auth

Documentation

Index

• Constants
• func DeleteCredentials() error
• func ExtractEmailFromIDToken(idToken string) string
• func GeneratePKCE() (verifier, challenge string, err error)
• func GenerateState() (string, error)
• func LoadAndRefresh(authBaseURL string) (string, error)
• func LoadAndRefreshWithOrg(authBaseURL, orgId string) (string, error)
• func Login(authBaseURL string) error
• func Logout(authBaseURL string) error
• func PrintLoginSuccess(email string, expiresAt int64)
• func SaveCredentials(creds *Credentials) error
• func Status() error
• type Credentials
  • func ClientCredentialsLogin(authBaseURL, clientID, clientSecret string) (*Credentials, error)
  • func ExchangeCode(authBaseURL, code, redirectURI, codeVerifier string) (*Credentials, error)
  • func LoadCredentials() (*Credentials, error)
  • func RefreshTokens(authBaseURL string, creds *Credentials) (*Credentials, error)
  • func (c *Credentials) IsExpired() bool

Constants

const Banner = `` /* 865-byte string literal not displayed */

Functions

func DeleteCredentials

func DeleteCredentials() error

DeleteCredentials removes the stored credentials file.

func ExtractEmailFromIDToken

func ExtractEmailFromIDToken(idToken string) string

ExtractEmailFromIDToken parses the JWT payload (without verification — the token was received directly from the auth server over HTTPS) and returns the "email" claim.

func GeneratePKCE

func GeneratePKCE() (verifier, challenge string, err error)

GeneratePKCE returns a code_verifier (base64url-encoded random bytes) and its S256 code_challenge. The challenge is computed by hashing the raw bytes (not the base64url string) to match the auth server's verification, which decodes the verifier from base64url before hashing.

func GenerateState

func GenerateState() (string, error)

GenerateState returns a random string suitable for the OAuth state parameter.

func LoadAndRefresh

func LoadAndRefresh(authBaseURL string) (string, error)

LoadAndRefresh loads stored credentials and refreshes them if expired. Returns the valid access token, or an error if not logged in or refresh fails.

func LoadAndRefreshWithOrg

func LoadAndRefreshWithOrg(authBaseURL, orgId string) (string, error)

LoadAndRefreshWithOrg loads stored credentials and exchanges them for an org-scoped enriched token (with orgId, scopes, userId claims). This is required for services that validate org-level permissions.

func Login

func Login(authBaseURL string) error

Login runs the full OAuth 2.0 Authorization Code + PKCE flow. It starts a local callback server, opens the browser, waits for the callback, exchanges the code for tokens, and stores them.

func Logout

func Logout(authBaseURL string) error

Logout deletes stored credentials and optionally invalidates server-side session.

func PrintLoginSuccess

func PrintLoginSuccess(email string, expiresAt int64)

PrintLoginSuccess prints the Bitwave banner and structured login info.

func SaveCredentials

func SaveCredentials(creds *Credentials) error

SaveCredentials writes tokens to ~/.bitwave/credentials.json with 0600 permissions.

func Status

func Status() error

Status prints the current authentication state.

Types

type Credentials

type Credentials struct {
	AccessToken  string `json:"access_token"`
	IDToken      string `json:"id_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresAt    int64  `json:"expires_at"`
	// OrgID identifies an org-scoped access token. Older credential files omit
	// this field and are upgraded after their next org token exchange.
	OrgID string `json:"org_id,omitempty"`
}

Credentials represents the stored OAuth tokens.

func ClientCredentialsLogin

func ClientCredentialsLogin(authBaseURL, clientID, clientSecret string) (*Credentials, error)

ClientCredentialsLogin exchanges a client_id and client_secret for tokens using the OAuth 2.0 client_credentials grant type. This is the headless alternative to the browser-based PKCE flow, intended for agents and automation.

func ExchangeCode

func ExchangeCode(authBaseURL, code, redirectURI, codeVerifier string) (*Credentials, error)

ExchangeCode exchanges an authorization code for tokens via POST /oauth/token.

func LoadCredentials

func LoadCredentials() (*Credentials, error)

LoadCredentials reads stored credentials. Returns nil, nil if no credentials file exists.

func RefreshTokens

func RefreshTokens(authBaseURL string, creds *Credentials) (*Credentials, error)

RefreshTokens uses a refresh token to obtain new tokens.

func (*Credentials) IsExpired

func (c *Credentials) IsExpired() bool

IsExpired reports whether the access token is expired or within the refresh buffer.