Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AuthorizeURL ¶
func AuthorizeURL(in AuthorizeInput) string
AuthorizeURL builds the authorization-code + PKCE authorization URL. It preserves any pre-existing query on the auth endpoint, sets the standard PKCE params (S256), and includes the RFC 8707 resource indicator when non-empty.
func CodeChallengeS256 ¶
CodeChallengeS256 returns the PKCE S256 code challenge for a verifier: base64url(sha256(verifier)) with no padding (RFC 7636 §4.2).
func NewCodeVerifier ¶
NewCodeVerifier builds a PKCE code verifier from caller-supplied randomness (base64url, no padding). Callers pass 32 crypto/rand bytes; randomness is an argument so the result is deterministic and testable.
Types ¶
type AuthorizeInput ¶
type AuthorizeInput struct {
AuthEndpoint string
ClientID string
RedirectURI string
Scopes []string
State string
CodeChallenge string
Resource string // RFC 8707 resource indicator; omitted if empty
}
AuthorizeInput holds the parameters for building an OAuth2 authorization URL.
type ExchangeInput ¶
type ExchangeInput struct {
TokenEndpoint, ClientID, ClientSecret, Code, CodeVerifier, RedirectURI string
Now func() int64
HTTP *http.Client
}
ExchangeInput carries everything the authorization_code grant needs to obtain the initial TokenSet: the vendor's token endpoint, our client_id (and client_secret for confidential clients), the authorization code the browser returned, the PKCE code_verifier that proves possession, and the redirect_uri that must match the one used at authorize time.
type RefreshInput ¶
type RefreshInput struct {
TokenEndpoint, ClientID, ClientSecret, RefreshToken string
Now func() int64
HTTP *http.Client
}
RefreshInput carries everything the refresh_token grant needs. RefreshToken is filled per call by the caller (e.g. oauthSource) from the current TokenSet.
type TokenSet ¶
type TokenSet struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
ExpiresAt int64 `json:"expires_at"` // unix seconds; 0 = unknown/never
Scopes []string `json:"scopes,omitempty"` //
TokenType string `json:"token_type,omitempty"` // usually "Bearer"
}
TokenSet is the sealed credential payload for an OAuth2 vendor target.
func ExchangeCode ¶
func ExchangeCode(ctx context.Context, in ExchangeInput) (TokenSet, error)
ExchangeCode performs the OAuth2 authorization_code grant (with PKCE) and returns the initial TokenSet. It POSTs a form-encoded request to TokenEndpoint and parses the token response exactly like Refresh does (ExpiresAt = Now()+expires_in when positive; Scopes = fields of scope). Non-200 responses surface the status and body as an error.
func Refresh ¶
func Refresh(ctx context.Context, in RefreshInput) (TokenSet, error)
Refresh performs the OAuth2 refresh_token grant and returns the new TokenSet. It preserves the old refresh token if the server omits a new one (non-rotating servers) and only sets ExpiresAt when the server reports a positive expires_in.
func UnmarshalSealed ¶
UnmarshalSealed parses a sealed JSON string back into a TokenSet.
func (TokenSet) MarshalSealed ¶
MarshalSealed serializes the TokenSet to a JSON string for sealing.
func (TokenSet) NeedsRefresh ¶
NeedsRefresh reports whether the access token is at/near expiry.
Source Files