oauth

Documentation

Index

• Constants
• Variables
• func BrowserFlow(ctx context.Context, cfg FlowConfig, openBrowser func(string) error) (string, error)
• func ChallengeFromVerifier(verifier string) string
• func GenerateVerifier() (string, error)
• func HeadlessFlow(ctx context.Context, cfg FlowConfig, out io.Writer, ...) (string, error)
• type AdminActor
• type AdminTokenResponse
• type FlowConfig
  • func DefaultFlowConfig() FlowConfig
• type FlowResult
  • func BrowserFlowResult(ctx context.Context, cfg FlowConfig, openBrowser func(string) error) (FlowResult, error)
  • func HeadlessFlowResult(ctx context.Context, cfg FlowConfig, out io.Writer, ...) (FlowResult, error)
• type TokenResponse

Constants

const (
	// ClientID is the public OAuth application UID for the Gumroad CLI.
	// This is a public client (confidential: false) — the client ID is not secret.
	ClientID = "oljO5HmcOWvCZ5wbitpXPXk3u0LjAb5GdAEBBU5hwKA"

	AuthorizeURL = "https://app.gumroad.com/oauth/authorize"
	TokenURL     = "https://app.gumroad.com/oauth/token" //nolint:gosec // G101: not a credential

	Scopes = "edit_products view_sales mark_sales_as_shipped edit_sales view_payouts view_profile account"

	DefaultTimeout = 2 * time.Minute
)

Variables

var DefaultFlowConfigFunc = defaultFlowConfig

DefaultFlowConfigFunc returns a FlowConfig using the built-in constants. Replaceable in tests.

var OpenBrowser = browser.OpenURL

OpenBrowser opens the specified URL in the user's default browser.

Functions

func BrowserFlow

func BrowserFlow(ctx context.Context, cfg FlowConfig, openBrowser func(string) error) (string, error)

BrowserFlow runs the full OAuth authorization code flow with PKCE. It binds a local listener, opens the authorize URL via openBrowser, waits for the callback, and exchanges the code for an access token.

func ChallengeFromVerifier

func ChallengeFromVerifier(verifier string) string

ChallengeFromVerifier computes the S256 PKCE code challenge for a given verifier.

func GenerateVerifier

func GenerateVerifier() (string, error)

GenerateVerifier creates a PKCE code verifier: 32 random bytes, base64url-encoded (43 chars).

func HeadlessFlow

func HeadlessFlow(ctx context.Context, cfg FlowConfig, out io.Writer, readLine func() (string, error)) (string, error)

HeadlessFlow runs the OAuth flow without a browser: prints the authorize URL and prompts the user to paste the redirect URL.

Types

type AdminActor

type AdminActor struct {
	Name  string `json:"name"`
	Email string `json:"email"`
}

type AdminTokenResponse

type AdminTokenResponse struct {
	Token           string     `json:"token"`
	TokenExternalID string     `json:"token_external_id"`
	Actor           AdminActor `json:"actor"`
	ExpiresAt       string     `json:"expires_at"`
}

type FlowConfig

type FlowConfig struct {
	ClientID      string
	AuthorizeURL  string
	TokenURL      string
	Scopes        string
	OptionalAdmin bool
	Timeout       time.Duration
	HTTPClient    *http.Client // optional; defaults to http.DefaultClient
}

FlowConfig holds the parameters for an OAuth authorization code flow.

func DefaultFlowConfig

func DefaultFlowConfig() FlowConfig

DefaultFlowConfig returns a FlowConfig using the built-in constants.

type FlowResult

type FlowResult struct {
	AccessToken            string
	AdminToken             *AdminTokenResponse
	AdminAuthorizationCode string
	CodeVerifier           string
}

func BrowserFlowResult

func BrowserFlowResult(ctx context.Context, cfg FlowConfig, openBrowser func(string) error) (FlowResult, error)

BrowserFlowResult runs BrowserFlow and returns optional admin credential material emitted by the unified Gumroad authorization page.

func HeadlessFlowResult

func HeadlessFlowResult(ctx context.Context, cfg FlowConfig, out io.Writer, readLine func() (string, error)) (FlowResult, error)

HeadlessFlowResult is HeadlessFlow with optional admin credential metadata.

type TokenResponse

type TokenResponse struct {
	AccessToken string              `json:"access_token"`
	TokenType   string              `json:"token_type"`
	Scope       string              `json:"scope"`
	AdminToken  *AdminTokenResponse `json:"admin_token,omitempty"`
	Admin       *AdminTokenResponse `json:"admin,omitempty"`
}

TokenResponse is the JSON body returned by the OAuth token endpoint.