code

Documentation

Overview

Package code implements the single-use authorization codes minted by GET /authorize and redeemed by the authorization_code grant at POST /token.

Index

• Variables
• type AuthorizationCode
• type Store
  • func NewCacheStore(c *cache.Cache, codeTTL time.Duration) (Store, error)

Variables

var (
	// ErrNotFound is returned by Consume when no code matches.
	ErrNotFound = errors.New("authorization code not found")
	// ErrReplayed is returned by Consume, together with the bound record, when the code was
	// already redeemed.
	ErrReplayed = errors.New("authorization code replayed")
)

Types

type AuthorizationCode

type AuthorizationCode struct {
	// Code is the opaque high-entropy value returned to the client.
	Code     string
	ClientID string
	UserID   string
	// SessionID is the session established at /authorize; validated again on redemption.
	SessionID string
	// RedirectURI must exactly match the redirect_uri presented at /token.
	RedirectURI string
	Scope       string
	// Nonce is echoed into the id_token.
	Nonce string
	// ACRValues are the requested acr_values, enforced again at redemption.
	ACRValues []string
	// CodeChallenge is the PKCE S256 challenge; "" when the client did not use PKCE.
	CodeChallenge       string
	CodeChallengeMethod string
	ExpiresAt           time.Time
	// IssuedTokenID and IssuedTokenExpiresAt identify the JWT access token issued at
	// redemption so a replay can revoke it. Populated only on the ErrReplayed record.
	IssuedTokenID        string
	IssuedTokenExpiresAt time.Time
}

AuthorizationCode is the server-side record bound to an issued code.

type Store

type Store interface {
	// Save persists a freshly minted code.
	Save(ctx context.Context, c *AuthorizationCode) error
	// Consume atomically fetches and deletes the code. It returns ErrNotFound for an unknown
	// or expired code, or the redeemed record with ErrReplayed when the code was already
	// consumed.
	Consume(ctx context.Context, code string) (*AuthorizationCode, error)
	// BindIssuedToken records the JWT access token issued for a redeemed code so a later
	// replay can revoke it.
	BindIssuedToken(ctx context.Context, code, tokenID string, expiresAt time.Time) error
}

Store persists single-use authorization codes.

func NewCacheStore

func NewCacheStore(c *cache.Cache, codeTTL time.Duration) (Store, error)

NewCacheStore creates the default cache-backed code Store using the app's cache.