authflow

Documentation

Overview

Package authflow implements the OAuth Loopback flow used by `mp2rss auth login`.

Lifecycle:

1. Caller calls New() with the resolved Web origin and asks for an open port.
2. Caller composes the authorize URL using AuthorizeURL().
3. Caller invokes Wait(ctx) to block until the browser POSTs the Feed Key to /cli/callback, or 120s elapses.
4. Server shuts itself down after the first successful callback.

Security:

• Listens on 127.0.0.1 only.
• Single route: /cli/callback (POST).
• Validates Origin against an allow-list.
• Validates state nonce against CSRF.
• Never prints the Feed Key to the terminal.

Index

• Constants
• Variables
• type CallbackResult
• type Flow
  • func New(webOrigin string) (*Flow, error)
  • func (f *Flow) AuthorizeURL(cliVersion string) string
  • func (f *Flow) CallbackURL() string
  • func (f *Flow) Close() error
  • func (f *Flow) Wait(ctx context.Context) (*CallbackResult, error)

Constants

const DefaultTimeout = 120 * time.Second

DefaultTimeout is how long we wait for the browser to POST back.

Variables

var AllowedOrigins = []string{
	"https://mp2rss.bugcode.dev",
	"http://localhost:3000",
	"http://[::1]:3000",
}

AllowedOrigins are the only Origin headers we'll accept.

Web 端 vite dev 默认起在 :3000（apps/web vite.config 已固定），生产是 https://mp2rss.bugcode.dev。同一台机器同时通过 IPv4 / IPv6 解析 localhost 时 浏览器可能发出 http://[::1]:3000，所以两条都列上。

Types

type CallbackResult

type CallbackResult struct {
	FeedKey string `json:"feed_key"`
	State   string `json:"state"`
	Email   string `json:"email,omitempty"`
	Name    string `json:"name,omitempty"`
}

CallbackResult is what the browser POSTs to /cli/callback.

type Flow

type Flow struct {
	State     string        // 32-byte hex CSRF nonce
	Port      int           // TCP port we bound to
	WebOrigin string        // e.g. https://mp2rss.bugcode.dev
	Timeout   time.Duration // override DefaultTimeout for tests

	// AllowedOrigins overrides the package default — useful for tests.
	AllowedOrigins []string
	// contains filtered or unexported fields
}

Flow is a single-shot loopback server.

func New

func New(webOrigin string) (*Flow, error)

New binds 127.0.0.1 on a random unprivileged port and generates a state.

func (*Flow) AuthorizeURL

func (f *Flow) AuthorizeURL(cliVersion string) string

AuthorizeURL composes the URL the user opens in their browser.

func (*Flow) CallbackURL

func (f *Flow) CallbackURL() string

CallbackURL returns the loopback URL the browser POSTs to.

func (*Flow) Close

func (f *Flow) Close() error

Close shuts down the underlying listener without waiting. Safe to call multiple times.

func (*Flow) Wait

func (f *Flow) Wait(ctx context.Context) (*CallbackResult, error)

Wait starts the loopback HTTP server and blocks until either:

• the browser POSTs a valid callback (returns the result)
• timeout elapses
• ctx is canceled