auth

Documentation

Index

• func HasDisplay() bool
• func LoadCredentials() (credentials, error)
• func LoadHubURL() (string, error)
• func LoadRefreshToken() (string, error)
• func LoadToken() (string, error)
• func OpenBrowser(url string) error
• func RemoveCredentials() error
• func RevokeToken(ctx context.Context, hubURL, refreshToken string) error
• func SaveCredentials(creds credentials) error
• func SaveOAuthCredentials(hubURL, accessToken, refreshToken, tokenType string, expiresAt time.Time) error
• type DeviceAuthResponse
  • func StartDeviceAuth(ctx context.Context, hubURL string) (*DeviceAuthResponse, error)
• type PermanentOAuthError
  • func (e *PermanentOAuthError) Error() string
• type TokenManager
  • func NewTokenManager(hubURL, accessToken, refreshToken string, expiresAt time.Time) *TokenManager
  • func ResolveTokenManager(hubURL string) (string, *TokenManager, error)
  • func (tm *TokenManager) AccessToken() string
  • func (tm *TokenManager) Stop()
• type TokenResponse
  • func PollForToken(ctx context.Context, hubURL string, dar *DeviceAuthResponse) (*TokenResponse, error)
  • func RefreshAccessToken(ctx context.Context, hubURL, refreshToken string) (*TokenResponse, error)

Functions

func HasDisplay

func HasDisplay() bool

HasDisplay reports whether the current environment likely has a graphical display available (i.e. not a headless server or SSH session).

func LoadCredentials

func LoadCredentials() (credentials, error)

LoadCredentials reads the full credentials struct from disk.

func LoadHubURL

func LoadHubURL() (string, error)

LoadHubURL reads the hub URL from saved credentials.

func LoadRefreshToken

func LoadRefreshToken() (string, error)

LoadRefreshToken reads the refresh token from credentials.

func LoadToken

func LoadToken() (string, error)

LoadToken reads the access token from ~/.cllmhub/credentials.

func OpenBrowser

func OpenBrowser(url string) error

OpenBrowser opens the given URL in the user's default browser.

func RemoveCredentials

func RemoveCredentials() error

RemoveCredentials deletes the credentials file.

func RevokeToken

func RevokeToken(ctx context.Context, hubURL, refreshToken string) error

RevokeToken revokes a refresh token server-side (RFC 7009).

func SaveCredentials

func SaveCredentials(creds credentials) error

SaveCredentials writes the credentials struct to disk.

func SaveOAuthCredentials

func SaveOAuthCredentials(hubURL, accessToken, refreshToken, tokenType string, expiresAt time.Time) error

SaveOAuthCredentials stores OAuth tokens in ~/.cllmhub/credentials.

Types

type DeviceAuthResponse

type DeviceAuthResponse struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete"`
	ExpiresIn               int    `json:"expires_in"`
	Interval                int    `json:"interval"`
}

DeviceAuthResponse is the response from the device authorization endpoint.

func StartDeviceAuth

func StartDeviceAuth(ctx context.Context, hubURL string) (*DeviceAuthResponse, error)

StartDeviceAuth initiates the OAuth 2.0 device authorization flow.

type PermanentOAuthError

type PermanentOAuthError struct {
	Code        string
	Description string
}

PermanentOAuthError represents an OAuth error that will not succeed on retry (e.g. invalid_grant, invalid_client).

func (*PermanentOAuthError) Error

func (e *PermanentOAuthError) Error() string

type TokenManager

type TokenManager struct {

	// Dead is closed when the token manager can no longer refresh tokens.
	Dead chan struct{}
	// contains filtered or unexported fields
}

TokenManager handles automatic access token refresh in the background. It is safe for concurrent use.

func NewTokenManager

func NewTokenManager(hubURL, accessToken, refreshToken string, expiresAt time.Time) *TokenManager

NewTokenManager creates a TokenManager that will refresh the access token 5 minutes before expiry. Call Stop() when done.

func ResolveTokenManager

func ResolveTokenManager(hubURL string) (string, *TokenManager, error)

ResolveTokenManager loads OAuth credentials from disk and returns a TokenManager for automatic background refresh.

func (*TokenManager) AccessToken

func (tm *TokenManager) AccessToken() string

AccessToken returns the current access token.

func (*TokenManager) Stop

func (tm *TokenManager) Stop()

Stop shuts down the background refresh goroutine.

type TokenResponse

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
}

TokenResponse is the response from the token endpoint.

func PollForToken

func PollForToken(ctx context.Context, hubURL string, dar *DeviceAuthResponse) (*TokenResponse, error)

PollForToken polls the token endpoint until the user approves, denies, or the code expires.

func RefreshAccessToken

func RefreshAccessToken(ctx context.Context, hubURL, refreshToken string) (*TokenResponse, error)

RefreshAccessToken exchanges a refresh token for a new access token.