Help us shape the future of Go! Take the 2026 Go Developer Survey

oauthserver

package module
v0.0.0-...-3b58e4c Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 23, 2026 License: MIT Imports: 37 Imported by: 0

README

go-oauth-server

Experimental authorization-code/S256 OAuth protocol contracts for configured platform-owned public and Basic-authenticated confidential web clients and genuine password single-factor user sessions, plus explicitly configured workload client-credentials access. This is not a complete OAuth/OIDC provider or a stable released API.

The optional restricted workload exchange profile uses the standard RFC 8693 grant at Service.Token. It is distinct from private session exchange and does not enable customer, API-key or organization delegation.

The separate human code-access exchange profile lets an explicitly selected configured Basic web client narrow its genuine password-session/S256 access source. It preserves existing human/consent authority and adds no API-key, organization, JWT/cache or HTTP composition profile.

The optional OIDC child selects public or registered pairwise subjects (single-host or validated HTTPS sector URI) for ES256 code flow through the same native password-session/consent authority. Its finite profile explains composition and remaining full-goal work; existing OAuth-only configuration remains unchanged. The child separately opts into consented email UserInfo; openid-only remains the default and email never expands the ID token.

The root package owns bounded protocol parsing, exact HTTPS redirect/issuer/ resource policy, explicit consent and scope ceilings. The optional PostgreSQL adapter implements the durable flow using the existing identity coordinator, current primary authorities, counters, audit and lifecycle owners. Applications supply configuration, not a domain store or replacement authentication engine.

Public surface

  • ParseAuthorizationQuery and ParseTokenForm bound and discriminate input before credential work. Parsing authenticates nothing.
  • ParseTokenFormWithClientAuthentication and ParseRevocationForm enforce exclusive public-none or confidential-Basic credential channels. Configure each confidential client's startup-only ClientSecretVerifier from a borrowed password.Secret, then destroy that startup secret.
  • Service.Authorize admits a genuine current browser and returns an opaque consent interaction, never a code before consent. Explicitly selected OIDC prompt=none can reuse an original unexpired approval for a fresh code without an interaction; it cannot create or renew consent. Exact prompt=consent forces a new protected approval despite reusable consent; it does not itself force new authentication or renew original deadlines.
  • Service.Continue checks the exact original browser, synchronizer, issuer origin and non-expanding scopes before a one-use code response or denial.
  • Service.Token exchanges an exact client/redirect/S256 code or rotates a refresh token. Reused parents revoke their related family. A client with an explicit immutable Workload instead selects Basic-only client_credentials, bound to its startup tenant, service-account identity, scopes and resource; it produces access only, never a human session, consent or refresh token.
  • Service.Revoke handles owning-client token possession. Unknown and foreign tokens are indistinguishable no-ops; access revocation is narrower than refresh-family revocation.
  • Optional Service.EndSession composes native RP-initiated logout through the OIDC child and existing session owner. Client PostLogoutRedirects are exact independent registrations, never authorization callbacks. See the selected logout profile for required migrations, issued-hint custody and metadata-only recovery.
  • Service.Introspect is disabled by default. Explicit OwningClientIntrospection selects separately authenticated confidential clients inspecting only their own actual opaque access/refresh tokens. Public client ID or inspected-token possession alone never authorizes lookup.
  • ResourceVerifier.Verify separately admits only opaque human access tokens for one trusted configured tenant/client/version/issuer/resource/scope policy. Its opaque result's RequireScope checks the demanded OAuth scope and original deadline before a selected resource read; it is not business authorization or an RFC7662 Active wrapper. Use the matching native NewResourceVerifier.
  • Service.ConsentGet/List/Delete use genuine current own-session custody. Deletion additionally requires recent original authentication, issuer origin and same-browser CSRF; native consent-root withdrawal denies associated code/access/refresh authority without unbounded grant fanout.
  • Service.ConsentUpdate separately selects optional ConsentUpdater support for a nonempty strict scope subset of the same own consent. Exact consent and client versions, resource, original fresh password session, issuer origin, same-browser CSRF and a native request key are required. Success invalidates every old-generation descendant; newly approved narrowed authorization is needed to obtain new tokens. Existing ConsentManager implementations do not acquire a new mandatory method.
  • Service.ClientCreate/Delete optionally manage one immutable platform-owned confidential class through Config.ManagedClients and matching native CurrentClientRegistry. Genuine fresh password-session custody, exact current platform-management policy, origin/CSRF and native request keys are required; configuring the owner does not authorize a manager. Creation allocates a reserved managed. ID and reveals a random secret only once after known commitment. Existing warm services resolve actual registry status on every call; terminal deletion denies all descendants without token fanout. Selected OAuth discovery includes the managed human-web/Basic capability, including when no static confidential registration exists.
  • Service.ClientRotateSecret optionally rotates that confidential class using the same exact manager/CSRF authority and keyed original recovery. Explicit overlap is 0..24h at microsecond precision; the successor is revealed once. Rotation advances actual client authority and invalidates every earlier code/access/refresh/grant/consent. New explicit authorization is required even during overlap; only the immediately preceding Basic secret can authenticate those new grants, until its original exclusive expiry. Static clients are unchanged. See the native forward-migration and fleet adoption requirements.
  • Service.ClientGet/List optionally read safe active managed-client metadata through ClientReader. A fresh service can discover current IDs/versions for the existing rotation/deletion calls without retaining creation responses. Reads require an actual current password session and exact platform policy, not mutation-only password freshness or CSRF. List limits are 1..100, with actor/tenant/owner/limit/configuration-bound cursors; no static/deleted client, secret, digest or encrypted preparation is returned. Pages are snapshots, not permission or mutation-version leases.
  • Service.ClientUpdate optionally replaces the complete redirect/scope sets of one exact discovered managed confidential-human client/version within fixed configured ceilings. Existing fresh manager, origin/CSRF and request-key authority remain required. Every commit advances registration authority and invalidates old consent/grants, including a replacement with identical sets. ID/owner/resource/method and both secret generations/overlap expiry are unchanged; unchanged Basic requires NEW explicit consent/code/S256 afterward. Matching native forward history and compatible-fleet activation are required.
  • Service.DiscoveryOauth returns OAuth-only RFC8414 metadata when explicitly selected by Config.Discovery. Trusted issuer-origin endpoint configuration and actual configured clients determine grants, authentication methods, S256, scopes and optional owning-client introspection. It registers no HTTP route.

This root prerequisite alone does not supply durable execution. The selected native composition uses oauthpostgres.NewService(pool, config, keys) and is provided by the optional native module consuming this public core. Its consumer proof starts with actual signup, registration confirmation and password sign-in. The selected contract defines that integration boundary.

Transport and custody

Applications own TLS, routing, browser UI, cookies, trusted network attribution, endpoint rate limits and response encoding. No HTTP routes are registered here. Supply TokenRequest.Network from the trusted transport after parsing; the OAuth form cannot provide it. Untrusted headers cannot establish network attribution without the transport owner's policy.

Requests borrow credential strings until their bounded call returns. Tokens have explicit reveal-once custody; copies cannot restore delivery permission or durable one-use authority. Never log or implicitly serialize requests, token results, cookies, synchronizers, verifiers, codes or bearer values. Deliver only fresh known-committed output. Unknown/historical results contain no credential.

All external operations require a non-nil context and honor earlier deadlines. Immutable services support concurrent calls; borrowed pools, clocks, policy and key providers must remain alive and concurrency-safe. The packages start no background work and own no pool or process shutdown.

Adoption boundary

Public clients with method none and configured confidential clients with client_secret_basic, exact HTTPS callbacks, OAuth-only scopes, opaque access tokens of at most five minutes and rotating opaque refresh tokens are selected. Each statically configured confidential client uses one fixed random 32-byte startup secret; changes require a new client version and retiring old service instances. This is not hot rotation or fleet-wide client/secret revocation. Optional workload issuance requires the native forward migration and actual directory/workload authorization owners; workload-only composition needs no session configuration. Core policy alone does not make an older native adapter workload-capable: adopt an adapter version pinned to this workload-capable core and install its forward migration before enabling that profile. Local paired-source development does not establish canonical public-module installability. Own-consent management similarly requires a matching native version implementing ConsentManager, its forward ConsentMigrationSource, and explicit ConsentManagement selection. Retire old/unselected accepting instances before activation; a new core alone cannot add these fences to an older adapter. Narrowing additionally requires native ConsentNarrowing, its configured kernel request-key owner/history and an explicit application permission for identity.oauth-server.consent-update. A request key is retry correlation, never authentication. See the native adoption and recovery requirements before enabling this separate profile. Device authorization is separately selected through the device child and the native adapter's optional factory. Only clients with explicit DeviceAuthorization permission can use it; default registration and base OAuth bootstrap remain unchanged. The first native profile is unbound OAuth-only issuance reviewed by a recent authenticated password human. It provides no device UI or HTTP/reference routes and does not by itself establish complete device milestone qualification.

Client administration, OIDC, organization delegation, API-key exchange and general resource-server policy and positive-cache composition remain unsupported. The separately selected direct access-only resource profile adds no transport, JWT or remote introspection endpoint. No vendor authorization engine is embedded.

See the selected contract, security model and changelog. The complete repository goal remains broader than this profile.

See contributing for the bounded structural/security checks and the selected runtime checks used by CI.

License

MIT. See LICENSE.

Continue with the documentation index.

Documentation

Overview

Package oauthserver owns the explicitly selected OAuth authorization-server protocol. Protocol parsing does not authenticate a client or subject, authorize consent, consume a code, or issue a token. Durable adapters own those effects.

Index

Constants

View Source 
const AccessTokenType = "urn:ietf:params:oauth:token-type:access_token"

AccessTokenType is the RFC8693 access-token input/output purpose identifier.

View Source 
const ManagedClientPrefix = "managed."

ManagedClientPrefix reserves one server-owned namespace. Selected registries never fall back to static configuration for any ID in this namespace.

Variables

View Source 
var (
	// ErrInvalidRequest rejects malformed, conflicting or out-of-profile input.
	// Errors deliberately contain no submitted values or credential material.
	ErrInvalidRequest = errors.New("oauthserver: invalid request")
	// ErrUnsupportedGrant denies every grant not selected by this profile.
	ErrUnsupportedGrant = errors.New("oauthserver: unsupported grant type")
)
View Source 
var (
	// ErrInvalidGrant denies absent, expired, withdrawn, foreign or reused grant
	// custody without disclosing which property failed.
	ErrInvalidGrant = errors.New("oauthserver: invalid grant")
	// ErrAccessDenied denies current subject, browser, consent or owner admission.
	ErrAccessDenied = errors.New("oauthserver: access denied")
	// ErrInvalidScope denies malformed or expanding requested scope authority.
	ErrInvalidScope = errors.New("oauthserver: invalid scope")
	// ErrLoginRequired is the standard OIDC login_required condition. It does not
	// prove rollback or a pending continuation: a late known commitment retains
	// metadata-only AuthorizationHistorical and CommandID for recovery. It never
	// permits replay or supplies another credential.
	ErrLoginRequired = errors.New("oauthserver: login_required")
	// ErrConsentRequired is OIDC consent_required. It never grants approval or
	// permits an interactive continuation in a no-interaction authorization.
	ErrConsentRequired = errors.New("oauthserver: consent_required")
)
View Source 
var (
	// ErrAlreadyRevealed denies repeated delivery through any custody copy.
	// It is not replay detection: durable protocol state remains authoritative.
	ErrAlreadyRevealed = errors.New("oauthserver: token already revealed")
	// ErrUnavailable redacts unavailable dependencies without secret diagnostics.
	ErrUnavailable = errors.New("oauthserver: unavailable")
)
View Source 
var ErrClientConflict = errors.New("oauthserver: client request conflict")

ErrClientConflict means a request key already names another management intent.

View Source 
var ErrConsentConflict = errors.New("oauthserver: consent request conflict")

ErrConsentConflict means the original request key is already bound to a different narrowing intent. No command identity or authority is disclosed.

View Source 
var ErrInvalidClient = errors.New("oauthserver: invalid client")

ErrInvalidClient denies missing, wrong, foreign or downgraded client authentication without disclosing credential/configuration details.

View Source 
var ErrInvalidResourceToken = errors.New("oauthserver: invalid resource token")

ErrInvalidResourceToken denies unknown, wrong-kind, expired, withdrawn or foreign access custody without disclosing which property failed.

Functions

func PostLogoutRedirectAllowed 

func PostLogoutRedirectAllowed(c Client, target string) bool

PostLogoutRedirectAllowed tests only exact explicitly registered logout metadata. It authenticates no client or session; callers must separately obtain current registration and prove the hint/session association. An absent target is local-only, not a registered redirect, under RP-Initiated Logout §3.

func S256Challenge 

func S256Challenge(verifier string) (string, error)

S256Challenge implements RFC7636 sections4.1/4.2 using standard SHA-256. Verifiers are 43..128 ASCII unreserved characters; plain PKCE is not offered. The returned challenge alone proves neither verifier possession nor entropy.

Types

type AuthorizationCommand 

type AuthorizationCommand struct {
	Request AuthorizationRequest
	Client  Client
	Session session.GetResult
	Browser auth.BearerCredential
	Network string
	// SubjectCandidate is never a resolved identity. The native owner must
	// resolve it in the existing authenticated transaction before signing.
	SubjectCandidate *OIDCSubjectCandidate
	// OIDC is the composed extension's actual authorization policy, for native
	// admission of prompt/max_age against original sealed session observations.
	// Invoke synchronously before protected Work, never while holding row locks;
	// it is borrowed only until this Store call returns. Core conserves the
	// originally observed decision/deadline, not a later freshness renewal.
	OIDC func(context.Context, OIDCAuthorizationInput) (OIDCAuthorizationProjection, error)
}

AuthorizationCommand carries a validated request and genuine sealed session observation to persistence. Browser remains borrowed secret custody, not a caller-selected identity; adapters must repeat current native owner checks.

func (AuthorizationCommand) Format 

func (AuthorizationCommand) Format(s fmt.State, _ rune)

func (AuthorizationCommand) MarshalJSON 

func (AuthorizationCommand) MarshalJSON() ([]byte, error)

type AuthorizationError 

type AuthorizationError string

AuthorizationError is the selected closed no-interaction OIDC error set. It does not establish redirect authority without a validated Service result. 

const (
	AuthorizationLoginRequiredError   AuthorizationError = "login_required"
	AuthorizationConsentRequiredError AuthorizationError = "consent_required"
)

type AuthorizationRequest 

type AuthorizationRequest struct {
	ClientID, RedirectURI, State, CodeChallenge, Resource string
	Scopes                                                []string
	// Nonce is uninterpreted extension input. Core bounds/preserves it; only an
	// explicitly composed OIDC extension may authorize its semantics.
	Nonce string `json:",omitempty"`
	// Prompt preserves absence as empty. The selected extension profile accepts
	// exactly login, none or consent, never empty-present, duplicates or combinations.
	Prompt string `json:",omitempty"`
	// MaxAge is optional elapsed authentication age in uint32 seconds; nil is
	// absent and a nonnil zero requires real fresh login (OIDC Core3.1.2.1).
	// Callers own this input; services copy it before retaining a request.
	MaxAge *uint32 `json:",omitempty"`
}

AuthorizationRequest contains a bounded code/S256 OAuth-only request. It conveys no validated redirect, client, subject or consent authority. Scopes are sorted unique; state is retained byte-for-byte. The selected profile does not accept OIDC, implicit, request-object or caller-selected response modes.

func ParseAuthorizationQuery 

func ParseAuthorizationQuery(raw string) (AuthorizationRequest, error)

ParseAuthorizationQuery parses at most16KiB before allocation-heavy work. Every field is unique and belongs to this selected code/S256 profile. URI syntax is validated but redirect authority remains the registered client policy's responsibility; a parsed RedirectURI must never itself enable a redirect error. Unknown parameters fail rather than silently change profiles.

func ParseAuthorizationQueryWithOIDC 

func ParseAuthorizationQueryWithOIDC(raw string) (AuthorizationRequest, error)

ParseAuthorizationQueryWithOIDC explicitly selects bounded nonce syntax in addition to the existing code/S256 fields. It establishes no OIDC semantics or grant authority: Service still requires its configured extension. The default OAuth parser remains unchanged and rejects every nonce parameter.

func (AuthorizationRequest) Format 

func (AuthorizationRequest) Format(s fmt.State, _ rune)

Format prevents correlated request/state data from appearing in diagnostics.

type AuthorizeOutcome 

type AuthorizeOutcome uint8

AuthorizeOutcome distinguishes interaction, known redirect and metadata-only durability states. Zero is invalid; unknown/historical carry no credentials. 

const (
	LoginRequired AuthorizeOutcome = iota + 1
	ConsentRequired
	AuthorizationRedirect
	AuthorizationDenied
	AuthorizationUnknown
	AuthorizationHistorical
	// FreshAuthenticationRequired retains an original native one-use
	// continuation while requesting genuine newly authenticated password
	// session custody. It is not a completed login or consent authorization.
	FreshAuthenticationRequired
	// AuthorizationProtocolError carries only a closed standard condition and
	// an exact previously validated redirect; no interaction or fresh material.
	AuthorizationProtocolError
)

type AuthorizeRequest 

type AuthorizeRequest struct {
	TenantID identity.TenantID
	Session  auth.BearerCredential
	Request  AuthorizationRequest
	Network  string
}

AuthorizeRequest supplies borrowed browser bearer custody and a typed parsed request. Tenant selects lookup scope, never a user/actor override. Network is trusted transport attribution for native risk, not an authorization assertion.

func (AuthorizeRequest) Format 

func (AuthorizeRequest) Format(s fmt.State, _ rune)

func (AuthorizeRequest) MarshalJSON 

func (AuthorizeRequest) MarshalJSON() ([]byte, error)

type AuthorizeResult 

type AuthorizeResult struct {
	Outcome            AuthorizeOutcome
	CommandID          identity.CommandID
	Continuation, Code Token
	ExpiresAt          time.Time
	RedirectURI, State string
	Issuer             Issuer
	// Request is the original retained request, not a newly proposed redirect
	// or policy. Adapters selecting prompt/max_age must echo it on known initial
	// interaction/success results and protected continuation success.
	Request       AuthorizationRequest
	ProtocolError AuthorizationError
}

AuthorizeResult is a closed interaction/redirect/durability result. Core fills redirect/issuer/state only after checking exact current client registration. Tokens are explicit reveal custody and cannot be implicitly serialized. Historical and unknown outcomes contain no fresh material or redirect. A known commit whose credential expires before delivery retains only Historical and CommandID alongside its error; recover metadata, never replay.

func (AuthorizeResult) Format 

func (AuthorizeResult) Format(s fmt.State, _ rune)

func (AuthorizeResult) Location 

func (r AuthorizeResult) Location() (string, error)

Location explicitly encodes a known committed success/denial for transport. Success consumes Code's sole reveal permission. This representation helper is not proof of issuance or redirect authority; use only a Service result.

func (AuthorizeResult) MarshalJSON 

func (AuthorizeResult) MarshalJSON() ([]byte, error)

type Client 

type Client struct {
	ID, AuthenticationMethod, Resource string
	Owner                              Owner
	Version                            uint64
	Public                             bool
	// DeviceAuthorization explicitly permits RFC8628 for this registered human
	// client. Zero preserves browser-only permission. The optional device child
	// and native composition must still be selected; this is not authentication.
	DeviceAuthorization bool `json:",omitempty"`
	// HumanCodeExchange selects the separate configured code-access delegation
	// operation for this confidential web client. It does not replace Basic
	// authentication or alter existing registration/grant identity. False retains
	// the existing profile; the global/native selection is also required.
	HumanCodeExchange bool `json:",omitempty"`
	Redirects, Scopes []string
	// PostLogoutRedirects independently registers exact RP logout targets.
	// Empty selects local-only logout, never an authorization-redirect fallback.
	PostLogoutRedirects []string `json:",omitempty"`
	// Workload explicitly selects access-only client credentials instead of
	// browser code/consent/refresh. Nil retains the existing web profile.
	Workload *Workload `json:",omitempty"`
	// SubjectRegistration selects immutable OIDC subject policy independently
	// of client authentication. Nil retains legacy public-subject behavior.
	SubjectRegistration *OIDCSubjectRegistration `json:",omitempty"`
}

Client is a non-secret projection. Public=false is the valid confidential class and requires client_secret_basic; Public=true selects none and never a secret. ValidateClient establishes syntax only, not durable existence, current owner authorization or selected issuance capability. Never mutate a supplied projection concurrently with validation or service construction.

func ValidateClient 

func ValidateClient(input Client) (Client, error)

ValidateClient checks/copies complete immutable registration policy. It accepts exactly the reference authentication matrix's two metadata classes; the supported runtime profile must additionally supply the selected class's actual authentication implementation before advertising or issuing for it.

type ClientAuthentication 

type ClientAuthentication struct {
	// contains filtered or unexported fields
}

ClientAuthentication borrows exactly one parsed Basic credential; zero selects public-client none. Parsing grants no client, user or tenant authority. Keep this credential only until the bounded operation returns, never in durable commands or logs. Strings cannot provide guaranteed runtime-wide erasure.

func ParseClientAuthentication 

func ParseClientAuthentication(authorization []string) (ClientAuthentication, error)

ParseClientAuthentication admits absent or exactly one bounded Authorization field. It delegates strict padded Basic decoding to the existing HTTP extractor, then form-unescapes each component once (RFC6749 section2.3.1). A present unsupported/malformed field never falls back to none. The 1KiB ceiling accommodates this profile's 128-byte client ID and 43-byte secret, including component percent-encoding and Base64, before decoding allocations. Applications still bound whole requests and reject credentials in URI/body locations; use the OAuth form parsers for the supported exclusive channels.

func (ClientAuthentication) ClientID 

func (a ClientAuthentication) ClientID() string

ClientID returns parsed non-secret metadata, not authenticated client identity.

func (ClientAuthentication) Format 

func (ClientAuthentication) Format(s fmt.State, _ rune)

Format redacts borrowed credentials for every formatting verb.

func (ClientAuthentication) MarshalJSON 

func (ClientAuthentication) MarshalJSON() ([]byte, error)

MarshalJSON denies implicit borrowed-credential export.

func (ClientAuthentication) MarshalText 

func (ClientAuthentication) MarshalText() ([]byte, error)

MarshalText denies implicit borrowed-credential export.

func (ClientAuthentication) Method 

func (a ClientAuthentication) Method() string

Method returns only the selected protocol method, not successful verification.

func (ClientAuthentication) VerifySecretDigest 

func (a ClientAuthentication) VerifySecretDigest(id string, version uint64, digest ClientSecretDigest) error

VerifySecretDigest authenticates only the exact Basic client/secret-generation digest. Digest possession grants no actor, tenant or management authority.

type ClientGetResult 

type ClientGetResult struct{ Client Client }

ClientGetResult contains one safe current registration, not authentication or an authorization lease. Mutations must independently admit its exact version.

type ClientListPage 

type ClientListPage struct {
	// contains filtered or unexported fields
}

ClientListPage owns up to 100 safe managed confidential-human registrations in ascending ID order. Zero is invalid; an explicitly constructed empty page is valid. Items returns independent copies, including nested collections.

func NewClientListPage 

func NewClientListPage(items []Client) (ClientListPage, error)

NewClientListPage checks the finite metadata class and deep-copies its items. Static/public/workload/OIDC clients and unsorted or duplicate IDs are invalid.

func (ClientListPage) Items 

func (p ClientListPage) Items() []Client

Items returns owned mutable projections; changing them cannot alter the page or native registration authority. The safe managed class has no nested secret, workload or subject-registration policy.

type ClientListResult 

type ClientListResult struct {
	Page       ClientListPage
	NextCursor Cursor
}

ClientListResult contains a bounded independently owned page and scoped cursor. Pages are keyset reads, not an enduring multi-request snapshot or permission.

type ClientManagementExecution 

type ClientManagementExecution struct {
	Request ClientManagementRequest
	Session session.GetResult
	Delete  bool
}

ClientManagementExecution carries original sealed custody, not a permission assertion. Native owners repeat real current actor, exact platform-owner authorization, session/CSRF and original sensitive-proof fences inside Work.

func (ClientManagementExecution) Format 

func (ClientManagementExecution) Format(f fmt.State, _ rune)

func (ClientManagementExecution) MarshalJSON 

func (ClientManagementExecution) MarshalJSON() ([]byte, error)

func (ClientManagementExecution) MarshalText 

func (ClientManagementExecution) MarshalText() ([]byte, error)

func (ClientManagementExecution) ValidateAt 

func (e ClientManagementExecution) ValidateAt(now time.Time) error

ValidateAt checks only original sealed admission and the sensitive 15-minute password age; current native authority, authorization and CSRF remain required.

type ClientManagementRequest 

type ClientManagementRequest struct {
	Owner               Owner
	TenantID            identity.TenantID
	Session             auth.BearerCredential
	CSRF                session.CSRFToken
	Origin, Network     string
	RequestKey          identity.IdempotencyKey
	ClientID            string
	Version             uint64
	Public              bool
	DeviceAuthorization bool
	Redirects, Scopes   []string
	PostLogoutRedirects []string
}

ClientManagementRequest borrows genuine browser/CSRF custody. Create accepts no ID/version; the native owner allocates both once. Public=false explicitly selects the supported Basic confidential class. Delete accepts only ID/version and no registration edits. Owner/tenant are exact preconditions, not overrides. RequestKey is correlation only and never authenticates a manager.

func ValidateClientManagementRequest 

func ValidateClientManagementRequest(r ClientManagementRequest, remove bool, p ManagedClientPolicy, issuer Issuer) (ClientManagementRequest, error)

ValidateClientManagementRequest copies the finite registration variant and checks immutable policy preconditions, never authentication or authorization.

func (ClientManagementRequest) Format 

func (ClientManagementRequest) Format(f fmt.State, _ rune)

func (ClientManagementRequest) MarshalJSON 

func (ClientManagementRequest) MarshalJSON() ([]byte, error)

func (ClientManagementRequest) MarshalText 

func (ClientManagementRequest) MarshalText() ([]byte, error)

type ClientManagementResult 

type ClientManagementResult struct {
	Client     Client
	Secret     Token
	Completion Completion
}

ClientManagementResult returns metadata only except a fresh known committed creation's reveal-once Secret. Retry/recovery/unknown never redelivers secret.

func (ClientManagementResult) Format 

func (ClientManagementResult) Format(f fmt.State, _ rune)

func (ClientManagementResult) MarshalJSON 

func (ClientManagementResult) MarshalJSON() ([]byte, error)

func (ClientManagementResult) MarshalText 

func (ClientManagementResult) MarshalText() ([]byte, error)

type ClientManager 

type ClientManager interface {
	ManageClient(context.Context, ClientManagementExecution) (ClientManagementResult, error)
}

ClientManager is additive; existing Store implementations remain unchanged.

type ClientReadExecution 

type ClientReadExecution struct {
	Request ClientReadRequest
	Session session.GetResult
}

ClientReadExecution carries borrowed browser custody and the original session observation. This exported struct is not sealed authentication evidence or a permission assertion. Native readers independently authenticate Request.Session and compare exact original session/actor/tenant, then repeat current platform policy and client status/version fences without renewing original <=20s validity. This profile selects verified password humans only.

func (ClientReadExecution) Format 

func (ClientReadExecution) Format(f fmt.State, _ rune)

func (ClientReadExecution) MarshalJSON 

func (ClientReadExecution) MarshalJSON() ([]byte, error)

func (ClientReadExecution) MarshalText 

func (ClientReadExecution) MarshalText() ([]byte, error)

func (ClientReadExecution) ValidateAt 

func (e ClientReadExecution) ValidateAt(now time.Time) error

ValidateAt checks original current-read custody only. Unlike client mutations, private safe reads do not require Lifetime.Fresh or a 15-minute password age. Current native authorization and owner/status comparison remain mandatory.

type ClientReadRequest 

type ClientReadRequest struct {
	Owner    Owner
	TenantID identity.TenantID
	Session  auth.BearerCredential
	ClientID string
	Limit    uint16
	Cursor   Cursor
}

ClientReadRequest borrows current browser custody for private managed-client metadata. Get requires only ClientID; list requires Limit in 1..100 and accepts Cursor, but no ClientID. Owner/tenant are exact configured preconditions, never management authorization. Safe reads require neither CSRF nor sensitive-change freshness. Credentials must remain alive until the bounded call returns.

func ValidateClientReadRequest 

func ValidateClientReadRequest(r ClientReadRequest, list bool, p ManagedClientPolicy) (ClientReadRequest, error)

ValidateClientReadRequest validates the closed get/list variants and exact immutable policy, never session authentication, cursor ownership or permission.

func (ClientReadRequest) Format 

func (ClientReadRequest) Format(f fmt.State, _ rune)

func (ClientReadRequest) MarshalJSON 

func (ClientReadRequest) MarshalJSON() ([]byte, error)

func (ClientReadRequest) MarshalText 

func (ClientReadRequest) MarshalText() ([]byte, error)

type ClientReader 

type ClientReader interface {
	ClientGet(context.Context, ClientReadExecution) (ClientGetResult, error)
	ClientList(context.Context, ClientReadExecution) (ClientListResult, error)
}

ClientReader is an additive optional authenticated private-read owner. The protocol's trusted CurrentClientRegistry is not this management API. Readers return no secret/digest/ciphertext or credentials, create no durable effects, and return zero results on denial, cancellation or unavailable authority.

type ClientSecretDigest 

type ClientSecretDigest [32]byte

ClientSecretDigest is digest-only durable verification for a random 32-byte client secret. It is not suitable for human passwords or bearer disclosure.

func DigestClientSecret 

func DigestClientSecret(id string, version uint64, wire string) (ClientSecretDigest, error)

DigestClientSecret binds canonical high-entropy custody to client/secret generation. This is not Client.Version after metadata replacement; native digest-slot custody owns the generation independently of registration authority. Native generation uses independent crypto/rand; no user password is accepted.

func (ClientSecretDigest) Format 

func (ClientSecretDigest) Format(f fmt.State, _ rune)

func (ClientSecretDigest) MarshalJSON 

func (ClientSecretDigest) MarshalJSON() ([]byte, error)

func (ClientSecretDigest) MarshalText 

func (ClientSecretDigest) MarshalText() ([]byte, error)

type ClientSecretRotationExecution 

type ClientSecretRotationExecution struct {
	Request ClientSecretRotationRequest
	Session session.GetResult
}

ClientSecretRotationExecution retains the original sealed human observation; it is not management authorization. The native owner repeats actual current actor/platform policy/CSRF and original freshness fences inside sole Work.

func (ClientSecretRotationExecution) Format 

func (ClientSecretRotationExecution) Format(f fmt.State, _ rune)

func (ClientSecretRotationExecution) MarshalJSON 

func (ClientSecretRotationExecution) MarshalJSON() ([]byte, error)

func (ClientSecretRotationExecution) MarshalText 

func (ClientSecretRotationExecution) MarshalText() ([]byte, error)

func (ClientSecretRotationExecution) ValidateAt 

func (e ClientSecretRotationExecution) ValidateAt(now time.Time) error

ValidateAt preserves the original session/proof deadline; it cannot renew it.

type ClientSecretRotationRequest 

type ClientSecretRotationRequest struct {
	Management ClientManagementRequest
	Overlap    time.Duration
}

ClientSecretRotationRequest borrows the exact management custody and selects an overlap in [0,24h] at microsecond precision. No registration edits, caller secret or caller expiry are accepted. Rotation advances the client authority version: all earlier grants/consents are invalid, including during overlap. A predecessor authenticates only new current-version authorizations, until its original exclusive expiry. A second rotation retires any older predecessor.

func ValidateClientSecretRotationRequest 

func ValidateClientSecretRotationRequest(r ClientSecretRotationRequest, p ManagedClientPolicy, issuer Issuer) (ClientSecretRotationRequest, error)

ValidateClientSecretRotationRequest checks finite policy/preconditions, not authorization. PostgreSQL's microsecond timestamp precision must not round an exclusive expiry into a longer overlap than explicitly requested.

func (ClientSecretRotationRequest) Format 

func (ClientSecretRotationRequest) Format(f fmt.State, _ rune)

func (ClientSecretRotationRequest) MarshalJSON 

func (ClientSecretRotationRequest) MarshalJSON() ([]byte, error)

func (ClientSecretRotationRequest) MarshalText 

func (ClientSecretRotationRequest) MarshalText() ([]byte, error)

type ClientSecretRotationResult 

type ClientSecretRotationResult struct {
	Client               Client
	Secret               Token
	PredecessorExpiresAt time.Time
	Completion           Completion
}

ClientSecretRotationResult exposes the successor once, only on a fresh known commitment. Replays/recovery never redeliver it. PredecessorExpiresAt is zero for zero overlap, otherwise the immutable exclusive predecessor deadline.

func (ClientSecretRotationResult) Format 

func (ClientSecretRotationResult) Format(f fmt.State, _ rune)

func (ClientSecretRotationResult) MarshalJSON 

func (ClientSecretRotationResult) MarshalJSON() ([]byte, error)

func (ClientSecretRotationResult) MarshalText 

func (ClientSecretRotationResult) MarshalText() ([]byte, error)

type ClientSecretRotator 

type ClientSecretRotator interface {
	RotateClientSecret(context.Context, ClientSecretRotationExecution) (ClientSecretRotationResult, error)
}

ClientSecretRotator is additive; existing ClientManager/Store implementations do not acquire a mandatory method. Selection alone never authorizes a manager.

type ClientSecretVerifier 

type ClientSecretVerifier struct {
	// contains filtered or unexported fields
}

ClientSecretVerifier is immutable startup-only confidential-client authority. The reviewed Basic primitive retains keyed digests, never the plaintext input. It is not a durable secret store, hot-rotation policy or tenant/user authority. Retire old service instances and advance Client.Version on configuration or secret changes. Copies share this immutable verifier and support concurrency.

func NewClientSecretVerifier 

func NewClientSecretVerifier(clientID string, version uint64, secret password.Secret) (ClientSecretVerifier, error)

NewClientSecretVerifier binds one fixed configured 32-byte canonical opaque secret to an exact client ID/version. Generate that secret independently with cryptographic entropy. This constructor borrows Secret only during Use; the caller still owns Destroy. It generates only the Basic primitive's local digest key, performs no network/storage IO and does not issue/reveal a secret. Encoded passwords and arbitrary human passwords are not this selected profile.

func (ClientSecretVerifier) Format 

func (ClientSecretVerifier) Format(s fmt.State, _ rune)

Format redacts configured credential authority for every formatting verb.

func (ClientSecretVerifier) MarshalJSON 

func (ClientSecretVerifier) MarshalJSON() ([]byte, error)

MarshalJSON denies implicit configured-credential export.

func (ClientSecretVerifier) MarshalText 

func (ClientSecretVerifier) MarshalText() ([]byte, error)

MarshalText denies implicit configured-credential export.

type ClientUpdateExecution 

type ClientUpdateExecution struct {
	Request ClientUpdateRequest
	Session session.GetResult
}

ClientUpdateExecution retains original sealed session custody, not permission. The native owner independently authenticates borrowed Management.Session and repeats current platform policy, CSRF, actor/version and original expiry fences.

func (ClientUpdateExecution) Format 

func (ClientUpdateExecution) Format(f fmt.State, _ rune)

func (ClientUpdateExecution) MarshalJSON 

func (ClientUpdateExecution) MarshalJSON() ([]byte, error)

func (ClientUpdateExecution) MarshalText 

func (ClientUpdateExecution) MarshalText() ([]byte, error)

func (ClientUpdateExecution) ValidateAt 

func (e ClientUpdateExecution) ValidateAt(now time.Time) error

ValidateAt checks the original nonrenewing sensitive management observation.

type ClientUpdateRequest 

type ClientUpdateRequest struct {
	Management          ClientManagementRequest
	Redirects           []string
	PostLogoutRedirects []string
	Scopes              []string
}

ClientUpdateRequest borrows existing sensitive management custody for an exact current managed confidential-human client/version. Redirects and Scopes are complete replacements within immutable configured ceilings, not merge patches. ID, owner, resource, authentication method and secret generations cannot change. Every committed replacement advances authority and invalidates old consent and grants; unchanged Basic custody requires new explicit authorization afterward.

func ValidateClientUpdateRequest 

func ValidateClientUpdateRequest(r ClientUpdateRequest, p ManagedClientPolicy, issuer Issuer) (ClientUpdateRequest, error)

ValidateClientUpdateRequest copies a complete bounded replacement. Embedded Management registration edits are forbidden; neither validation nor configured owner selection authenticates a manager.

func (ClientUpdateRequest) Format 

func (ClientUpdateRequest) Format(f fmt.State, _ rune)

func (ClientUpdateRequest) MarshalJSON 

func (ClientUpdateRequest) MarshalJSON() ([]byte, error)

func (ClientUpdateRequest) MarshalText 

func (ClientUpdateRequest) MarshalText() ([]byte, error)

type ClientUpdateResult 

type ClientUpdateResult struct {
	Client     Client
	Completion Completion
}

ClientUpdateResult contains safe historical committed metadata and completion only. No secret is generated or revealed by update, retry or recovery.

type ClientUpdater 

type ClientUpdater interface {
	UpdateClient(context.Context, ClientUpdateExecution) (ClientUpdateResult, error)
}

ClientUpdater is optional and additive; Store and ClientManager do not acquire a mandatory method. Native activation requires compatible forward history.

type Clock 

type Clock interface{ Now() time.Time }

Clock is trusted, fast, local and concurrent-safe. Callers cannot supply time in protocol input. Native transactions additionally use authoritative DB time.

type Completion 

type Completion struct {
	Outcome   identity.CommitOutcome
	CommandID identity.CommandID
	Replayed  bool
}

Completion is historical mutation durability, never a permission renewal.

type Config 

type Config struct {
	Issuer                Issuer
	Environment, Resource string
	Scopes                ScopeCatalog
	// OIDCScopes declares the optional child's reserved scope catalog to native
	// persistence. It grants no semantics until WithOIDC composes the child.
	OIDCScopes ScopeCatalog
	Clients    []Client
	// SectorRegistrations supplies opaque registration-time HTTPS provenance
	// for URI-backed pairwise clients. Zero preserves public/single-host policy.
	// Stored client JSON alone cannot establish multi-host registration authority.
	SectorRegistrations []ValidatedSectorRegistration
	// ClientSecrets contains exactly one verifier per confidential client ID and
	// version, none for public clients. See NewClientSecretVerifier's startup policy.
	ClientSecrets []ClientSecretVerifier
	// ManagedClients optionally reserves the server-owned dynamic namespace.
	// Current registry composition is required; zero preserves static-only use.
	ManagedClients *ManagedClientPolicy
	// OwningClientIntrospection explicitly enables RFC7662 for authenticated
	// confidential clients inspecting only their own issued opaque tokens.
	// Merely configuring a confidential client never enables this capability.
	OwningClientIntrospection bool
	// WorkloadExchange is an explicit opt-in; nil preserves all existing grants.
	WorkloadExchange *WorkloadExchangePolicy
	// HumanCodeExchange is a separate opt-in for explicitly selected confidential
	// web clients. Nil preserves the existing workload-only exchange boundary.
	HumanCodeExchange *HumanCodeExchangePolicy `json:",omitempty"`
	// Discovery explicitly selects OAuth authorization-server metadata using
	// trusted endpoint locations. Zero preserves the unadvertised legacy profile.
	Discovery                                                        DiscoveryConfig
	Clock                                                            Clock
	MaximumDuration, CodeTTL, ContinuationTTL, AccessTTL, RefreshTTL time.Duration
}

Config selects OAuth-only public or configured Basic-client web profiles. Every duration is explicit: code/continuation/access are 1s..5min; refresh is AccessTTL..30days; MaximumDuration is 1ms..5s. Resources and issuer are exact HTTPS origins. Sessions and configuration remain borrowed, with no package-owned goroutines.

func (Config) AuthenticateClient 

func (c Config) AuthenticateClient(ctx context.Context, clientID string, input ClientAuthentication) error

AuthenticateClient enforces this validated configuration's exact registered none/Basic matrix using the reviewed primitive, before durable effects. Startup configuration is the authority: it cannot claim hot/fleet-wide secret revocation. It never authenticates a human or chooses tenant authority. Native adapters repeat this same check rather than trusting a parsed DTO.

func (Config) Validated 

func (c Config) Validated() (Config, error)

Validated freezes owned configuration projections without IO, callbacks, randomness, migration or dependency health checks. Confidential clients require exactly one matching startup verifier; missing/foreign/duplicate verifiers deny. 

type Consent struct {
	// contains filtered or unexported fields
}

Consent owns validated immutable metadata. Zero is invalid. A returned consent is not a live authorization lease or a promise that it remains active.

func NewConsent 

func NewConsent(s ConsentSpec) (Consent, error)

NewConsent validates and copies a bounded approved-consent projection.

func (Consent) ClientID 

func (c Consent) ClientID() string

ClientID returns the configured client associated with this approval.

func (Consent) GrantedAt 

func (c Consent) GrantedAt() time.Time

GrantedAt returns the persisted approval time, never ambient renewed time.

func (Consent) ID 

func (c Consent) ID() string

ID returns the independent consent root identifier.

func (Consent) Scopes 

func (c Consent) Scopes() []string

Scopes returns an owned copy of the approved set.

func (Consent) Version 

func (c Consent) Version() uint64

Version is the exact optimistic concurrency version, not grant authority.

type ConsentCommand 

type ConsentCommand struct {
	// contains filtered or unexported fields
}

ConsentCommand owns an immutable scalar operation projection and borrows credential custody. Its zero value is invalid. Safe concurrent use requires the borrowed credential owners to remain alive and concurrency-safe.

func NewConsentCommand 

func NewConsentCommand(s ConsentCommandSpec) (ConsentCommand, error)

NewConsentCommand validates closed variant/pagination bounds without IO.

func (ConsentCommand) Format 

func (ConsentCommand) Format(f fmt.State, _ rune)

Format redacts borrowed custody and correlated consent identifiers.

func (ConsentCommand) Input 

func (c ConsentCommand) Input() ConsentCommandSpec

Input returns a scalar copy for native adapters; credentials remain borrowed.

func (ConsentCommand) MarshalJSON 

func (ConsentCommand) MarshalJSON() ([]byte, error)

MarshalJSON forbids implicit credential export.

func (ConsentCommand) MarshalText 

func (ConsentCommand) MarshalText() ([]byte, error)

MarshalText forbids implicit credential export.

type ConsentCommandSpec 

type ConsentCommandSpec struct {
	Operation ConsentOperation
	TenantID  identity.TenantID
	Session   auth.BearerCredential
	ID        string
	Version   uint64
	Limit     uint16
	Cursor    Cursor
	Origin    string
	CSRF      session.CSRFToken
	Network   string
}

ConsentCommandSpec selects one bounded own-consent operation. Session and CSRF remain borrowed until the bounded call returns; do not destroy them concurrently. Read/remove require ID; enumerate requires Limit in 1..64 and accepts only Cursor. Remove additionally requires exact positive Version, issuer Origin, CSRF and trusted Network. Narrow has those same requirements; its separate update request binds client/resource/scopes/key. Other variant fields must be zero.

func (ConsentCommandSpec) Format 

func (ConsentCommandSpec) Format(f fmt.State, _ rune)

Format redacts borrowed credentials and correlated scope metadata.

func (ConsentCommandSpec) MarshalJSON 

func (ConsentCommandSpec) MarshalJSON() ([]byte, error)

MarshalJSON forbids implicit credential export.

func (ConsentCommandSpec) MarshalText 

func (ConsentCommandSpec) MarshalText() ([]byte, error)

MarshalText forbids implicit credential export.

type ConsentDeleteRequest 

type ConsentDeleteRequest struct{ Consent ConsentCommand }

ConsentDeleteRequest selects fresh-session, same-browser consent withdrawal.

type ConsentDeleteResult 

type ConsentDeleteResult struct {
	Deleted    bool
	Completion Completion
}

ConsentDeleteResult reports committed withdrawal or metadata-only durability. Deleted is true only when a committed withdrawal/no-op is known; unknown or in-progress never proves withdrawal. It does not claim asynchronous cleanup.

type ConsentExecution 

type ConsentExecution struct {
	Command ConsentCommand
	Session session.GetResult
}

ConsentExecution carries genuine sealed session observation plus borrowed original browser/CSRF custody. Native owners must authenticate it again and enforce current subject/session/credential/policy and fresh-mutation fences.

func (ConsentExecution) ValidateAt 

func (e ConsentExecution) ValidateAt(now time.Time) error

ValidateAt checks original sealed session custody and selected recent-proof policy, not current database state, CSRF or authorization. Trusted adapters pass authoritative time and still repeat their owning primary fences.

type ConsentGetRequest 

type ConsentGetRequest struct{ Consent ConsentCommand }

ConsentGetRequest selects an own-consent read with original browser custody.

type ConsentGetResult 

type ConsentGetResult struct{ Consent Consent }

ConsentGetResult contains only currently approved own-consent metadata.

type ConsentListPage 

type ConsentListPage struct {
	// contains filtered or unexported fields
}

ConsentListPage owns 0..64 approved consents in stable ascending ID order. Pagination is keyset-based, not an enduring multi-request snapshot.

func NewConsentListPage 

func NewConsentListPage(items []Consent) (ConsentListPage, error)

NewConsentListPage validates immutable, unique, sorted items and copies them.

func (ConsentListPage) Items 

func (p ConsentListPage) Items() []Consent

Items returns an owned slice of immutable values, including empty final pages.

type ConsentListRequest 

type ConsentListRequest struct{ Consent ConsentCommand }

ConsentListRequest selects an own-consent bounded keyset read.

type ConsentListResult 

type ConsentListResult struct {
	Page       ConsentListPage
	NextCursor Cursor
}

ConsentListResult contains a bounded page and an optional next cursor.

type ConsentManager 

type ConsentManager interface {
	ConsentGet(context.Context, ConsentExecution) (ConsentGetResult, error)
	ConsentList(context.Context, ConsentExecution) (ConsentListResult, error)
	ConsentDelete(context.Context, ConsentExecution) (ConsentDeleteResult, error)
}

ConsentManager is an optional native own-consent owner; absence denies. Reads must be bounded/current and withdrawal atomic with audit/lifecycle/recovery. Existing Store implementations and workload-only profiles need not enable it.

type ConsentOperation 

type ConsentOperation uint8

ConsentOperation is a closed own-consent query, withdrawal or strict scope narrowing. Zero is invalid; subject overrides and expansion remain unavailable. 

const (
	ConsentRead ConsentOperation = iota + 1
	ConsentEnumerate
	ConsentRemove
	ConsentNarrow
)

type ConsentSpec 

type ConsentSpec struct {
	ID, ClientID string
	Version      uint64
	Scopes       []string
	GrantedAt    time.Time
}

ConsentSpec is a nonsecret approved-consent projection, without subject overrides, bearer credentials or inferred permission to use a grant.

type ConsentUpdateExecution 

type ConsentUpdateExecution struct {
	Request ConsentUpdateRequest
	Session session.GetResult
	Client  Client
}

ConsentUpdateExecution carries genuine original session custody and the current configured client. These projections alone are not live authority.

func (ConsentUpdateExecution) Format 

func (ConsentUpdateExecution) Format(f fmt.State, _ rune)

func (ConsentUpdateExecution) MarshalJSON 

func (ConsentUpdateExecution) MarshalJSON() ([]byte, error)

func (ConsentUpdateExecution) MarshalText 

func (ConsentUpdateExecution) MarshalText() ([]byte, error)

type ConsentUpdateRequest 

type ConsentUpdateRequest struct {
	Consent       ConsentCommand
	ClientID      string
	ClientVersion uint64
	Resource      string
	Scopes        []string
	RequestKey    identity.IdempotencyKey
}

ConsentUpdateRequest selects only strict scope narrowing of an existing own consent. Client/version/resource are exact immutable preconditions, not edits. RequestKey is required native retry correlation, never authentication. Session and CSRF in Consent remain borrowed; Scopes are copied before delegation.

func (ConsentUpdateRequest) Format 

func (ConsentUpdateRequest) Format(f fmt.State, _ rune)

func (ConsentUpdateRequest) MarshalJSON 

func (ConsentUpdateRequest) MarshalJSON() ([]byte, error)

func (ConsentUpdateRequest) MarshalText 

func (ConsentUpdateRequest) MarshalText() ([]byte, error)

func (ConsentUpdateRequest) Validated 

func (r ConsentUpdateRequest) Validated() (ConsentUpdateRequest, error)

Validated returns an owned scope copy after bounded structural checks only. The native owner must prove current identity, strict subset and original key.

type ConsentUpdateResult 

type ConsentUpdateResult struct {
	Updated    bool
	Completion Completion
}

ConsentUpdateResult contains metadata only. Updated means a known committed narrowing; historical completion never redelivers tokens or renews authority.

type ConsentUpdater 

type ConsentUpdater interface {
	ConsentUpdate(context.Context, ConsentUpdateExecution) (ConsentUpdateResult, error)
}

ConsentUpdater is an additive optional capability. ConsentManager and legacy Store implementations retain their existing method set unchanged.

type ContinuationCommand 

type ContinuationCommand struct {
	Request ContinueRequest
	Client  Client
	Session session.GetResult
	// OIDC has AuthorizationCommand.OIDC's synchronous borrowed lifetime.
	// Selected success requires evaluation against the original stored request
	// and applicable original/new session context before protected Work.
	OIDC func(context.Context, OIDCAuthorizationInput) (OIDCAuthorizationProjection, error)
}

ContinuationCommand preserves the current browser observation for one protected transition. Selected OIDC policy may require a newly authenticated same-user session. The adapter authenticates/fences the original interaction, both applicable sources and synchronizer; identifiers alone confer no authority.

func (ContinuationCommand) Format 

func (ContinuationCommand) Format(s fmt.State, _ rune)

func (ContinuationCommand) MarshalJSON 

func (ContinuationCommand) MarshalJSON() ([]byte, error)

type ContinueRequest 

type ContinueRequest struct {
	TenantID                                identity.TenantID
	Session                                 auth.BearerCredential
	CSRF                                    session.CSRFToken
	ClientID, Continuation, Origin, Network string
	Approve                                 bool
	Scopes                                  []string
}

ContinueRequest consumes one original browser-bound interaction. The selected issuer-origin synchronizer profile is mandatory. Nil Scopes accepts the exact originally requested set; a supplied set may only narrow it. Deny ignores no authority checks: the native owner still validates/consumes the continuation.

func (ContinueRequest) Format 

func (ContinueRequest) Format(s fmt.State, _ rune)

func (ContinueRequest) MarshalJSON 

func (ContinueRequest) MarshalJSON() ([]byte, error)

type CurrentClientRegistry 

type CurrentClientRegistry interface {
	CurrentClient(context.Context, string) (Client, error)
	AuthenticateCurrentClient(context.Context, Client, ClientAuthentication) error
}

CurrentClientRegistry is a trusted optional native current-client owner, not caller-provided authentication. Each read/authentication must fence actual status/version/owner and never cache positives or fall back on tombstones. Static clients remain owned by Config; only ManagedClientPrefix is delegated.

type Cursor 

type Cursor struct {
	// contains filtered or unexported fields
}

Cursor is bounded, opaque pagination custody. Empty means the first/final page. Native cursors are authenticated to the current tenant/user and limit; parsing alone establishes no authorization or snapshot isolation.

func ParseCursor 

func ParseCursor(value string) (Cursor, error)

ParseCursor borrows at most 512 visible ASCII bytes; native ownership is checked on use. Empty is the explicit absent cursor.

func (Cursor) String 

func (c Cursor) String() string

String returns pagination metadata, never a credential or authority assertion.

type Dependencies 

type Dependencies struct {
	Sessions *session.SessionService
	Store    Store
	OIDC     OIDCExtension
	Clients  CurrentClientRegistry
}

Dependencies uses the existing session owner for credential admission and an owned adapter for complete OAuth effects. Store implementations must honor context, recheck current authority, own no replacement authentication engine, and provide atomic mutation/audit/lifecycle/reconciliation. The PostgreSQL adapter supplies that implementation; applications need no domain-store glue.

type DeviceAction 

type DeviceAction uint8

DeviceAction is a closed native execution discriminator, not a protocol grant. 

const (
	DeviceIssue DeviceAction = iota + 1
	DeviceApprove
	DeviceDeny
	DevicePoll
	DeviceCancel
)

type DeviceClientProjection 

type DeviceClientProjection struct {
	Issuer                                 Issuer
	Environment, Resource                  string
	Client                                 Client
	Scopes                                 []string
	AccessTTL, RefreshTTL, MaximumDuration time.Duration
}

DeviceClientProjection is copied, configured core policy after current client authentication, not a reusable authentication proof. The device child consumes it directly; native mutation must reauthenticate and fence the same registration/version inside its existing transaction before issuing tokens. This first profile excludes workload clients and OIDC scope/subject policy.

func (DeviceClientProjection) Format 

func (DeviceClientProjection) Format(f fmt.State, _ rune)

type DeviceClientSourceRequest 

type DeviceClientSourceRequest struct {
	ClientID, Resource   string
	Scopes               []string
	ClientAuthentication ClientAuthentication
}

DeviceClientSourceRequest borrows actual registered-client custody. Resource omission selects the sole registered resource; nil scopes select its complete OAuth-only scope ceiling. It conveys no subject or consent authority.

func (DeviceClientSourceRequest) Format 

func (DeviceClientSourceRequest) Format(f fmt.State, _ rune)

func (DeviceClientSourceRequest) MarshalJSON 

func (DeviceClientSourceRequest) MarshalJSON() ([]byte, error)

func (DeviceClientSourceRequest) MarshalText 

func (DeviceClientSourceRequest) MarshalText() ([]byte, error)

type DeviceCondition 

type DeviceCondition string

DeviceCondition is a native protocol-state projection. Only the device child maps it to RFC8628 errors; zero has no successful protocol meaning. 

const (
	DevicePending   DeviceCondition = "authorization_pending"
	DeviceSlowDown  DeviceCondition = "slow_down"
	DeviceDenied    DeviceCondition = "access_denied"
	DeviceExpired   DeviceCondition = "expired_token"
	DeviceSucceeded DeviceCondition = "success"
)

type DeviceConfigurationProjection 

type DeviceConfigurationProjection struct {
	Issuer                                 Issuer
	Environment, Resource                  string
	Clock                                  Clock
	MaximumDuration, AccessTTL, RefreshTTL time.Duration
}

DeviceConfigurationProjection is core-owned trusted composition policy. Clock is borrowed, fast, local and concurrent-safe; no state is transferred.

type DeviceDigestScope 

type DeviceDigestScope struct {
	Issuer                                   Issuer
	Environment                              string
	TenantID                                 identity.TenantID
	VerificationURI, TokenEndpoint, ClientID string
	UserCode                                 bool
}

DeviceDigestScope fixes the native digest-at-rest namespace. UserCode lookup requires empty ClientID so inspection can find the original registration; device-code lookup requires it. All other fields are trusted configuration.

type DeviceExecution 

type DeviceExecution struct {
	Action                                DeviceAction
	Policy                                DevicePolicy
	Client                                DeviceClientProjection
	ClientAuthentication                  ClientAuthentication
	Session                               DeviceSessionProjection
	CSRF                                  session.CSRFToken
	Origin, Network, DeviceCode, UserCode string
	GeneratedDeviceCode                   Token
	GeneratedUserCode                     string
}

DeviceExecution borrows original credentials until the bounded native call returns. Client and Session are projections, never permission assertions; native execution must independently authenticate them and compare all original versions inside its sole coordinator. Generated codes are accepted only for Issue and may be disclosed only after fresh known commitment.

func (DeviceExecution) Format 

func (DeviceExecution) Format(f fmt.State, _ rune)

func (DeviceExecution) MarshalJSON 

func (DeviceExecution) MarshalJSON() ([]byte, error)

func (DeviceExecution) MarshalText 

func (DeviceExecution) MarshalText() ([]byte, error)

type DeviceInspection 

type DeviceInspection struct {
	Policy            DevicePolicy
	Session           DeviceSessionProjection
	UserCode, Network string
}

DeviceInspection borrows an actual recent session and a bounded canonical user code. Native inspection rate-limits before lookup and emits no domain audit or lifecycle; rate-store writes are abuse admission, not authorization.

func (DeviceInspection) Format 

func (DeviceInspection) Format(f fmt.State, _ rune)

func (DeviceInspection) MarshalJSON 

func (DeviceInspection) MarshalJSON() ([]byte, error)

func (DeviceInspection) MarshalText 

func (DeviceInspection) MarshalText() ([]byte, error)

type DevicePolicy 

type DevicePolicy struct {
	Enabled                                               bool
	TenantID                                              identity.TenantID
	VerificationURI, TokenEndpoint, AuthorizationEndpoint string
	TTL, PollInterval                                     time.Duration
	VerificationURICompleteBytes                          uint16
	LookupLimit                                           uint16
}

DevicePolicy is the optional child's immutable storage-neutral policy projection. The child owns RFC8628 validation and protocol semantics. Tenant and all endpoint locations are trusted configuration, never device input. Zero Enabled exposes no device capability. Native construction installs no schema, launches no work and must reject a different projection at execution.

type DevicePrompt 

type DevicePrompt struct {
	ClientID, ClientDisplay, UserCode, Resource string
	Scopes                                      []string
	ExpiresAt                                   time.Time
}

DevicePrompt contains only safe current bounded display metadata and the canonical code the user must explicitly compare. It grants no approval.

func (DevicePrompt) Format 

func (DevicePrompt) Format(f fmt.State, _ rune)

type DeviceRecovery 

type DeviceRecovery struct {
	Policy               DevicePolicy
	OperationID          string
	CommandID            identity.CommandID
	Client               DeviceClientProjection
	ClientAuthentication ClientAuthentication
	Session              DeviceSessionProjection
	DeviceCode, UserCode string
}

DeviceRecovery asks the existing coordinator about the original command. Client custody is required for Issue/Poll; human approval/denial requires a current real same-actor session. No recovery generates or redelivers secrets.

func (DeviceRecovery) Format 

func (DeviceRecovery) Format(f fmt.State, _ rune)

func (DeviceRecovery) MarshalJSON 

func (DeviceRecovery) MarshalJSON() ([]byte, error)

func (DeviceRecovery) MarshalText 

func (DeviceRecovery) MarshalText() ([]byte, error)

type DeviceResult 

type DeviceResult struct {
	Completion Completion
	Condition  DeviceCondition
	DeviceCode Token
	UserCode   string
	ExpiresAt  time.Time
	Interval   time.Duration
	Tokens     TokenResult
}

DeviceResult contains fresh material only for a fresh known-committed Issue or token winner. Replays, cancellation, error and unknown commitment retain only Completion and closed nonsecret protocol state, never credentials.

func (DeviceResult) Format 

func (DeviceResult) Format(f fmt.State, _ rune)

func (DeviceResult) MarshalJSON 

func (DeviceResult) MarshalJSON() ([]byte, error)

func (DeviceResult) MarshalText 

func (DeviceResult) MarshalText() ([]byte, error)

type DeviceSessionProjection 

type DeviceSessionProjection struct {
	Request DeviceSessionSourceRequest
	Session session.GetResult
}

DeviceSessionProjection conserves existing session-owner sealed custody and the original nonrenewing read deadline. Native inspection/mutation must independently authenticate/fence this same source and current primary owners; approval/denial additionally require the session owner's actual synchronizer.

func (DeviceSessionProjection) Format 

func (DeviceSessionProjection) Format(f fmt.State, _ rune)

func (DeviceSessionProjection) MarshalJSON 

func (DeviceSessionProjection) MarshalJSON() ([]byte, error)

func (DeviceSessionProjection) MarshalText 

func (DeviceSessionProjection) MarshalText() ([]byte, error)

func (DeviceSessionProjection) ValidateAt 

func (p DeviceSessionProjection) ValidateAt(now time.Time) error

ValidateAt enforces the existing sensitive password-session freshness policy, including original <=20s observation and exclusive15-minute proof age. It grants no current authority and cannot replace native transactional fences.

type DeviceSessionSourceRequest 

type DeviceSessionSourceRequest struct {
	TenantID identity.TenantID
	Session  auth.BearerCredential
}

DeviceSessionSourceRequest selects a tenant lookup and borrows a genuine browser credential. It never accepts a device-selected subject identifier.

func (DeviceSessionSourceRequest) Format 

func (DeviceSessionSourceRequest) Format(f fmt.State, _ rune)

func (DeviceSessionSourceRequest) MarshalJSON 

func (DeviceSessionSourceRequest) MarshalJSON() ([]byte, error)

func (DeviceSessionSourceRequest) MarshalText 

func (DeviceSessionSourceRequest) MarshalText() ([]byte, error)

type DeviceStore 

type DeviceStore interface {
	DevicePolicy() DevicePolicy
	ExecuteDevice(context.Context, DeviceExecution) (DeviceResult, error)
	InspectDevice(context.Context, DeviceInspection) (DevicePrompt, error)
	RecoverDevice(context.Context, DeviceRecovery) (Completion, error)
}

DeviceStore is the optional native execution owner consumed by the device child. Base OAuth Store and bootstrap do not require this interface, a child import or its migrations. Implementations own permanent winning state and atomic core grant/consent/token, audit/lifecycle and reconciliation effects; applications do not supply missing protocol or domain-store orchestration.

type DiscoveryConfig 

type DiscoveryConfig struct {
	Enabled                                                                         bool
	AuthorizationEndpoint, TokenEndpoint, RevocationEndpoint, IntrospectionEndpoint string
}

DiscoveryConfig selects the unsigned RFC8414 authorization-server projection. Zero disables discovery. Enabled configuration requires token/revocation endpoints, authorization only when web clients exist, and introspection iff OwningClientIntrospection is selected with an eligible confidential client. Every URL is trusted startup configuration, not inferred from a request Host. The selected deployment policy restricts endpoints to distinct canonical HTTPS paths on the exact issuer origin; RFC8414 itself permits other origins. No listener, HTTP route or endpoint implementation is created by this value.

type DiscoveryOauthMetadata 

type DiscoveryOauthMetadata struct {
	Issuer                                     string   `json:"issuer"`
	AuthorizationEndpoint                      string   `json:"authorization_endpoint,omitempty"`
	TokenEndpoint                              string   `json:"token_endpoint"`
	RevocationEndpoint                         string   `json:"revocation_endpoint"`
	IntrospectionEndpoint                      string   `json:"introspection_endpoint,omitempty"`
	ScopesSupported                            []string `json:"scopes_supported"`
	ResponseTypesSupported                     []string `json:"response_types_supported"`
	ResponseModesSupported                     []string `json:"response_modes_supported,omitempty"`
	GrantTypesSupported                        []string `json:"grant_types_supported"`
	TokenEndpointAuthMethodsSupported          []string `json:"token_endpoint_auth_methods_supported"`
	RevocationEndpointAuthMethodsSupported     []string `json:"revocation_endpoint_auth_methods_supported"`
	IntrospectionEndpointAuthMethodsSupported  []string `json:"introspection_endpoint_auth_methods_supported,omitempty"`
	CodeChallengeMethodsSupported              []string `json:"code_challenge_methods_supported,omitempty"`
	AuthorizationResponseISSParameterSupported bool     `json:"authorization_response_iss_parameter_supported,omitempty"`
	ProtectedResources                         []string `json:"protected_resources"`
}

DiscoveryOauthMetadata is a caller-owned nonsecret RFC8414 JSON projection, extended only by RFC9207 issuer-response support and RFC9728 protected_resources. Each call returns independently owned slices; mutation conveys no authority and cannot change a service or another caller's metadata. Zero is not valid metadata. It contains no OIDC, registration, device, signing or verifier claim.

type DiscoveryOauthRequest 

type DiscoveryOauthRequest struct{}

DiscoveryOauthRequest is the empty public, read-only discovery operation. It accepts no effective issuer, host, client, tenant or scope override.

type DiscoveryOauthResult 

type DiscoveryOauthResult struct{ Metadata DiscoveryOauthMetadata }

DiscoveryOauthResult carries exact configured metadata on success only. It owns no resource and does not authenticate a client or protected request.

type EndSessionExecution 

type EndSessionExecution struct {
	Input     EndSessionInput
	Client    Client
	StartedAt time.Time
}

EndSessionExecution captures immutable current client policy and the original core call start. The native primary observation must retain the earlier of this start+20s and every original contributing authority/session deadline.

func (EndSessionExecution) Format 

func (EndSessionExecution) Format(f fmt.State, _ rune)

func (EndSessionExecution) MarshalJSON 

func (EndSessionExecution) MarshalJSON() ([]byte, error)

func (EndSessionExecution) MarshalText 

func (EndSessionExecution) MarshalText() ([]byte, error)

type EndSessionInput 

type EndSessionInput struct {
	TenantID                     identity.TenantID
	Session                      auth.BearerCredential
	CSRF                         session.CSRFToken
	Origin, Network              string
	Hint                         VerifiedCompact
	ClientID, Subject            string
	IssuedAt, ExpiresAt          time.Time
	PostLogoutRedirectURI, State string
}

EndSessionInput borrows initiating browser and verified compact custody. The OIDC consumer validates protocol claims; the native owner must independently bind the exact issued digest to its original tenant/client/subject/session. Subject and client are checked preconditions, never target selectors. Expiry is historical hint metadata, not an authorization deadline. No refresh, global session termination, hintless UI or arbitrary recent-session policy is implied.

func (EndSessionInput) Format 

func (EndSessionInput) Format(f fmt.State, _ rune)

func (EndSessionInput) MarshalJSON 

func (EndSessionInput) MarshalJSON() ([]byte, error)

func (EndSessionInput) MarshalText 

func (EndSessionInput) MarshalText() ([]byte, error)

type EndSessionOutcome 

type EndSessionOutcome string

EndSessionOutcome is the closed native RP logout result taxonomy. Provider variants are reserved protocol outcomes, not implemented provider orchestration. 

const (
	EndSessionRedirect              EndSessionOutcome = "redirect"
	EndSessionLocalOnly             EndSessionOutcome = "local-only"
	EndSessionProviderComplete      EndSessionOutcome = "provider-complete"
	EndSessionProviderError         EndSessionOutcome = "provider-error"
	EndSessionTimeout               EndSessionOutcome = "timeout"
	EndSessionUnknownReconciliation EndSessionOutcome = "unknown-reconciliation"
)

type EndSessionResult 

type EndSessionResult struct {
	Outcome     EndSessionOutcome `json:"outcome"`
	RedirectURI string            `json:"redirect_uri,omitempty"`
	State       string            `json:"state,omitempty"`
	Completion  Completion        `json:"completion"`
	ValidUntil  time.Time         `json:"-"`
}

EndSessionResult exposes redirect/state only for fresh known committed logout. Unknown and historical outcomes contain durability metadata, never renewed authority, successful redirect or permission to clear a browser credential. ValidUntil is the original exclusive delivery deadline, not a renewable lease.

func (EndSessionResult) Format 

func (EndSessionResult) Format(f fmt.State, _ rune)

func (EndSessionResult) MarshalJSON 

func (r EndSessionResult) MarshalJSON() ([]byte, error)

func (EndSessionResult) Validate 

func (r EndSessionResult) Validate() error

Validate rejects impossible/mixed payloads; it supplies no revocation proof.

type EndSessionStore 

type EndSessionStore interface {
	EndSessionSelected() bool
	EndSession(context.Context, EndSessionExecution) (EndSessionResult, error)
}

EndSessionStore is an optional native composition, not another mandatory Store method. Fresh execution authenticates the real current initiating session. Matching historical repeat/result access must instead prove original retained custody without requiring that self-revoked session to authenticate again. Required invalidation/audit/lifecycle effects share the existing sole Work.

type GrantType 

type GrantType string

GrantType is the exact protocol discriminator. No grant is implicit. 

const (
	AuthorizationCodeGrant GrantType = "authorization_code"
	RefreshTokenGrant      GrantType = "refresh_token"
	ClientCredentialsGrant GrantType = "client_credentials"
	// TokenExchangeGrant is RFC8693, distinct from the private session grant.
	TokenExchangeGrant GrantType = "urn:ietf:params:oauth:grant-type:token-exchange"
)

type HumanCodeExchangePolicy 

type HumanCodeExchangePolicy struct {
	MaximumDepth     uint8
	ClockUncertainty time.Duration
}

HumanCodeExchangePolicy explicitly selects owning-client delegation of opaque access issued through the existing password-session/S256 authorization-code profile. Clients must independently opt in with Client.HumanCodeExchange. It grants no workload, refresh-source, device, API-key, organization, JWT or private-session exchange authority. Zero MaximumDepth means four exchanges; an explicit value may only lower that ceiling. ClockUncertainty and the configured MaximumDuration share the profile's ten-second uncertainty budget. The native adapter requires its real consent owner and forward lineage history.

type IDToken 

type IDToken struct {
	// contains filtered or unexported fields
}

IDToken is explicit reveal-once signed authentication custody, not an access token or current authorization proof. Parsing gives no verification authority. Copies share delivery permission; implicit diagnostics/serialization redact.

func ParseIDToken 

func ParseIDToken(wire string) (IDToken, error)

func (IDToken) Format 

func (IDToken) Format(f fmt.State, _ rune)

func (IDToken) MarshalJSON 

func (IDToken) MarshalJSON() ([]byte, error)

func (IDToken) MarshalText 

func (IDToken) MarshalText() ([]byte, error)

func (IDToken) Reveal 

func (t IDToken) Reveal() (string, error)

type IntrospectRequest 

type IntrospectRequest struct {
	ClientID, Token      string
	Hint                 TokenKind
	ClientAuthentication ClientAuthentication
}

IntrospectRequest borrows an inspected token separately from the caller's Basic credential. Hint is advisory and cannot restrict supported-type lookup.

func ParseIntrospectionForm 

func ParseIntrospectionForm(raw string, authorization []string) (IntrospectRequest, error)

ParseIntrospectionForm parses the explicitly selected RFC7662 owning-client profile. Exactly one bounded Basic header is separate from the inspected token. Body/URI client credentials are unsupported; transports reject URI credentials and bound the whole request. Duplicates/unknown fields deny. Unknown hints are ignored and recognized hints never constrain lookup (RFC7662 section2.1). Parsing authenticates neither caller nor inspected token.

func (IntrospectRequest) Format 

func (IntrospectRequest) Format(s fmt.State, _ rune)

func (IntrospectRequest) MarshalJSON 

func (IntrospectRequest) MarshalJSON() ([]byte, error)

type IntrospectResult 

type IntrospectResult struct {
	Active                      bool
	ClientID, Subject, Resource string
	Scopes                      []string
	ExpiresAt                   time.Time
	Issuer                      Issuer
}

IntrospectResult is normal successful inactive metadata or current active disclosure. Every metadata member must be absent for Active=false. This is not resource-server authorization or renewable source validity evidence.

func (IntrospectResult) MarshalJSON 

func (r IntrospectResult) MarshalJSON() ([]byte, error)

MarshalJSON projects RFC7662's selected nonsecret metadata. Inactive results always encode only active=false, even if a caller supplied stray metadata. Active values should come only from Service.Introspect, not caller assertions. No bearer, client secret, grant ID or source-session custody is represented.

type IntrospectionCommand 

type IntrospectionCommand struct {
	Request IntrospectRequest
	Client  Client
}

func (IntrospectionCommand) Format 

func (IntrospectionCommand) Format(s fmt.State, _ rune)

func (IntrospectionCommand) MarshalJSON 

func (IntrospectionCommand) MarshalJSON() ([]byte, error)

type Introspector 

type Introspector interface {
	Introspect(context.Context, IntrospectionCommand) (IntrospectResult, error)
}

Introspector is an optional adapter-neutral read seam. Implementations must separately authenticate the owning confidential client and read current primary token/grant and original subject/credential authority. No writes, caching, freshness renewal or credential disclosure are permitted.

type Issuer 

type Issuer struct {
	// contains filtered or unexported fields
}

Issuer is one exact configured HTTPS origin. Zero is invalid. Its value is public metadata, never derived from an inbound Host or forwarded header.

func NewIssuer 

func NewIssuer(value string) (Issuer, error)

NewIssuer validates the selected origin-only issuer profile without IO. Trailing slash and path-bearing issuers are unselected rather than normalized.

func (Issuer) String 

func (i Issuer) String() string

String returns configured public issuer metadata; zero returns empty.

type ManagedClientPolicy 

type ManagedClientPolicy struct {
	Owner     Owner
	TenantID  identity.TenantID
	Redirects []string
	// PostLogoutRedirects is an independent exact ceiling, never inferred from Redirects.
	PostLogoutRedirects []string
	Scopes              ScopeCatalog
	// DeviceAuthorization is an explicit ceiling for newly managed device
	// registrations; false preserves the existing browser-only namespace.
	DeviceAuthorization bool
}

ManagedClientPolicy fixes the only supported immutable platform owner, management tenant and exact redirect/OAuth-scope ceilings. It selects no administrator: each call must authorize the genuine current human separately.

type OIDCAuthenticationRequirement 

type OIDCAuthenticationRequirement uint8

OIDCAuthenticationRequirement is the extension's typed policy projection; it never authenticates a session or permits bypassing native current owners. 

const (
	OIDCAuthenticationCurrent OIDCAuthenticationRequirement = iota + 1
	OIDCAuthenticationFresh
	// OIDCAuthenticationSilent requires current authentication without any user
	// interaction. It is extension policy, never proof of reusable consent; the
	// durable owner must independently admit exact unexpired approval.
	OIDCAuthenticationSilent
)

type OIDCAuthorizationInput 

type OIDCAuthorizationInput struct {
	Issuer      Issuer
	Environment string
	Client      Client
	Request     AuthorizationRequest
	Session     session.GetResult
	// Reauthentication is original native continuation context, never protocol
	// input. The adapter must authenticate/fence this stored original session
	// and request time as well as the newly submitted current session.
	Reauthentication *OIDCReauthenticationInput
}

func (OIDCAuthorizationInput) Format 

func (OIDCAuthorizationInput) Format(f fmt.State, _ rune)

type OIDCAuthorizationProjection 

type OIDCAuthorizationProjection struct {
	Accepted         bool
	SubjectCandidate *OIDCSubjectCandidate
	// Authentication is zero only for requests without selected prompt/max_age.
	// AuthenticationUntil is an exclusive positive max_age policy deadline, not
	// renewable session admission; native Work must check it after waits.
	Authentication      OIDCAuthenticationRequirement
	AuthenticationUntil time.Time
}

type OIDCClaimsInput 

type OIDCClaimsInput struct {
	Issuer                               Issuer
	Environment                          string
	TenantID                             identity.TenantID
	UserID                               identity.UserID
	ClientID, Nonce, ExpectedSubject     string
	Scopes                               []string
	IssuedAt, ExpiresAt, AuthenticatedAt time.Time
	UserInfo                             bool
	// SubjectRegistration and BoundSubject are the current registered policy
	// and the original grant's durable native binding, never caller selectors.
	SubjectRegistration *OIDCSubjectRegistration
	BoundSubject        string
	// Identifiers is optional trusted-only primary directory custody for the
	// selected UserInfo extension, never caller input or an authentication proof.
	// AuthorityExpiresAt retains the earliest original contributing deadline;
	// copying or projecting this input cannot renew primary-read freshness.
	Identifiers        *identity.IdentifierState
	AuthorityExpiresAt time.Time
}

OIDCClaimsInput is supplied only after native grant/primary-authority admission by the adapter. It is not a caller-selected subject or a renewable proof. ExpectedSubject is an immutable previous artifact projection for UserInfo.

func (OIDCClaimsInput) Format 

func (OIDCClaimsInput) Format(f fmt.State, _ rune)

func (OIDCClaimsInput) MarshalJSON 

func (OIDCClaimsInput) MarshalJSON() ([]byte, error)

func (OIDCClaimsInput) MarshalText 

func (OIDCClaimsInput) MarshalText() ([]byte, error)

type OIDCClaimsProjection 

type OIDCClaimsProjection struct {
	Subject, SigningKeyID string
	IDToken               IDToken
}

func (OIDCClaimsProjection) Format 

func (OIDCClaimsProjection) Format(f fmt.State, _ rune)

type OIDCDiscoveryProjection 

type OIDCDiscoveryProjection struct {
	JWKSURI                          string   `json:"jwks_uri"`
	UserInfoEndpoint                 string   `json:"userinfo_endpoint"`
	SubjectTypesSupported            []string `json:"subject_types_supported"`
	IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
	ClaimsSupported                  []string `json:"claims_supported"`
	EndSessionEndpoint               string   `json:"end_session_endpoint,omitempty"`
}

type OIDCExtension 

type OIDCExtension interface {
	Scopes() ScopeCatalog
	ValidateAuthorization(context.Context, OIDCAuthorizationInput) (OIDCAuthorizationProjection, error)
	Claims(context.Context, OIDCClaimsInput) (OIDCClaimsProjection, error)
	OIDCDiscovery(context.Context) (OIDCDiscoveryProjection, error)
}

OIDCExtension is the one consumer-owned optional extension. Core preserves native session/grant authority and does not interpret identity claim meanings. Implementations are immutable, borrowed, concurrent-safe and bounded by ctx.

type OIDCReauthenticationInput 

type OIDCReauthenticationInput struct {
	OriginalSession session.Session
	RequestedAt     time.Time
}

OIDCReauthenticationInput conserves the original pending authorization's native context. Reconstructed metadata alone cannot authorize a transition.

type OIDCSubjectCandidate 

type OIDCSubjectCandidate struct {
	Registration  OIDCSubjectRegistration
	Subject       string
	KeyVersion    uint32
	KeyCommitment [32]byte
}

OIDCSubjectCandidate is a trusted extension's first-binding proposal, not an established subject or bearer authority. Native authenticated Authorize Work resolves the durable binding atomically; an existing binding always wins. KeyVersion identifies writer custody and is not part of subject namespace.

func (OIDCSubjectCandidate) Format 

func (OIDCSubjectCandidate) Format(f fmt.State, _ rune)

type OIDCSubjectKeyRegistration 

type OIDCSubjectKeyRegistration struct {
	Issuer                Issuer
	Environment, PolicyID string
	PolicyVersion         uint64
	KeyVersion            uint32
	Commitment            [32]byte
	Envelope              []byte
}

OIDCSubjectKeyRegistration is non-plaintext deployment custody for one exact pairwise derivation-key version. Envelope contains the authenticated binary secret-envelope representation, not a wrapping key or clear HMAC key. The native adapter authenticates it before durable staging. Callers own Envelope; consumers must copy it. A key version selects writers, never subject namespace.

func (OIDCSubjectKeyRegistration) Format 

func (OIDCSubjectKeyRegistration) Format(f fmt.State, _ rune)

func (OIDCSubjectKeyRegistration) MarshalJSON 

func (OIDCSubjectKeyRegistration) MarshalJSON() ([]byte, error)

func (OIDCSubjectKeyRegistration) MarshalText 

func (OIDCSubjectKeyRegistration) MarshalText() ([]byte, error)

type OIDCSubjectRegistration 

type OIDCSubjectRegistration struct {
	// contains filtered or unexported fields
}

OIDCSubjectRegistration is immutable client registration, independent of the client's public/confidential authentication class. Policy identity/version select the issuer's subject policy, never its current derivation-key version. The zero value is invalid; a nil Client.SubjectRegistration preserves the original public-subject profile. Copies may be shared concurrently.

func NewOIDCSubjectRegistration 

func NewOIDCSubjectRegistration(kind, sector, policy string, version uint64) (OIDCSubjectRegistration, error)

NewOIDCSubjectRegistration selects public or the registered-single-host pairwise profile. Policy IDs use the core identifier grammar. Pairwise sector hosts are exact lowercase ASCII DNS names (no port, URI or normalization). Multi-host registration is obtained from SectorValidator instead. This pure constructor checks syntax, not the existence of issuer policy/key custody.

func (OIDCSubjectRegistration) MarshalJSON 

func (p OIDCSubjectRegistration) MarshalJSON() ([]byte, error)

MarshalJSON preserves the complete nonsecret policy identity. Zero is invalid.

func (OIDCSubjectRegistration) PolicyID 

func (p OIDCSubjectRegistration) PolicyID() string

PolicyID returns the immutable subject-policy selector, empty for zero.

func (OIDCSubjectRegistration) PolicyVersion 

func (p OIDCSubjectRegistration) PolicyVersion() uint64

PolicyVersion returns the policy schema version, zero for invalid zero.

func (OIDCSubjectRegistration) SectorHost 

func (p OIDCSubjectRegistration) SectorHost() string

SectorHost returns the exact registered host, empty for public and zero.

func (OIDCSubjectRegistration) SectorIdentifierURI 

func (p OIDCSubjectRegistration) SectorIdentifierURI() string

SectorIdentifierURI returns the exact HTTPS registration URI, empty for the original public/single-host profiles. The policy is not retrieval authority; Config additionally requires its opaque ValidatedSectorRegistration.

func (OIDCSubjectRegistration) SubjectType 

func (p OIDCSubjectRegistration) SubjectType() string

SubjectType returns public or pairwise; zero returns empty.

func (*OIDCSubjectRegistration) UnmarshalJSON 

func (p *OIDCSubjectRegistration) UnmarshalJSON(wire []byte) error

UnmarshalJSON restores only a complete validated closed object; duplicate, unknown or missing fields deny without changing the receiver. Callers own the receiver and must not mutate it concurrently with use by another goroutine.

type Owner 

type Owner struct {
	// contains filtered or unexported fields
}

Owner is an explicit immutable client-management owner, distinct from the authenticated end user and calling client. The selected profile admits only a deployment-configured platform owner; absent/user/org approximations deny.

func NewPlatformOwner 

func NewPlatformOwner(id string) (Owner, error)

NewPlatformOwner validates a configured platform owner, not request-selected tenant authority. It grants no management permission or end-user identity.

func (Owner) PlatformID 

func (o Owner) PlatformID() string

PlatformID returns public owner identity or empty for an invalid zero value.

type PublicSigningKey 

type PublicSigningKey struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	Use string `json:"use"`
	Alg string `json:"alg"`
	Kid string `json:"kid"`
	X   string `json:"x"`
	Y   string `json:"y"`
}

PublicSigningKey is the public ES256 JWK projection. Private members are not representable. Kid values are unique for the lifetime of an authority.

type RedirectPolicy 

type RedirectPolicy struct {
	// contains filtered or unexported fields
}

RedirectPolicy freezes 1..16 exact registered HTTPS callback URIs. Zero denies all redirects. This initial web-client profile does not select RFC8252 native loopback/custom-scheme exceptions; it never normalizes URI strings.

func NewRedirectPolicy 

func NewRedirectPolicy(targets []string) (RedirectPolicy, error)

NewRedirectPolicy validates/copies a nonempty unique redirect set without IO. Fragments, userinfo, wildcard hosts, backslashes and reserved OAuth response query members are rejected. Output query members must not be shadowed by a registered callback's own parameters (RFC6749 sections3.1.2/4.1.2).

func (RedirectPolicy) Allows 

func (p RedirectPolicy) Allows(target string) bool

Allows performs byte-for-byte matching only, with no URI normalization, prefix matching, query removal or implicit default-port equivalence.

type ResourceAccessProjection 

type ResourceAccessProjection struct {
	Issuer                                                         Issuer
	Environment                                                    string
	TenantID                                                       identity.TenantID
	UserID                                                         identity.UserID
	ClientID                                                       string
	ClientVersion                                                  uint64
	Resource                                                       string
	Scopes                                                         []string
	Kind                                                           TokenKind
	ReadStartedAt, ValidUntil, TokenExpiresAt, CredentialExpiresAt time.Time
}

ResourceAccessProjection is trusted native-reader output, not a credential or public authentication assertion. ReadStartedAt is the earliest contributing read start; ValidUntil cannot exceed it+20s or token/credential expiry. Native readers recheck current token/consent/subject/credential/policy before return.

func (ResourceAccessProjection) Format 

func (ResourceAccessProjection) Format(f fmt.State, _ rune)

func (ResourceAccessProjection) MarshalJSON 

func (ResourceAccessProjection) MarshalJSON() ([]byte, error)

func (ResourceAccessProjection) MarshalText 

func (ResourceAccessProjection) MarshalText() ([]byte, error)

type ResourceAccessReader 

type ResourceAccessReader interface {
	ReadResourceAccess(context.Context, string) (ResourceAccessProjection, error)
}

ResourceAccessReader is a trusted, already policy-bound native access reader. It accepts no caller-selected tenant/client/issuer/resource. Implementations authenticate actual access kind and repeat primary current-authority fences; no positive cache, refresh fallback, writes or renewed evidence is permitted.

type ResourcePrincipal 

type ResourcePrincipal struct {
	// contains filtered or unexported fields
}

ResourcePrincipal is an opaque, scope-bound result of one completed access verification. Zero is invalid. Metadata getters confer no authority; consumers must call RequireScope immediately before their selected resource read. Copies retain the original clock/deadline and cannot renew evidence or act as tokens.

func (ResourcePrincipal) Format 

func (ResourcePrincipal) Format(f fmt.State, _ rune)

func (ResourcePrincipal) MarshalJSON 

func (ResourcePrincipal) MarshalJSON() ([]byte, error)

func (ResourcePrincipal) MarshalText 

func (ResourcePrincipal) MarshalText() ([]byte, error)

func (ResourcePrincipal) RequireScope 

func (p ResourcePrincipal) RequireScope(scope string) (err error)

RequireScope checks the exact verified scope using the original trusted clock. It performs no refresh and grants no general resource/business authorization.

func (ResourcePrincipal) Resource 

func (p ResourcePrincipal) Resource() string

Resource returns the exact configured audience/resource origin.

func (ResourcePrincipal) Subject 

func (p ResourcePrincipal) Subject() identity.UserID

Subject returns nonsecret identity metadata, not an authorization decision.

func (ResourcePrincipal) TenantID 

func (p ResourcePrincipal) TenantID() identity.TenantID

TenantID returns the immutable configured tenant, never a request override.

func (ResourcePrincipal) ValidUntil 

func (p ResourcePrincipal) ValidUntil() time.Time

ValidUntil returns original evidence expiry; reading it never renews custody.

type ResourceVerificationConfig 

type ResourceVerificationConfig struct {
	Issuer          Issuer
	Environment     string
	TenantID        identity.TenantID
	ClientID        string
	ClientVersion   uint64
	Resource        string
	Scopes          ScopeCatalog
	Clock           Clock
	MaximumDuration time.Duration
}

ResourceVerificationConfig is trusted startup policy, never request input. It selects exactly one native human client/tenant/resource and OAuth scope catalog. Clock is trusted, fast and concurrency-safe; MaximumDuration is 1ms..5s. A verifier borrows its reader/clock for its concurrent lifetime.

func (ResourceVerificationConfig) Validated 

func (c ResourceVerificationConfig) Validated() (ResourceVerificationConfig, error)

Validated checks the finite trusted policy without IO or authority claims.

type ResourceVerifier 

type ResourceVerifier struct {
	// contains filtered or unexported fields
}

ResourceVerifier freezes policy and composition independently of protocol Service and RFC7662 metadata disclosure. It owns no pool or background work.

func NewResourceVerifier 

func NewResourceVerifier(c ResourceVerificationConfig, r ResourceAccessReader) (*ResourceVerifier, error)

NewResourceVerifier freezes trusted reader policy. Applications normally use the native constructor rather than implementing missing authority themselves.

func (*ResourceVerifier) Format 

func (*ResourceVerifier) Format(f fmt.State, _ rune)

func (*ResourceVerifier) Verify 

func (v *ResourceVerifier) Verify(ctx context.Context, r ResourceVerifyRequest) (out ResourcePrincipal, err error)

Verify returns only a scope-bound access principal or a zero result/error. Invalid tokens and insufficient scopes fail closed; dependency failures and cancellation return no metadata. Every call performs a new native read.

type ResourceVerifyRequest 

type ResourceVerifyRequest struct{ AccessToken, Scope string }

ResourceVerifyRequest borrows an opaque access token until Verify returns. Scope may demand one supported scope; it cannot choose any trust context. RFC6749 section1.5 reserves refresh tokens for authorization servers only.

func (ResourceVerifyRequest) Format 

func (ResourceVerifyRequest) Format(f fmt.State, _ rune)

func (ResourceVerifyRequest) MarshalJSON 

func (ResourceVerifyRequest) MarshalJSON() ([]byte, error)

func (ResourceVerifyRequest) MarshalText 

func (ResourceVerifyRequest) MarshalText() ([]byte, error)

type RevocationCommand 

type RevocationCommand struct {
	Request RevokeRequest
	Client  Client
}

RevocationCommand binds borrowed token possession to configured client policy; unknown/foreign tokens must remain indistinguishable successful no-ops.

func (RevocationCommand) Format 

func (RevocationCommand) Format(s fmt.State, _ rune)

func (RevocationCommand) MarshalJSON 

func (RevocationCommand) MarshalJSON() ([]byte, error)

type RevokeRequest 

type RevokeRequest struct {
	ClientID, Token      string
	Hint                 TokenKind
	Network              string
	ClientAuthentication ClientAuthentication
}

RevokeRequest borrows a protocol token for client-bound RFC7009 revocation. Hint is advisory; Network is trusted transport attribution, never form input.

func ParseRevocationForm 

func ParseRevocationForm(raw string, authorization []string) (RevokeRequest, error)

ParseRevocationForm validates a bounded RFC7009 token/hint form and the same exclusive none/Basic client credential matrix as the token form. Unknown advisory hints are ignored per RFC7009 section2.1; they never select authority. Transport supplies trusted Network separately and rejects URI credentials.

func (RevokeRequest) Format 

func (RevokeRequest) Format(s fmt.State, _ rune)

func (RevokeRequest) MarshalJSON 

func (RevokeRequest) MarshalJSON() ([]byte, error)

type RevokeResult 

type RevokeResult struct {
	Outcome   identity.CommitOutcome
	CommandID identity.CommandID
}

type ScopeCatalog 

type ScopeCatalog struct {
	// contains filtered or unexported fields
}

ScopeCatalog is the immutable OAuth-resource scope set. Core never assigns OIDC identity/claim/offline semantics. Zero denies all scopes. Copies can be shared concurrently; Scopes returns independently owned projection data.

func NewOIDCScopeCatalog 

func NewOIDCScopeCatalog(names []string) (ScopeCatalog, error)

NewOIDCScopeCatalog reserves 1..6 unique extension-owned names without giving them OAuth resource semantics. Config.Scopes remains OAuth-only.

func NewScopeCatalog 

func NewScopeCatalog(values []string) (ScopeCatalog, error)

NewScopeCatalog validates/copies 1..16 unique OAuth scopes. OIDC reserved scopes belong to the optional OIDC extension and are rejected by this core constructor even if supplied by configuration. No IO or defaults occur.

func (ScopeCatalog) Contains 

func (c ScopeCatalog) Contains(scope string) bool

Contains matches exact case-sensitive scope text. Zero catalogs deny all.

func (ScopeCatalog) Scopes 

func (c ScopeCatalog) Scopes() []string

Scopes returns the sorted public catalog. Mutations cannot change policy.

type SectorEndpoint 

type SectorEndpoint struct {
	URI       string
	Addresses []netip.Addr
}

SectorEndpoint is trusted deployment egress policy for one exact HTTPS URI. Empty Addresses uses public-only DNS. Nonempty Addresses pins the only dial destinations, including explicitly trusted private endpoints; TLS still checks the URI host. No request, redirect, proxy or subsequent DNS can change them.

type SectorRegistrationRequest 

type SectorRegistrationRequest struct {
	Client        Client
	URI, PolicyID string
	PolicyVersion uint64
}

SectorRegistrationRequest contains exact trusted client registration inputs. URI must match an allowed endpoint byte-for-byte. All registered redirects must occur in the fetched document. Policy identity never selects a key version.

type SectorValidator 

type SectorValidator struct {
	// contains filtered or unexported fields
}

SectorValidator owns bounded HTTPS fetching and validation. It is immutable, concurrent-safe and has no background work, shared transport or response cache. Each call closes its connection/response; callers own supplied contexts.

func NewSectorValidator 

func NewSectorValidator(config SectorValidatorConfig) (*SectorValidator, error)

NewSectorValidator freezes explicit egress/TLS policy without IO. There is no generic HTTP/fetch callback: only this owner can create fetched provenance.

func (*SectorValidator) Validate 

func (v *SectorValidator) Validate(ctx context.Context, request SectorRegistrationRequest) (ValidatedSectorRegistration, error)

Validate fetches the exact URI with verified TLS, no proxies, cookies, redirects, decompression or credential forwarding. Documents are <=64KiB, one flat JSON array of 1..64 unique HTTPS redirects, each <=2048 bytes. Network, TLS and remote validation failures return redacted ErrAccessDenied; malformed caller configuration returns ErrInvalidRequest. Cancellation is preserved.

type SectorValidatorConfig 

type SectorValidatorConfig struct {
	Issuer          Issuer
	Environment     string
	Endpoints       []SectorEndpoint
	MaximumDuration time.Duration
	RootCAs         *x509.CertPool
}

SectorValidatorConfig selects registration-time HTTPS validation, not a dynamic-registration endpoint. Issuer/environment bind resulting provenance. Endpoints contains 1..64 exact allowed URIs. MaximumDuration is 1ms..5s for DNS, connection, TLS, headers and body together. RootCAs selects deployment trust (nil uses system roots); construction copies the selected pool and pins.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service freezes selected protocol and adapter composition. It issues no local session and owns no pool, transaction, listener or background work. Immutable concurrent calls require borrowed dependencies to remain alive/concurrent-safe.

func NewService 

func NewService(config Config, dependencies Dependencies) (*Service, error)

NewService validates/copies selected composition without IO or generation.

func (*Service) Authorize 

func (s *Service) Authorize(ctx context.Context, request AuthorizeRequest) (out AuthorizeResult, err error)

Authorize validates exact registered request policy before native state work, then delegates genuine session custody without selecting another subject. Missing/inactive sessions yield LoginRequired; operational failures deny.

func (*Service) ClientCreate 

func (s *Service) ClientCreate(ctx context.Context, r ClientManagementRequest) (ClientManagementResult, error)

ClientCreate selects confidential creation under current platform-owner policy.

func (*Service) ClientDelete 

func (s *Service) ClientDelete(ctx context.Context, r ClientManagementRequest) (ClientManagementResult, error)

ClientDelete terminally withdraws one exact managed client/version.

func (*Service) ClientGet 

func (s *Service) ClientGet(ctx context.Context, r ClientReadRequest) (out ClientGetResult, err error)

ClientGet authenticates current platform-management permission for one safe registration. It never accepts an ID as authority or exposes secret custody.

func (*Service) ClientList 

func (s *Service) ClientList(ctx context.Context, r ClientReadRequest) (out ClientListResult, err error)

ClientList authenticates current platform-management permission for a bounded safe metadata page. Cursors are native scoped metadata, not authorization.

func (*Service) ClientRotateSecret 

func (s *Service) ClientRotateSecret(ctx context.Context, r ClientSecretRotationRequest) (out ClientSecretRotationResult, err error)

ClientRotateSecret rotates one exact managed confidential client/version using current fresh human password authority, exact platform policy and CSRF.

func (*Service) ClientUpdate 

func (s *Service) ClientUpdate(ctx context.Context, r ClientUpdateRequest) (out ClientUpdateResult, err error)

ClientUpdate atomically replaces only redirects/scopes of one exact managed registration. Existing fresh-session, origin/CSRF and keyed native management authority remain mandatory. Static/public/workload/OIDC variants are unselected.

func (*Service) ConsentDelete 

func (s *Service) ConsentDelete(ctx context.Context, r ConsentDeleteRequest) (out ConsentDeleteResult, err error)

ConsentDelete withdraws the exact approved consent version under a fresh current genuine session and native synchronizer/current-authority fences. Replayed/unknown completion never re-executes or discloses bearer material.

func (*Service) ConsentGet 

func (s *Service) ConsentGet(ctx context.Context, r ConsentGetRequest) (out ConsentGetResult, err error)

ConsentGet reads only the current session's approved consent. Missing, foreign, revoked and unsupported profile requests deny without metadata.

func (*Service) ConsentList 

func (s *Service) ConsentList(ctx context.Context, r ConsentListRequest) (out ConsentListResult, err error)

ConsentList reads a current own-subject bounded page, never another actor's approvals. Cursors convey pagination only; native owners authenticate scope.

func (*Service) ConsentUpdate 

func (s *Service) ConsentUpdate(ctx context.Context, r ConsentUpdateRequest) (out ConsentUpdateResult, err error)

ConsentUpdate narrows only an authenticated own consent under fresh original password-session, origin, exact CSRF and native request-key fences.

func (*Service) Continue 

func (s *Service) Continue(ctx context.Context, request ContinueRequest) (out AuthorizeResult, err error)

Continue requires a current genuine source session plus exact issuer origin and a submitted synchronizer. Native storage enforces original interaction, current CSRF/session/authority, one-time consumption and atomic consent/code.

func (*Service) DeviceClientSource 

func (s *Service) DeviceClientSource(ctx context.Context, r DeviceClientSourceRequest) (out DeviceClientProjection, err error)

DeviceClientSource admits only an explicitly permitted current registration through core's existing public/Basic authentication owner. It has no storage, device-code generation or side effects and advertises no endpoint.

func (*Service) DeviceConfiguration 

func (s *Service) DeviceConfiguration() (DeviceConfigurationProjection, error)

DeviceConfiguration returns copied public configuration for the optional child without authenticating a client, advertising a feature or doing IO.

func (*Service) DeviceSessionSource 

func (s *Service) DeviceSessionSource(ctx context.Context, r DeviceSessionSourceRequest) (out DeviceSessionProjection, err error)

DeviceSessionSource requires a current recently authenticated password human through the actual configured SessionService; it creates no replacement session engine, consent, device state or audit effect.

func (*Service) DiscoveryOauth 

func (s *Service) DiscoveryOauth(ctx context.Context, _ DiscoveryOauthRequest) (DiscoveryOauthResult, error)

DiscoveryOauth projects the immutable current selected runtime without IO, callbacks, credential work or storage access. Disabled discovery returns ErrAccessDenied and zero metadata; invalid/nil input returns ErrInvalidRequest, and cancellation preserves the context error. Concurrent calls are safe. The application may serve Metadata as application/json at the RFC8414 well-known URL; transport registration and TLS remain application-owned.

func (*Service) EndSession 

func (s *Service) EndSession(ctx context.Context, in EndSessionInput) (out EndSessionResult, err error)

EndSession delivers only the exact native committed policy-bound outcome. It deliberately delegates original-vs-current browser admission to the native session composition so historical access never authenticates a revoked cookie as a fresh current session. Unknown acknowledgement never yields a redirect.

func (*Service) EndSessionConfigured 

func (s *Service) EndSessionConfigured() (selected bool)

EndSessionConfigured reports trusted native selection only, with no IO or capability activation. An ordinary/custom Store remains unselected by default.

func (*Service) Format 

func (*Service) Format(f fmt.State, _ rune)

Format prevents recursive diagnostics from traversing borrowed secret-bearing extension/store configuration. Public metadata has explicit read operations.

func (*Service) Introspect 

func (s *Service) Introspect(ctx context.Context, request IntrospectRequest) (out IntrospectResult, err error)

Introspect selects only explicitly enabled owning-confidential-client RFC7662 disclosure. Separate Basic authentication precedes lookup; public clients and disabled profiles deny. Unknown, inactive or foreign tokens return only false. The result is a current uncached observation, not renewable validity evidence or resource-server authorization. Transport must enforce TLS and rate limits.

func (*Service) Revoke 

func (s *Service) Revoke(ctx context.Context, request RevokeRequest) (out RevokeResult, err error)

Revoke delegates a possessed owning-client access/refresh token. Unknown tokens are non-enumerating native success; hints cannot select foreign kinds.

func (*Service) Token 

func (s *Service) Token(ctx context.Context, request TokenRequest) (out TokenResult, err error)

Token admits the exact selected grant/client shape and delegates atomic possession/PKCE/current-authority/one-use effects. No browser session, arbitrary tenant selector, actor override or private exchange is inferred. A workload grant requires explicit immutable startup policy and confidential Basic custody.

func (*Service) UserInfoSource 

func (s *Service) UserInfoSource(ctx context.Context, r UserInfoRequest) (out OIDCClaimsInput, err error)

UserInfoSource obtains uncached native authority for the optional child. It returns no identity fields beyond the selected grant projection; it never accepts an ID token as an access credential or renews evidence on replay.

func (*Service) WithOIDC 

func (s *Service) WithOIDC(extension OIDCExtension) (*Service, error)

WithOIDC returns a new immutable service with exactly one configured child. The original service remains OAuth-only and rejects extension scopes. This two-step construction lets the child consume the existing public Service struct without changing it into the stale goal document's breaking interface.

type SigningAuthority 

type SigningAuthority struct {
	// contains filtered or unexported fields
}

SigningAuthority owns private key custody and selected ES256 lifecycle. Its mutex alone owns key states and the last possible issued expiry. No goroutines or external resources are created. Applications must coordinate all serving instances through the same authority/lifecycle; independent instances are not a distributed key registry. Restart must restore published keys and overlap deadlines before activation; a fresh authority is not lifecycle recovery.

func NewSigningAuthority 

func NewSigningAuthority(clock Clock, maximumTTL time.Duration) (*SigningAuthority, error)

NewSigningAuthority selects explicit ID-token lifetime bounds, 1s..5min. Clock is borrowed, fast and concurrency-safe; it must not call this authority.

func (*SigningAuthority) Activate 

func (a *SigningAuthority) Activate(kid string) error

Activate selects only previously published, uncompromised private custody.

func (*SigningAuthority) AddKey 

func (a *SigningAuthority) AddKey(kid string, key *ecdsa.PrivateKey) error

AddKey copies a valid P-256 private key. It is initially unselectable until PublicKeys has projected it and Activate explicitly selects it. Removed kids cannot be reused, avoiding verifier cache ambiguity (OIDC Core 10.1.1).

func (*SigningAuthority) Compromise 

func (a *SigningAuthority) Compromise(kid string) error

Compromise immediately disables signing and publication, deliberately overriding overlap. Existing offline RP caches require explicit invalidation; ID tokens alone are not current resource/session authorization evidence.

func (*SigningAuthority) Format 

func (*SigningAuthority) Format(f fmt.State, _ rune)

Format and serialization prohibit implicit private-custody diagnostics.

func (*SigningAuthority) MarshalJSON 

func (*SigningAuthority) MarshalJSON() ([]byte, error)

func (*SigningAuthority) MarshalText 

func (*SigningAuthority) MarshalText() ([]byte, error)

func (*SigningAuthority) PublicKeys 

func (a *SigningAuthority) PublicKeys(ctx context.Context) ([]PublicSigningKey, error)

PublicKeys publishes the current verification projection and marks included keys eligible for explicit activation. Serve this projection before activating a new key and do not positively cache JWKS across activation. Publication is a composition operation, not proof that a particular remote client fetched it.

func (*SigningAuthority) Retire 

func (a *SigningAuthority) Retire(kid string) error

Retire removes only inactive keys whose last signed token has expired. Keep serving old public keys until then (OIDC Core 10.1.1 key rotation).

func (*SigningAuthority) Sign 

func (a *SigningAuthority) Sign(ctx context.Context, input []byte, expires time.Time) (string, string, error)

Sign performs bounded ES256 signing using only the active published key. Returned signature is the JWS fixed-width R||S encoding, not ASN.1 DER.

func (*SigningAuthority) SignCompact 

func (a *SigningAuthority) SignCompact(ctx context.Context, claims []byte, expires time.Time) (string, error)

SignCompact is a raw signing capability, not a claim validator or authority. Its caller must supply its own closed typed object, never untrusted JSON. It binds the current kid and fixed ES256/JWT header in one lock, so rotation cannot change the key between header creation and signature. Native grant commitment, not possession of signed bytes, authorizes token delivery.

type SigningLifecycle 

type SigningLifecycle interface {
	RegisterSigningKey(context.Context, PublicSigningKey) error
	PublishSigningKeys(context.Context) ([]PublicSigningKey, error)
	ActivateSigningKey(context.Context, string) error
	ReserveSigningKey(context.Context, string, time.Time) error
	RetireSigningKey(context.Context, string) error
	CompromiseSigningKey(context.Context, string) error
}

SigningLifecycle is core's durable public-key authority. Implementations must compare complete registered public material on repeated registration, make publication irreversible, serialize activation, retain the greatest reserved expiry across restart, and prohibit retired/compromised kid reuse. Unknown mutations deny; callers reconcile against the original immutable key/kid. No private material crosses this seam. All methods honor the bounded ctx.

type SigningService 

type SigningService struct {
	// contains filtered or unexported fields
}

SigningService combines core-owned private custody with native durable public lifecycle. This, not an isolated SigningAuthority, is the selected provider signing capability. Lifecycle remains borrowed; it owns no private key.

func NewSigningService 

func NewSigningService(authority *SigningAuthority, lifecycle SigningLifecycle) (*SigningService, error)

func (*SigningService) Activate 

func (s *SigningService) Activate(ctx context.Context, kid string) error

func (*SigningService) Compromise 

func (s *SigningService) Compromise(ctx context.Context, kid string) error

func (*SigningService) Format 

func (*SigningService) Format(f fmt.State, _ rune)

func (*SigningService) Install 

func (s *SigningService) Install(ctx context.Context, kid string, key *ecdsa.PrivateKey) error

Install copies private custody in core and idempotently registers only its exact public identity in the durable owner. A restart must explicitly install private custody again; persistence cannot reconstitute or disclose it.

func (*SigningService) MarshalJSON 

func (*SigningService) MarshalJSON() ([]byte, error)

func (*SigningService) MarshalText 

func (*SigningService) MarshalText() ([]byte, error)

func (*SigningService) PublicKeys 

func (s *SigningService) PublicKeys(ctx context.Context) ([]PublicSigningKey, error)

func (*SigningService) Retire 

func (s *SigningService) Retire(ctx context.Context, kid string) error

func (*SigningService) SignCompact 

func (s *SigningService) SignCompact(ctx context.Context, claims []byte, expires time.Time) (IDToken, string, error)

SignCompact is a raw bounded signing capability: the child must first build its own closed typed claims object, never caller JSON. Private signing starts only after native authority reserves expiry under the exact active, published kid. Reservations are conservative on rollback or lost acknowledgement and are never shortened; delivery still belongs to the native token transaction.

func (*SigningService) VerificationConfigured 

func (s *SigningService) VerificationConfigured() bool

VerificationConfigured reports the optional read-only owner without IO. It does not establish current eligibility or authorize any protocol operation.

func (*SigningService) VerifyCompact 

func (s *SigningService) VerifyCompact(ctx context.Context, wire string) (VerifiedCompact, error)

VerifyCompact validates the core-issued ES256/JWT envelope with bounded strict JOSE syntax and current read-only key eligibility. It intentionally does not reject exp: RP-Initiated Logout §2 permits historical hints. The consuming protocol must still establish exact durable issuance and current source-session association before using such a hint. Cancellation never returns partial proof.

type SigningVerificationKeys 

type SigningVerificationKeys interface {
	VerificationSigningKey(context.Context, string) (PublicSigningKey, error)
}

SigningVerificationKeys is an optional read-only current key-eligibility owner. Unlike publication, this operation must never activate/register keys. Retained retired material may verify historical hints; compromised/foreign keys deny. Implementations perform a bounded primary read without positive caching.

type Store 

type Store interface {
	Authorize(context.Context, AuthorizationCommand) (AuthorizeResult, error)
	Continue(context.Context, ContinuationCommand) (AuthorizeResult, error)
	Token(context.Context, TokenCommand) (TokenResult, error)
	Revoke(context.Context, RevocationCommand) (RevokeResult, error)
}

Store is the consumer-owned storage-neutral OAuth execution seam. Commands contain original custody, not permission to omit current owner checks. Native implementations must not expose concrete transaction handles to core, retain caller inputs after completion, or reveal material on replay/unknown outcomes.

type Token 

type Token struct {
	// contains filtered or unexported fields
}

Token owns one OAuth 32-byte canonical opaque bearer. Copies share a single atomic delivery permission; immutable Digest remains available afterward. This is secret custody, not a session, signature, protocol grant, proof of authentication, persistence or one-time consumption. Only a fresh known committed issuance may deliver it. Unknown and replay results reveal nothing. Go does not guarantee erasure of retained string bytes; there are no external resources or background goroutines. Formatting/serialization never reveals it.

func NewToken 

func NewToken() (Token, error)

NewToken uses the standard library's cryptographic entropy to create exactly 32 random bytes (RFC6749 section10.10). It issues no grant or permission. It must not be called to retry an uncertain durable issuance; reconcile that original command before any new grant or material can be generated.

func ParseToken 

func ParseToken(wire string) (Token, error)

ParseToken copies already possessed canonical 32-byte bearer syntax. It establishes no validity, purpose, ownership or replay authority. New delivery custody from parsed wire cannot undo protocol consumption or reveal an unknown secret. Bounds precede allocation; malformed input is always redacted.

func (Token) Digest 

func (t Token) Digest(key TokenDigestKey, scope TokenScope) (TokenDigest, error)

Digest uses standard HMAC-SHA-256, domain separation and unambiguous length framing, not new cryptography. The version, exact issuer/environment/client, closed purpose and decoded 32-byte bearer are bound. No raw bearer is retained by the result. This pure concurrent-safe operation does not reveal custody, check durable use/expiry, authorize the client, or refresh validity evidence.

func (Token) Format 

func (Token) Format(s fmt.State, _ rune)

Format redacts all formatting verbs, including Go-syntax diagnostics.

func (Token) MarshalJSON 

func (Token) MarshalJSON() ([]byte, error)

MarshalJSON forbids automatic bearer export. Use explicit Reveal after commit.

func (Token) MarshalText 

func (Token) MarshalText() ([]byte, error)

MarshalText forbids automatic text and map-key bearer export.

func (Token) Reveal 

func (t Token) Reveal() (string, error)

Reveal explicitly returns the original bearer once across all copies. Losing the response does not restore this permission. Transport must keep the wire value out of logs, telemetry, persistence and implicit serialization.

type TokenCommand 

type TokenCommand struct {
	Request TokenRequest
	Client  Client
	// OIDC is a trusted composition callback, invoked only for a genuine native
	// human grant in encrypted preparation. Adapters must never invoke it during
	// metadata-only replay/recovery or deliver it before known commitment.
	OIDC func(context.Context, OIDCClaimsInput) (OIDCClaimsProjection, error)
}

TokenCommand borrows exactly one code/S256 or refresh credential until the bounded call returns. Client is configured policy, not client authentication.

func (TokenCommand) Format 

func (TokenCommand) Format(s fmt.State, _ rune)

func (TokenCommand) MarshalJSON 

func (TokenCommand) MarshalJSON() ([]byte, error)

type TokenDigest 

type TokenDigest struct {
	KeyVersion uint32
	Sum        [32]byte
}

TokenDigest is a non-bearer keyed lookup commitment. Persist version and sum together; neither authenticates a grant without current durable state. Avoid exposing stable commitments as correlation identifiers or alternate bearers.

func DeviceLookupDigest 

func DeviceLookupDigest(key TokenDigestKey, scope DeviceDigestScope, wire string) (TokenDigest, error)

DeviceLookupDigest applies versioned standard HMAC-SHA256 with a device-only domain and length framing. It validates canonical lookup syntax before crypto, retains no wire input and authenticates no state. Keys must be dedicated and retained while rows or original-command recovery can reference their version.

func (TokenDigest) Format 

func (TokenDigest) Format(s fmt.State, _ rune)

Format suppresses stable correlation values in diagnostics.

type TokenDigestKey 

type TokenDigestKey struct {
	// contains filtered or unexported fields
}

TokenDigestKey owns an independent nonzero 256-bit lookup key and positive rotation version. Source buffers are copied; callers own their erasure. Retain old versions while active records/tombstones or recovery need their lookup. Versions must never identify different material. This is not an envelope, capability-signing, session, command-fingerprint or client-secret key.

func NewTokenDigestKey 

func NewTokenDigestKey(version uint32, material []byte) (TokenDigestKey, error)

NewTokenDigestKey validates/copies dedicated configuration without IO.

func (TokenDigestKey) Format 

func (TokenDigestKey) Format(s fmt.State, _ rune)

Format prevents automatic key disclosure for every verb.

func (TokenDigestKey) MarshalJSON 

func (TokenDigestKey) MarshalJSON() ([]byte, error)

MarshalJSON prevents secret-key serialization.

func (TokenDigestKey) MarshalText 

func (TokenDigestKey) MarshalText() ([]byte, error)

MarshalText prevents secret-key text serialization.

func (TokenDigestKey) Version 

func (k TokenDigestKey) Version() uint32

Version returns non-secret rotation metadata. Zero means unconfigured.

type TokenKind 

type TokenKind uint8

TokenKind is a closed purpose-separated OAuth lookup domain. 

const (
	TokenContinuation TokenKind = iota + 1
	TokenCode
	TokenAccess
	TokenRefresh
)

type TokenRequest 

type TokenRequest struct {
	GrantType                                 GrantType
	ClientID, Code, RedirectURI, CodeVerifier string
	RefreshToken, Resource                    string
	// Exchange fields are accepted only for the explicitly selected workload
	// profile. Audience and Resource are mutually exclusive exact target selectors.
	SubjectToken, SubjectTokenType, RequestedTokenType, Audience string
	Scopes                                                       []string
	ClientAuthentication                                         ClientAuthentication
	// Network is trusted transport attribution supplied after parsing. It is
	// never accepted from the OAuth form and grants no network trust by itself.
	Network string
	// CommandID is trusted native exchange retry metadata, never a form/header
	// field. Zero requests a distinct exchange; retain the returned ID to retry
	// that exact intent without redelivering a credential. Other grants reject it.
	CommandID identity.CommandID
}

TokenRequest contains exactly one explicitly selected grant variant. Code, subject/refresh token, verifier and Basic credential remain caller custody; transport must never log or serialize this request. Parsing does not validate client status, code ownership, PKCE, replay, current authority or expiry.

func ParseTokenForm 

func ParseTokenForm(raw string) (TokenRequest, error)

ParseTokenForm discriminates a bounded form before credential use. This entrypoint selects public none forms; use ParseTokenFormWithClientAuthentication for exclusive confidential Basic headers. Body secret/assertion channels, client credentials and standard exchange require that authenticated parser; this public-none parser rejects both. Private session exchange is unselected. Scope omission on refresh preserves grant authority; code requests must not supply scope (selected TRANSACTION/API contract).

func ParseTokenFormWithClientAuthentication 

func ParseTokenFormWithClientAuthentication(raw string, authorization []string) (TokenRequest, error)

ParseTokenFormWithClientAuthentication preserves public none forms and admits confidential Basic in exactly one header with no body client identifier or secret/assertion channel. Grant/field bounds precede credential decoding. Header credentials use RFC6749 section2.3.1, not raw RFC7617 components.

func (TokenRequest) Format 

func (TokenRequest) Format(s fmt.State, _ rune)

Format redacts every credential channel for all formatting verbs.

func (TokenRequest) MarshalJSON 

func (TokenRequest) MarshalJSON() ([]byte, error)

MarshalJSON prevents implicit export of bearer-equivalent values.

func (TokenRequest) MarshalText 

func (TokenRequest) MarshalText() ([]byte, error)

MarshalText prevents implicit export of bearer-equivalent values.

type TokenResult 

type TokenResult struct {
	Outcome                   identity.CommitOutcome
	CommandID                 identity.CommandID
	Replayed                  bool
	AccessToken, RefreshToken Token
	IDToken                   IDToken
	ExpiresAt                 time.Time
	Resource                  string
	Scopes                    []string
	// IssuedTokenType is RFC8693's required output purpose for standard exchange
	// only. It is absent on ordinary issuance and on metadata-only recovery.
	IssuedTokenType string
}

TokenResult distinguishes fresh known commitment from metadata-only replay and uncertain durability. Child expiry is bounded by the native parent/grant and Config.AccessTTL; core rejects/scrubs an adapter's invalid output.

func (TokenResult) Format 

func (TokenResult) Format(s fmt.State, _ rune)

func (TokenResult) MarshalJSON 

func (TokenResult) MarshalJSON() ([]byte, error)

type TokenScope 

type TokenScope struct {
	Issuer                Issuer
	Environment, ClientID string
	Kind                  TokenKind
}

TokenScope binds a lookup to trusted issuer/environment, exact client and one protocol purpose. These are server configuration/registered-client values, never authority selected from unverified token claims. The row reached by a digest must separately preserve/check its tenant, owner, actor and grant.

type UserInfoCommand 

type UserInfoCommand struct {
	Request UserInfoRequest
	Client  Client
}

type UserInfoReader 

type UserInfoReader interface {
	UserInfo(context.Context, UserInfoCommand) (OIDCClaimsInput, error)
}

type UserInfoRequest 

type UserInfoRequest struct{ ClientID, AccessToken string }

UserInfoRequest carries an owning-client selector and possessed access token. Neither value overrides the token's native subject, audience or scope.

func (UserInfoRequest) Format 

func (UserInfoRequest) Format(f fmt.State, _ rune)

func (UserInfoRequest) MarshalJSON 

func (UserInfoRequest) MarshalJSON() ([]byte, error)

func (UserInfoRequest) MarshalText 

func (UserInfoRequest) MarshalText() ([]byte, error)

type ValidatedSectorRegistration 

type ValidatedSectorRegistration struct {
	// contains filtered or unexported fields
}

ValidatedSectorRegistration is immutable, opaque registration-time provenance created only after this package fetched/authenticated the exact HTTPS URI. It binds issuer/environment/client/version/policy/URI/exact redirect set. Copies are concurrent-safe. Zero denies. It is not serialized authority; deployments reconstruct it by fetching again when loading their selected configuration. OIDC Registration 1.0 errata2 section5 does not require periodic refetch/expiry.

func (ValidatedSectorRegistration) MarshalJSON 

func (ValidatedSectorRegistration) MarshalJSON() ([]byte, error)

func (ValidatedSectorRegistration) MarshalText 

func (ValidatedSectorRegistration) MarshalText() ([]byte, error)

func (ValidatedSectorRegistration) SubjectRegistration 

func (v ValidatedSectorRegistration) SubjectRegistration() OIDCSubjectRegistration

SubjectRegistration returns comparable, storable policy identity, not proof of retrieval by itself. Config admission separately requires this provenance.

func (ValidatedSectorRegistration) ValidateClient 

func (v ValidatedSectorRegistration) ValidateClient(issuer Issuer, environment string, client Client) error

ValidateClient checks exact original registration ownership without IO or time renewal. Changed client version, URI, policy or redirect set requires refetch. It does not replace current account, grant, consent or revocation authority.

type VerifiedCompact 

type VerifiedCompact struct {
	// contains filtered or unexported fields
}

VerifiedCompact proves only the exact compact signature, not claim, issuance, session or current authorization semantics. Payload returns caller-owned bytes. Digest binds the original wire representation for durable issuance lookup.

func (VerifiedCompact) Digest 

func (v VerifiedCompact) Digest() [32]byte

func (VerifiedCompact) Format 

func (VerifiedCompact) Format(f fmt.State, _ rune)

func (VerifiedCompact) KeyID 

func (v VerifiedCompact) KeyID() string

func (VerifiedCompact) MarshalJSON 

func (VerifiedCompact) MarshalJSON() ([]byte, error)

func (VerifiedCompact) MarshalText 

func (VerifiedCompact) MarshalText() ([]byte, error)

func (VerifiedCompact) Payload 

func (v VerifiedCompact) Payload() []byte

func (VerifiedCompact) ReadStartedAt 

func (v VerifiedCompact) ReadStartedAt() time.Time

ReadStartedAt is the sealed original verification-key read start. It supplies no lease or current authorization; native consumers retain this earlier start instead of trusting a caller-constructed execution timestamp to renew time.

type Workload 

type Workload struct {
	// contains filtered or unexported fields
}

Workload is caller-owned startup policy for one confidential machine client. Tenant and service-account identity cannot come from token request data. The owning platform, scopes and sole resource belong to its enclosing Client. Nil selects the existing web profile; a nonnil zero value is invalid. No user, session, consent or customer delegation is created by this policy. Validation and service construction retain independent scalar snapshots; replacing a caller's whole value cannot change a constructed registration. Callers must not replace a value concurrently with reads or construction.

func NewWorkload 

func NewWorkload(tenant identity.TenantID, id string, accessTTL time.Duration) (*Workload, error)

NewWorkload constructs one exact tenant/service-account binding and a 1s..5min microsecond-aligned access ceiling. Config.AccessTTL may impose a smaller issuer ceiling. RFC6749 section4.4 permits only confidential, prearranged authority; this binding never authorizes a caller-selected human or tenant. Construction performs no IO or registration. Returned policy supports shared concurrent reads, but whole-value replacement must not race those reads. Validated clients and constructed services do not retain this mutable pointer.

func (*Workload) AccessTTL 

func (w *Workload) AccessTTL() time.Duration

AccessTTL returns the original configured ceiling. Nil returns zero.

func (*Workload) Format 

func (*Workload) Format(s fmt.State, _ rune)

Format redacts correlated tenant/workload configuration for all fmt verbs.

func (*Workload) ID 

func (w *Workload) ID() string

ID returns the configured service-account identity, never a human user ID. Nil returns empty and grants no authority.

func (*Workload) MarshalJSON 

func (*Workload) MarshalJSON() ([]byte, error)

MarshalJSON denies implicit correlated policy export; use explicit getters.

func (*Workload) MarshalText 

func (*Workload) MarshalText() ([]byte, error)

MarshalText denies implicit correlated policy export; use explicit getters.

func (*Workload) TenantID 

func (w *Workload) TenantID() identity.TenantID

TenantID returns the trusted isolation binding, not a request-selected account. Nil returns empty and grants no authority.

type WorkloadExchangePolicy 

type WorkloadExchangePolicy struct {
	MaximumDepth     uint8
	ClockUncertainty time.Duration
}

WorkloadExchangePolicy explicitly selects the finite issuer-owned opaque workload-access RFC8693 profile. It enables no human, API-key, organization, actor-token or private session exchange. Original and delegated tokens remain usable only by their owning Basic client at its one configured resource. MaximumDepth zero means four; explicit values may only lower that ceiling. ClockUncertainty is a trusted deployment upper bound, not a measured clock correction; with MaximumDuration it must fit the profile's ten-second budget. The native adapter always reads primary owners and never serves stale evidence.

Source Files

View all Source files

Directories

Path Synopsis
device module
oidc module
postgres module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.