gitauth

Documentation

Index

• func CheckCommand(args, env []string) bool
• func OverrideVSCodeConfigs(fs afero.Fs) error
• func ParseAskpass(prompt string) (user string, host string, err error)
• type AppInstallation
• type Config
  • func ConvertConfig(entries []codersdk.GitAuthConfig, accessURL *url.URL) ([]*Config, error)
  • func (c *Config) AppInstallations(ctx context.Context, token string) ([]codersdk.GitAuthAppInstallation, bool, error)
  • func (c *Config) RefreshToken(ctx context.Context, db database.Store, gitAuthLink database.GitAuthLink) (database.GitAuthLink, bool, error)
  • func (c *Config) ValidateToken(ctx context.Context, token string) (bool, *codersdk.GitAuthUser, error)
• type DeviceAuth
  • func (c *DeviceAuth) AuthorizeDevice(ctx context.Context) (*codersdk.GitAuthDevice, error)
  • func (c *DeviceAuth) ExchangeDeviceCode(ctx context.Context, deviceCode string) (*oauth2.Token, error)
• type ExchangeDeviceCodeResponse
• type OAuth2Config

Functions

func CheckCommand

func CheckCommand(args, env []string) bool

CheckCommand returns true if the command arguments and environment match those when the GIT_ASKPASS command is invoked by git.

func OverrideVSCodeConfigs

func OverrideVSCodeConfigs(fs afero.Fs) error

OverrideVSCodeConfigs overwrites a few properties to consume GIT_ASKPASS from the host instead of VS Code-specific authentication.

func ParseAskpass

func ParseAskpass(prompt string) (user string, host string, err error)

ParseAskpass returns the user and host from a git askpass prompt. For example: "user1" and "https://github.com". Note that for HTTP protocols, the URL will never contain a path.

For details on how the prompt is formatted, see `credential_ask_one`: https://github.com/git/git/blob/bbe21b64a08f89475d8a3818e20c111378daa621/credential.c#L173-L191

Types

type AppInstallation

type AppInstallation struct {
	ID int
	// Login is the username of the installation.
	Login string
	// URL is a link to configure the app install.
	URL string
}

type Config

type Config struct {
	OAuth2Config
	// ID is a unique identifier for the authenticator.
	ID string
	// Regex is a regexp that URLs will match against.
	Regex *regexp.Regexp
	// Type is the type of provider.
	Type codersdk.GitProvider
	// NoRefresh stops Coder from using the refresh token
	// to renew the access token.
	//
	// Some organizations have security policies that require
	// re-authentication for every token.
	NoRefresh bool
	// ValidateURL ensures an access token is valid before
	// returning it to the user. If omitted, tokens will
	// not be validated before being returned.
	ValidateURL string
	// AppInstallURL is for GitHub App's (and hopefully others eventually)
	// to provide a link to install the app. There's installation
	// of the application, and user authentication. It's possible
	// for the user to authenticate but the application to not.
	AppInstallURL string
	// InstallationsURL is an API endpoint that returns a list of
	// installations for the user. This is used for GitHub Apps.
	AppInstallationsURL string
	// DeviceAuth is set if the provider uses the device flow.
	DeviceAuth *DeviceAuth
}

Config is used for authentication for Git operations.

func ConvertConfig

func ConvertConfig(entries []codersdk.GitAuthConfig, accessURL *url.URL) ([]*Config, error)

ConvertConfig converts the SDK configuration entry format to the parsed and ready-to-consume in coderd provider type.

func (*Config) AppInstallations

func (c *Config) AppInstallations(ctx context.Context, token string) ([]codersdk.GitAuthAppInstallation, bool, error)

AppInstallations returns a list of app installations for the given token. If the provider does not support app installations, it returns nil.

func (*Config) RefreshToken

func (c *Config) RefreshToken(ctx context.Context, db database.Store, gitAuthLink database.GitAuthLink) (database.GitAuthLink, bool, error)

RefreshToken automatically refreshes the token if expired and permitted. It returns the token and a bool indicating if the token was refreshed.

func (*Config) ValidateToken

func (c *Config) ValidateToken(ctx context.Context, token string) (bool, *codersdk.GitAuthUser, error)

ValidateToken ensures the Git token provided is valid! The user is optionally returned if the provider supports it.

type DeviceAuth

type DeviceAuth struct {
	ClientID string
	TokenURL string
	Scopes   []string
	CodeURL  string
}

func (*DeviceAuth) AuthorizeDevice

func (c *DeviceAuth) AuthorizeDevice(ctx context.Context) (*codersdk.GitAuthDevice, error)

AuthorizeDevice begins the device authorization flow. See: https://tools.ietf.org/html/rfc8628#section-3.1

func (*DeviceAuth) ExchangeDeviceCode

func (c *DeviceAuth) ExchangeDeviceCode(ctx context.Context, deviceCode string) (*oauth2.Token, error)

ExchangeDeviceCode exchanges a device code for an access token. The boolean returned indicates whether the device code is still pending and the caller should try again.

type ExchangeDeviceCodeResponse

type ExchangeDeviceCodeResponse struct {
	AccessToken      string `json:"access_token"`
	RefreshToken     string `json:"refresh_token"`
	ExpiresIn        int    `json:"expires_in"`
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
}

type OAuth2Config

type OAuth2Config interface {
	AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string
	Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
	TokenSource(context.Context, *oauth2.Token) oauth2.TokenSource
}