auth

Documentation

Overview

Package auth implements the OAuth 2.0 Device Authorization Grant (RFC 8628) over OIDC discovery: discover the issuer's endpoints, request a device code, prompt the user to approve in a browser, then poll for the token. One code path serves any OIDC provider with discovery and the device grant — e.g. Keycloak or Okta for self-hosted, Auth0 for DBOS-managed.

Index

• type Config
• type DeviceAuth
• type Provider
  • func Discover(ctx context.Context, hc *http.Client, issuer string) (*Provider, error)
• type Token
  • func Login(ctx context.Context, cfg Config, prompt func(DeviceAuth)) (*Token, error)
  • func Refresh(ctx context.Context, cfg Config, refreshToken string) (*Token, error)

Types

type Config

type Config struct {
	Issuer     string
	ClientID   string
	Audience   string   // optional; Auth0 requires it, Keycloak ignores it
	Scopes     []string // e.g. "openid", "offline_access"
	HTTPClient *http.Client
}

Config configures a device-flow login.

type DeviceAuth

type DeviceAuth struct {
	DeviceCode              string
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	ExpiresIn               int
	Interval                int
}

DeviceAuth is what the user must act on to approve the login.

type Provider

type Provider struct {
	Issuer                      string
	DeviceAuthorizationEndpoint string
	TokenEndpoint               string
}

Provider holds the OIDC endpoints discovered from an issuer.

func Discover

func Discover(ctx context.Context, hc *http.Client, issuer string) (*Provider, error)

Discover fetches {issuer}/.well-known/openid-configuration.

type Token

type Token struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	ExpiresIn    int
}

Token is a successful device-flow result.

func Login

func Login(ctx context.Context, cfg Config, prompt func(DeviceAuth)) (*Token, error)

Login runs the full device flow: discover → request device code → prompt → poll → token. prompt is called once with the verification details so the caller can tell the user where to approve.

func Refresh

func Refresh(ctx context.Context, cfg Config, refreshToken string) (*Token, error)

Refresh exchanges a refresh token for a fresh access token (RFC 6749 §6), rediscovering the token endpoint from the issuer. A rotated refresh token, if the provider returns one, is on the result.