auth

Documentation

Overview

Package auth stores provider credentials without exposing secret values.

Index

• func AnthropicLoginURL() (string, error)
• type Credential
  • func LoginAnthropic(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)
  • func LoginAnthropicWithCode(ctx context.Context, authCode string) (*Credential, error)
  • func LoginOpenAICodex(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)
• type CredentialType
• type FileBackend
  • func NewFileBackend(path string) *FileBackend
  • func (backend *FileBackend) WithLock(ctx context.Context, callback func(current []byte) (LockResult, error)) error
• type LockResult
• type Locker
• type OAuthAuthInfo
• type Source
• type Status
• type Storage
  • func NewStorage(ctx context.Context, backend Locker) (*Storage, error)
  • func (storage *Storage) APIKey(provider string) (string, bool)
  • func (storage *Storage) APIKeyContext(ctx context.Context, provider string) (apiKey string, found bool, err error)
  • func (storage *Storage) AuthStatus(provider string) Status
  • func (storage *Storage) DrainErrors() []error
  • func (storage *Storage) Get(provider string) (Credential, bool)
  • func (storage *Storage) HasAuth(provider string) bool
  • func (storage *Storage) HasStored(provider string) bool
  • func (storage *Storage) List() []string
  • func (storage *Storage) Reload(ctx context.Context) error
  • func (storage *Storage) Remove(ctx context.Context, provider string) error
  • func (storage *Storage) RemoveRuntimeAPIKey(provider string)
  • func (storage *Storage) Set(ctx context.Context, provider string, credential *Credential) error
  • func (storage *Storage) SetFallbackResolver(resolver func(provider string) (string, bool))
  • func (storage *Storage) SetRuntimeAPIKey(provider, apiKey string)

Functions

func AnthropicLoginURL

func AnthropicLoginURL() (string, error)

AnthropicLoginURL creates the Claude Pro/Max OAuth URL.

Types

type Credential

type Credential struct {
	OAuth     map[string]string `json:"oauth,omitempty"`
	Type      CredentialType    `json:"type"`
	Key       string            `json:"key,omitempty"`
	Access    string            `json:"access,omitempty"`
	Refresh   string            `json:"refresh,omitempty"`
	AccountID string            `json:"account_id,omitempty"`
	Expires   int64             `json:"expires,omitempty"`
	ExpiresAt int64             `json:"expires_at,omitempty"`
}

Credential stores API-key or OAuth credentials.

Key may either be the literal API key or the name of an environment variable containing the key. OAuth token fields are kept in flat and map shapes for provider-specific OAuth flows.

func LoginAnthropic

func LoginAnthropic(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)

LoginAnthropic runs the Claude Pro/Max OAuth browser flow.

func LoginAnthropicWithCode

func LoginAnthropicWithCode(ctx context.Context, authCode string) (*Credential, error)

LoginAnthropicWithCode completes Claude Pro/Max OAuth using the pasted code from Claude.

func LoginOpenAICodex

func LoginOpenAICodex(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)

LoginOpenAICodex runs the ChatGPT/Codex OAuth browser flow.

type CredentialType

type CredentialType string

CredentialType identifies the stored credential kind.

const (
	// CredentialTypeAPIKey stores a provider API key.
	CredentialTypeAPIKey CredentialType = "api_key"
	// CredentialTypeOAuth stores OAuth token material.
	CredentialTypeOAuth CredentialType = "oauth"
)

type FileBackend

type FileBackend struct {
	// contains filtered or unexported fields
}

FileBackend stores credentials in auth.json with process-local locking and atomic writes.

func NewFileBackend

func NewFileBackend(path string) *FileBackend

NewFileBackend creates a file-backed auth storage backend.

func (*FileBackend) WithLock

func (backend *FileBackend) WithLock(ctx context.Context, callback func(current []byte) (LockResult, error)) error

WithLock serializes access to auth.json for this process.

type LockResult

type LockResult struct {
	Next  []byte
	Write bool
}

LockResult tells a backend whether to persist a new auth.json payload.

type Locker

type Locker interface {
	WithLock(ctx context.Context, callback func(current []byte) (LockResult, error)) error
}

Locker serializes access to credential bytes.

type OAuthAuthInfo

type OAuthAuthInfo struct {
	URL          string `json:"url"`
	Instructions string `json:"instructions,omitempty"`
}

OAuthAuthInfo describes a browser OAuth step.

type Source

type Source string

Source describes where a provider credential is configured.

const (
	// SourceStored comes from auth.json.
	SourceStored Source = "stored"
	// SourceRuntime comes from a process-only override.
	SourceRuntime Source = "runtime"
	// SourceEnvironment comes from an environment variable.
	SourceEnvironment Source = "environment"
	// SourceFallback comes from a caller-supplied resolver.
	SourceFallback Source = "fallback"
)

type Status

type Status struct {
	Source     Source `json:"source,omitempty"`
	Label      string `json:"label,omitempty"`
	Configured bool   `json:"configured"`
}

Status reports whether auth exists without revealing secrets.

type Storage

type Storage struct {
	// contains filtered or unexported fields
}

Storage provides librecode-style credential lookup with stored, runtime, env, and fallback sources.

Locking contract: lock protects credentials, runtimeOverrides, errors, loadError, and fallbackResolver. Do not call fallbackResolver or OAuth refreshers while holding lock; take an authSnapshot first and operate on the copied values.

func NewStorage

func NewStorage(ctx context.Context, backend Locker) (*Storage, error)

NewStorage creates credential storage over a backend and loads existing credentials.

func (*Storage) APIKey

func (storage *Storage) APIKey(provider string) (string, bool)

APIKey resolves provider API key using runtime, stored, environment, then fallback sources.

func (*Storage) APIKeyContext

func (storage *Storage) APIKeyContext(ctx context.Context, provider string) (apiKey string, found bool, err error)

APIKeyContext resolves provider API key and refreshes OAuth credentials when needed.

func (*Storage) AuthStatus

func (storage *Storage) AuthStatus(provider string) Status

AuthStatus reports credential availability without exposing values.

func (*Storage) DrainErrors

func (storage *Storage) DrainErrors() []error

DrainErrors returns accumulated non-secret storage errors and clears them.

func (*Storage) Get

func (storage *Storage) Get(provider string) (Credential, bool)

Get returns a stored credential only.

func (*Storage) HasAuth

func (storage *Storage) HasAuth(provider string) bool

HasAuth reports whether any source can provide auth for provider.

func (*Storage) HasStored

func (storage *Storage) HasStored(provider string) bool

HasStored reports whether auth.json contains a credential for provider.

func (*Storage) List

func (storage *Storage) List() []string

List returns providers with stored credentials.

func (*Storage) Reload

func (storage *Storage) Reload(ctx context.Context) error

Reload refreshes credentials from the backend.

func (*Storage) Remove

func (storage *Storage) Remove(ctx context.Context, provider string) error

Remove deletes a provider credential and persists the change.

func (*Storage) RemoveRuntimeAPIKey

func (storage *Storage) RemoveRuntimeAPIKey(provider string)

RemoveRuntimeAPIKey removes a process-only provider API key.

func (*Storage) Set

func (storage *Storage) Set(ctx context.Context, provider string, credential *Credential) error

Set stores a provider credential and persists it.

func (*Storage) SetFallbackResolver

func (storage *Storage) SetFallbackResolver(resolver func(provider string) (string, bool))

SetFallbackResolver configures a resolver for custom provider API keys.

func (*Storage) SetRuntimeAPIKey

func (storage *Storage) SetRuntimeAPIKey(provider, apiKey string)

SetRuntimeAPIKey sets a process-only provider API key.