encrypted PASETO v4.local token containing only
	// {sid, jti, iat, exp}, validated via the session store on every request.
	// Default for all clients.
	AccessTokenTypeIntrospect AccessTokenType = "introspect"
	// AccessTokenTypeJWT issues a signed JWT with standard OIDC claims, validated by signature
	// only. Requires a KeyProvider.
	AccessTokenTypeJWT AccessTokenType = "jwt"
)

type Client

type Client struct {
	ID            string
	Name          string
	SecretHash    string // bcrypt; required when TokenEndpointAuthMethod = client_secret
	PublicKey     string // PEM; required when TokenEndpointAuthMethod = private_key_jwt
	GrantTypes    []string
	Scopes        []string
	RedirectURIs  []string
	Public        bool // true = public client; no client secret required
	AllowNoPrompt bool // true = portal client; silent re-auth allowed
	RequirePKCE   bool // true for public clients
	// RequireDPoP, if true, makes a DPoP proof mandatory at /token; cnf.jkt is bound into
	// issued tokens.
	RequireDPoP             bool
	ResponseMode            ResponseMode
	AccessTokenType         AccessTokenType
	TokenEndpointAuthMethod TokenEndpointAuthMethod // how this client authenticates at /token
	// IDTokenSignedResponseAlg is the OIDC id_token_signed_response_alg registration
	// parameter.
	IDTokenSignedResponseAlg string
	MFAPolicy                MFAPolicy
	// AllowedMFAMethods restricts which registered MFA drivers are offered. Empty = all.
	AllowedMFAMethods []string
	// AllowedAuthMethods restricts which auth methods are permitted. Empty = all.
	// Use AuthMethodPassword for internal login; use the provider name for external ones.
	AllowedAuthMethods []string
	DefaultACR         string // acr applied when the request omits acr_values
	// MinACR that is always forced to at least this level.
	MinACR string
	// AllowedACRValues whitelists the acr values the client may request. Empty = any configured.
	AllowedACRValues []string
	// FederatedLogout, if true, chains GET /logout to the IdP's end_session_endpoint for
	// externally-authenticated sessions if supported.
	FederatedLogout bool
	// PostLogoutRedirectURIs is the exact-match allowlist for post_logout_redirect_uri.
	PostLogoutRedirectURIs []string
}

Client is the registered OAuth client metadata.

func (*Client) AuthMethodAllowed

func (c *Client) AuthMethodAllowed(method string) bool

AuthMethodAllowed returns true when method is a permitted primary auth method for this client.

func (*Client) GrantTypeAllowed

func (c *Client) GrantTypeAllowed(grantType string) bool

GrantTypeAllowed returns true when grantType is one of this client's registered GrantTypes.

type MFAPolicy

type MFAPolicy string

MFAPolicy declares whether MFA is required for a client.

const (
	MFAPolicyDisabled MFAPolicy = "disabled" // MFA never required (default)
	MFAPolicyOptional MFAPolicy = "optional" // MFA used if the user is enrolled
	MFAPolicyRequired MFAPolicy = "required" // MFA always required; onboarding if not enrolled
)

MFAPolicy values.

type MemoryRegistry

type MemoryRegistry struct {
	// contains filtered or unexported fields
}

MemoryRegistry is an in-memory Registry for development and tests. It stores clients by value, normalizing each on Add (e.g. defaulting an empty ResponseMode) so GetClient is a plain copy-return and callers never share the registry's state.

func NewMemoryRegistry

func NewMemoryRegistry(clients ...*Client) *MemoryRegistry

NewMemoryRegistry creates a registry seeded with the given clients (keyed by ID).

func (*MemoryRegistry) Add

func (r *MemoryRegistry) Add(c *Client)

Add registers (or replaces) a client. It stores a normalized copy, leaving the caller's *Client untouched.

func (*MemoryRegistry) GetClient

func (r *MemoryRegistry) GetClient(_ context.Context, clientID string) (*Client, error)

GetClient returns registered client by client ID.

type Registry

type Registry interface {
	GetClient(ctx context.Context, clientID string) (*Client, error)
}

Registry provides OAuth client metadata.

type ResponseMode

type ResponseMode string

ResponseMode controls the token response shape for a client (SPA vs SSR).

const (
	ResponseModeJSON     ResponseMode = "json"     // SPA/API: return tokens in JSON body
	ResponseModeRedirect ResponseMode = "redirect" // SSR: Set-Cookie + redirect
	ResponseModeCookie   ResponseMode = "cookie"   // SSR: Set-Cookie only, 204 No Content
)

ResponseMode values.

type TokenEndpointAuthMethod

type TokenEndpointAuthMethod string

TokenEndpointAuthMethod declares how a client authenticates at the token endpoint. Aligns with the OIDC token_endpoint_auth_method registration parameter.

const (
	TokenEndpointAuthNone         TokenEndpointAuthMethod = "none"          // public client - no secret
	TokenEndpointAuthClientSecret TokenEndpointAuthMethod = "client_secret" // shared secret (bcrypt-hashed)
	//nolint:gosec
	TokenEndpointAuthPrivateKeyJWT TokenEndpointAuthMethod = "private_key_jwt"
)

Registered OIDC token_endpoint_auth_method values.