auth

Documentation

Overview

Package auth manages slk credentials: profiles, token resolution, OAuth.

Index

• func ConfigPath() (string, error)
• func EncryptionInfo(cfg *Config) (backend, status string)
• func EncryptionStatus(cfg *Config) string
• func IsEncrypted(v string) bool
• func ResolveToken(cfg *Config, profileName, assertScope, envToken string) (string, error)
• func Save(path string, cfg *Config) error
• func TokenScope(token string) string
• func WaitForCode(addr, callbackPath string) (string, error)
• type AuthError
  • func (e *AuthError) Error() string
  • func (e *AuthError) ExitCode() int
• type Config
  • func Load(path string) (*Config, error)
• type Profile
• type TokenPair
  • func ExchangeCode(baseURL, clientID, clientSecret, code, redirectURI string) (TokenPair, error)

Functions

func ConfigPath

func ConfigPath() (string, error)

ConfigPath returns the config path, honoring the SLK_CONFIG env override.

func EncryptionInfo

func EncryptionInfo(cfg *Config) (backend, status string)

EncryptionInfo returns the at-rest encryption backend and status for `slk auth status --format json`. backend is the key backend ("file"/"keyring") or "none" for legacy plaintext; status is "ok", "key_unavailable", or "none". It never includes any token, secret, or key material.

func EncryptionStatus

func EncryptionStatus(cfg *Config) string

EncryptionStatus returns a single non-secret line describing at-rest encryption for display by `slk auth status`. It never includes any token, secret, or key material.

func IsEncrypted

func IsEncrypted(v string) bool

IsEncrypted reports whether v is still an slk-encrypted (ciphertext) value. Exposed for callers that must skip an unusable token Load could not decrypt (key unavailable), e.g. `auth status`.

func ResolveToken

func ResolveToken(cfg *Config, profileName, assertScope, envToken string) (string, error)

ResolveToken picks the active token. Precedence: envToken, then the named profile (or cfg.Active if profileName is empty). assertScope, when non-empty ("user"|"bot"), requires the resolved token's derived scope to match; a known mismatch is an *AuthError. An unknown prefix does not fail the assertion.

func Save

func Save(path string, cfg *Config) error

Save encrypts the sensitive fields of every profile and writes the config atomically with 0600 permissions. The caller's cfg is not mutated.

func TokenScope

func TokenScope(token string) string

TokenScope derives the Slack identity scope from a token's prefix: "user" for xoxp-, "bot" for xoxb-, "" for any other prefix (slk supports only these two). The token must be decrypted plaintext; a still-encrypted value (IsEncrypted) has no readable prefix and yields "".

func WaitForCode

func WaitForCode(addr, callbackPath string) (string, error)

WaitForCode starts a local HTTP server on addr, returns the first OAuth "code" query parameter it receives, then shuts down. Times out after 5 min.

Types

type AuthError

type AuthError struct {
	Reason string
}

AuthError is a credential-resolution failure. It carries exit code 3.

func (*AuthError) Error

func (e *AuthError) Error() string

func (*AuthError) ExitCode

func (e *AuthError) ExitCode() int

ExitCode returns the process exit code for an auth error.

type Config

type Config struct {
	Active     string             `toml:"active"`
	KeyBackend string             `toml:"key_backend,omitempty"`
	Profiles   map[string]Profile `toml:"profiles"`
}

Config is the on-disk slk configuration. KeyBackend records which backend holds the encryption key ("file" or "keyring") so reads are deterministic.

func Load

func Load(path string) (*Config, error)

Load reads the config; a missing file yields an empty Config and no error. Encrypted (enc:v1:) fields are decrypted into memory best-effort: a field that cannot be decrypted (key unavailable / bad ciphertext) is left as ciphertext and ResolveToken reports it. Plaintext fields are passed through unchanged so they still resolve; they are encrypted only when something next calls Save. Load never writes to disk.

type Profile

type Profile struct {
	Token string `toml:"token,omitempty"`
}

Profile holds the credential for one Slack identity. The token is stored encrypted at rest (see crypto.go); it is plaintext in memory after Load and re-encrypted by Save. Scope (user/bot) is derived from the prefix (TokenScope), never stored. slk does not persist the OAuth client id/secret.

type TokenPair

type TokenPair struct {
	UserToken string
	BotToken  string
}

TokenPair is the result of an OAuth exchange.

func ExchangeCode

func ExchangeCode(baseURL, clientID, clientSecret, code, redirectURI string) (TokenPair, error)

ExchangeCode trades an OAuth authorization code for tokens via oauth.v2.access. baseURL is normally https://slack.com/api (overridable for tests).