syoidc

Documentation

Overview

Package syoidc adds OpenID Connect login to a Syralit app — the Go counterpart of Streamlit's st.login. Wrap the app handler with Protect and every visitor is sent through the provider's login before reaching the app; sy.User() then returns the verified claims.

handler, err := syoidc.Protect(sy.Handler(sy.Config{}, app), syoidc.Config{
    Issuer:       "https://accounts.google.com",
    ClientID:     os.Getenv("OIDC_CLIENT_ID"),
    ClientSecret: os.Getenv("OIDC_CLIENT_SECRET"),
    RedirectURL:  "http://localhost:8600/auth/callback",
    CookieSecret: []byte(os.Getenv("COOKIE_SECRET")),
})
http.ListenAndServe(":8600", handler)

Index

• func Protect(app http.Handler, cfg Config) (http.Handler, error)
• type Config

Functions

func Protect

func Protect(app http.Handler, cfg Config) (http.Handler, error)

Protect wraps app with the OIDC login flow and registers a user resolver so sy.User() returns the verified claims ("sub", "email", "name", "picture"). Provider discovery runs on the first request needing it, so construction never blocks on the network.

Types

type Config

type Config struct {
	Issuer       string // e.g. "https://accounts.google.com"
	ClientID     string
	ClientSecret string
	RedirectURL  string // must match the provider's registered redirect URI

	// CookieSecret signs the identity cookie (HMAC-SHA256). Required;
	// use 32+ random bytes and keep it stable across restarts.
	CookieSecret []byte

	Scopes []string // defaults to [openid profile email]

	CookieName   string        // identity cookie name (default "sy_oidc")
	CookieMaxAge time.Duration // identity cookie lifetime (default 24h)

	LoginPath    string // default "/auth/login"
	CallbackPath string // default "/auth/callback"
	LogoutPath   string // default "/auth/logout"

	// Public lists path prefixes reachable without login (e.g. "/health").
	// Framework assets are always public so the login redirect can render.
	Public []string
}

Config configures the OIDC middleware.