oauth

package
v0.0.79 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2026 License: GPL-3.0 Imports: 15 Imported by: 0

Documentation

Overview

Package oauth exposes provider OAuth material parsing and refresh helpers.

The package is storage-agnostic: callers own where auth material is stored and can use these helpers for files, Kubernetes Secrets, or other stores.

Index

Constants

View Source 
const (
	AuthJSONKey = "auth.json"

	OpenAIRefreshMaxAge    = 8 * 24 * time.Hour
	AnthropicRefreshLead   = 4 * time.Hour
	CopilotRefreshLead     = 5 * time.Minute
	AnthropicOAuthClientID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
	AnthropicOAuthTokenURL = "https://platform.claude.com/v1/oauth/token"
	AnthropicOAuthScope    = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload"
	CopilotTokenURL        = "https://api.github.com/copilot_internal/v2/token"
	CopilotDefaultBaseURL  = "https://api.individual.githubcopilot.com"
)
View Source 
const AnthropicTokenSourceLead = 2 * time.Minute

AnthropicTokenSourceLead is the in-process refresh window for AnthropicFileTokenSource. It is deliberately much shorter than AnthropicRefreshLead: when a central refresher (e.g. the platform operator) owns rotation, the mounted file is normally updated long before this window, so the in-process refresh only fires when central rotation failed or does not exist (standalone SDK use). Keeping the window small avoids racing the central refresher for the single-use refresh token.

Variables

This section is empty.

Functions

func AnthropicAccessToken 

func AnthropicAccessToken(authJSON []byte) (string, error)

func AnthropicNeedsRefresh 

func AnthropicNeedsRefresh(auth AnthropicAuth, now time.Time) bool

func CopilotAPIBaseURLFromToken added in v0.0.39 

func CopilotAPIBaseURLFromToken(token string) string

CopilotAPIBaseURLFromToken derives the API host encoded in a Copilot API token. GitHub returns semicolon-delimited metadata such as "proxy-ep=proxy.individual.githubcopilot.com"; Copilot clients convert that proxy host into the API host used for model requests.

func CopilotAPIToken 

func CopilotAPIToken(authJSON []byte) (string, error)

func CopilotNeedsRefresh 

func CopilotNeedsRefresh(auth CopilotAuth, now time.Time) bool

func IsTerminalRefreshError 

func IsTerminalRefreshError(err error) bool

IsTerminalRefreshError reports whether an error likely means the stored refresh material has been consumed or invalidated and needs user re-login.

func MarshalAnthropicAuthJSON 

func MarshalAnthropicAuthJSON(auth AnthropicAuth) ([]byte, error)

func MarshalCopilotAuthJSON 

func MarshalCopilotAuthJSON(auth CopilotAuth) ([]byte, error)

func OpenAINeedsRefresh 

func OpenAINeedsRefresh(authJSON []byte, now time.Time) (bool, error)

func RefreshAnthropicAuthJSON 

func RefreshAnthropicAuthJSON(ctx context.Context, authJSON []byte, cfg RefreshConfig) ([]byte, bool, error)

RefreshAnthropicAuthJSON refreshes serialized Anthropic OAuth material when it is near expiry and returns the resulting auth JSON plus whether it changed.

func RefreshAnthropicTokens 

func RefreshAnthropicTokens(ctx context.Context, auth AnthropicAuth, cfg RefreshConfig) ([]byte, error)

RefreshAnthropicTokens exchanges an Anthropic OAuth refresh token and returns serialized flat auth JSON containing the updated access token.

func RefreshCopilotAuthJSON 

func RefreshCopilotAuthJSON(ctx context.Context, authJSON []byte, cfg RefreshConfig) ([]byte, bool, error)

RefreshCopilotAuthJSON refreshes serialized Copilot OAuth material when the Copilot API token is missing or near expiry.

func RefreshCopilotToken 

func RefreshCopilotToken(ctx context.Context, auth CopilotAuth, cfg RefreshConfig) ([]byte, error)

RefreshCopilotToken exchanges a GitHub OAuth token for a Copilot API token and returns serialized flat auth JSON.

func RefreshOpenAIAuthJSON 

func RefreshOpenAIAuthJSON(ctx context.Context, authJSON []byte, accountID string, cfg RefreshConfig) ([]byte, bool, error)

RefreshOpenAIAuthJSON refreshes serialized OpenAI OAuth material when it is stale and returns the resulting auth JSON plus whether it changed.

func SanitizeLogBody 

func SanitizeLogBody(body string) string

SanitizeLogBody redacts token-like and secret-like JSON fields before logging provider OAuth error bodies.

Types

type AnthropicAuth 

type AnthropicAuth struct {
	AccessToken  string
	RefreshToken string
	Email        string
	AccountUUID  string
	ExpiresAt    time.Time
	LastRefresh  time.Time
}

func ParseAnthropicAuthJSON 

func ParseAnthropicAuthJSON(data []byte) (AnthropicAuth, error)

ParseAnthropicAuthJSON accepts both auth2api's flat token file shape and Claude Code's .credentials.json shape under claudeAiOauth.

type AnthropicFileTokenSource added in v0.0.46 

type AnthropicFileTokenSource struct {
	// contains filtered or unexported fields
}

AnthropicFileTokenSource resolves Anthropic OAuth access tokens per request from an auth JSON file (Claude Code .credentials.json or the SDK's flat shape). It re-reads the file when it changes — picking up tokens rotated by an external refresher, such as a Kubernetes Secret mount — and, as a last resort, self-refreshes near expiry using the refresh token, writing the result back best-effort (read-only mounts keep the refreshed token in memory only).

It implements the anthropic client's TokenSource contract: Token(ctx) (string, error) and Invalidate().

func NewAnthropicFileTokenSource added in v0.0.46 

func NewAnthropicFileTokenSource(path string, cfg RefreshConfig) *AnthropicFileTokenSource

NewAnthropicFileTokenSource creates a token source backed by the auth JSON file at path. cfg controls the refresh HTTP client and endpoint overrides; zero values use the production Anthropic OAuth defaults.

func (*AnthropicFileTokenSource) Invalidate added in v0.0.46 

func (s *AnthropicFileTokenSource) Invalidate()

Invalidate marks the current access token as rejected so the next Token call re-reads the file and refreshes if the file still holds the same credential. Called by the API client after a 401.

func (*AnthropicFileTokenSource) Token added in v0.0.46 

func (s *AnthropicFileTokenSource) Token(ctx context.Context) (string, error)

Token returns a current access token, re-reading the backing file when it changed and refreshing via the OAuth token endpoint when the token is missing, rejected, or near expiry.

func (*AnthropicFileTokenSource) WithRefreshLead added in v0.0.46 

func (s *AnthropicFileTokenSource) WithRefreshLead(lead time.Duration) *AnthropicFileTokenSource

WithRefreshLead overrides the near-expiry window that triggers an in-process refresh. Returns the receiver for chaining.

type CopilotAuth 

type CopilotAuth struct {
	OAuthToken  string
	Token       string
	ExpiresAt   time.Time
	LastRefresh time.Time
}

func ParseCopilotAuthJSON 

func ParseCopilotAuthJSON(data []byte) (CopilotAuth, error)

ParseCopilotAuthJSON accepts the SDK-managed flat shape as well as GitHub Copilot's host-keyed apps.json/hosts.json shape.

type CopilotTokenSource added in v0.0.43 

type CopilotTokenSource struct {
	// contains filtered or unexported fields
}

CopilotTokenSource yields a valid Copilot API token on demand. GitHub mints Copilot API tokens with a short (~25–30 minute) lifetime; this source re-exchanges the long-lived GitHub OAuth token for a fresh API token when the current one is missing or near expiry, so long-running processes never serve requests with an expired token.

func NewCopilotTokenSource added in v0.0.43 

func NewCopilotTokenSource(cfg CopilotTokenSourceConfig) *CopilotTokenSource

NewCopilotTokenSource creates a CopilotTokenSource.

func (*CopilotTokenSource) CurrentToken added in v0.0.43 

func (s *CopilotTokenSource) CurrentToken() string

CurrentToken returns the current API token without triggering a refresh, re-reading AuthPath first when configured. It may be empty or expired.

func (*CopilotTokenSource) Token added in v0.0.43 

func (s *CopilotTokenSource) Token(ctx context.Context) (string, error)

Token returns a Copilot API token that is valid now, refreshing it first when it is missing or inside the refresh lead window. When a refresh fails but the current token has not expired yet, the current token is returned so transient exchange failures don't take down in-flight work.

type CopilotTokenSourceConfig added in v0.0.43 

type CopilotTokenSourceConfig struct {
	// Auth seeds the in-memory material. Optional when AuthPath is set.
	Auth CopilotAuth
	// AuthPath, when set, points at serialized Copilot auth JSON (flat SDK
	// shape or GitHub hosts.json shape) that is re-read on demand so external
	// rotations (e.g. a refreshed Kubernetes Secret mount or a re-login) are
	// picked up without restarting the process.
	AuthPath string
	// Refresh configures the token-exchange requests.
	Refresh RefreshConfig
}

CopilotTokenSourceConfig configures a CopilotTokenSource.

type RefreshConfig 

type RefreshConfig struct {
	HTTPClient *http.Client
	Now        func() time.Time

	OpenAIClientID      string
	OpenAITokenEndpoint string

	AnthropicClientID string
	AnthropicTokenURL string
	AnthropicScope    string

	CopilotTokenURL            string
	CopilotEditorVersion       string
	CopilotEditorPluginVersion string
	CopilotUserAgent           string
	CopilotAuthorizationScheme string
	ResponseBodyByteLimit      int64
}

RefreshConfig configures provider OAuth refresh requests.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.