auth

Documentation

Index

• Variables
• func IsTokenExpired(cfg DeviceFlowConfig, store Store) bool
• func RefreshToken(cfg DeviceFlowConfig, store Store, refreshToken string) (string, error)
• func RunDeviceFlow(cfg DeviceFlowConfig, store Store) (string, error)
• func TryRefresh(cfg DeviceFlowConfig, store Store) (string, error)
• type DeviceFlowConfig
• type MemStore
  • func NewMemStore() *MemStore
  • func (m *MemStore) Delete(providerName string) error
  • func (m *MemStore) Get(providerName string) (string, error)
  • func (m *MemStore) Set(providerName string, secret string) error
• type Store
  • func NewStore() Store

Variables

var ErrNotFound = errors.New("credential not found")

ErrNotFound is returned when a credential does not exist.

Functions

func IsTokenExpired

func IsTokenExpired(cfg DeviceFlowConfig, store Store) bool

IsTokenExpired checks if the OAuth token for the given client ID has expired (or will expire within the next 60 seconds). Returns false if no expiry is stored.

func RefreshToken

func RefreshToken(cfg DeviceFlowConfig, store Store, refreshToken string) (string, error)

RefreshToken exchanges a refresh token for a new access token and persists the result in the store.

func RunDeviceFlow

func RunDeviceFlow(cfg DeviceFlowConfig, store Store) (string, error)

RunDeviceFlow executes the OAuth 2.0 device authorization grant flow. It prints a verification URL and user code, then polls until the user authorizes the application (or the flow times out). On success the access token is persisted via the provided Store and returned.

func TryRefresh

func TryRefresh(cfg DeviceFlowConfig, store Store) (string, error)

TryRefresh attempts to refresh the OAuth token if a refresh token exists. Returns the new access token, or an error if refresh is not possible.

Types

type DeviceFlowConfig

type DeviceFlowConfig struct {
	ClientID      string
	TokenURL      string
	DeviceAuthURL string
	Scopes        []string
}

DeviceFlowConfig holds the parameters for an OAuth 2.0 device authorization flow.

type MemStore

type MemStore struct {
	// contains filtered or unexported fields
}

MemStore is an in-memory credential store useful for testing and ephemeral operations like the CLI wizard's connection test.

func NewMemStore

func NewMemStore() *MemStore

NewMemStore creates a new in-memory credential store.

func (*MemStore) Delete

func (m *MemStore) Delete(providerName string) error

func (*MemStore) Get

func (m *MemStore) Get(providerName string) (string, error)

func (*MemStore) Set

func (m *MemStore) Set(providerName string, secret string) error

type Store

type Store interface {
	// Get retrieves a secret for the given provider name.
	Get(providerName string) (string, error)
	// Set stores a secret for the given provider name.
	Set(providerName string, secret string) error
	// Delete removes the secret for the given provider name.
	Delete(providerName string) error
}

Store is the interface for credential storage backends.

func NewStore

func NewStore() Store

NewStore returns a keyring-backed store. If the system keyring is unavailable it falls back to a file-backed store that persists AES-256-GCM encrypted credentials to ~/.config/polycode/credentials.json.