auth

Documentation

Index

• Constants
• func GeneratePKCE() (verifier, challenge string, err error)
• func GenerateState() (string, error)
• func GetValidToken(apiURL string) (string, error)
• func IsExpired(expiry time.Time) bool
• func OpenBrowser(rawURL string) error
• func StartCallbackServer(expectedState string) (port int, codeCh chan string, shutdown func(), err error)
• type TokenResponse
  • func ExchangeCode(apiURL, code, verifier, redirectURI string) (*TokenResponse, error)
  • func Login(apiURL string) (*TokenResponse, error)
  • func RefreshToken(apiURL, refreshToken string) (*TokenResponse, error)

Constants

const (
	CLIClientID        = "stompy-cli"
	PKCEVerifierLength = 32
	LoginTimeout       = 5 * time.Minute
)

const TokenExpiryBuffer = 5 * time.Minute

Functions

func GeneratePKCE

func GeneratePKCE() (verifier, challenge string, err error)

GeneratePKCE creates a code_verifier and code_challenge for OAuth PKCE (RFC 7636).

func GenerateState

func GenerateState() (string, error)

GenerateState creates a random state parameter for CSRF protection.

func GetValidToken

func GetValidToken(apiURL string) (string, error)

GetValidToken returns a valid access token. It checks the stored token's expiry, refreshes if needed, persists updated tokens, and returns the access token string. Returns an error if no token is stored or refresh fails.

func IsExpired

func IsExpired(expiry time.Time) bool

IsExpired checks if a token expiry time has passed (with 5-minute safety buffer).

func OpenBrowser

func OpenBrowser(rawURL string) error

OpenBrowser opens the given URL in the user's default browser.

func StartCallbackServer

func StartCallbackServer(expectedState string) (port int, codeCh chan string, shutdown func(), err error)

StartCallbackServer starts a temporary HTTP server to receive the OAuth callback. The expectedState parameter is used to verify the CSRF state parameter.

Types

type TokenResponse

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int    `json:"expires_in"`
	TokenType    string `json:"token_type"`
}

TokenResponse represents the OAuth token exchange response.

func ExchangeCode

func ExchangeCode(apiURL, code, verifier, redirectURI string) (*TokenResponse, error)

ExchangeCode exchanges an authorization code for tokens via POST /oauth/token.

func Login

func Login(apiURL string) (*TokenResponse, error)

Login performs the full OAuth PKCE login flow: generate PKCE pair, start callback server, open browser, wait for code, exchange.

func RefreshToken

func RefreshToken(apiURL, refreshToken string) (*TokenResponse, error)

RefreshToken uses a refresh token to obtain a new access token.