googleauth

package
v0.36.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: MIT Imports: 30 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func APIServiceIDsForServices 

func APIServiceIDsForServices(services []Service) ([]string, error)

func Authorize 

func Authorize(ctx context.Context, opts AuthorizeOptions) (string, error)

func CheckRefreshToken 

func CheckRefreshToken(ctx context.Context, client string, refreshToken string, scopes []string, timeout time.Duration) error

func DeleteStoredEmailAlias 

func DeleteStoredEmailAlias(store secrets.Store, client string, email string) error

func FindStoredSubjectIdentityEmail 

func FindStoredSubjectIdentityEmail(store secrets.Store, client string, identity Identity) (string, error)

func IdentityScopes 

func IdentityScopes() []string

func MigrateStoredEmailReferences 

func MigrateStoredEmailReferences(store secrets.Store, updater EmailReferenceUpdater, client string, oldEmail string, newEmail string) error

func MigrateStoredSubjectIdentity 

func MigrateStoredSubjectIdentity(store secrets.Store, updater EmailReferenceUpdater, client string, identity Identity) (string, error)

func Reauth added in v0.36.0 

func Reauth(ctx context.Context, opts ReauthOptions) (secrets.Token, error)

Reauth performs an automatic re-authorization when the stored refresh token is expired or revoked (invalid_grant). It launches a browser-based OAuth flow using the same client, services, and scopes as the original authorization and returns replacement token metadata to the caller. The token-source owner is responsible for persistence and the in-memory swap.

It returns replacement token metadata so the caller can persist it and update any in-memory token source that still holds the revoked token.

This is the auto-reauth counterpart to `gog auth add`, designed to be called from the retry transport when an invalid_grant error is detected during an API call.

func Scopes 

func Scopes(service Service) ([]string, error)

func ScopesForManage 

func ScopesForManage(services []Service) ([]string, error)

func ScopesForManageWithOptions 

func ScopesForManageWithOptions(services []Service, opts ScopeOptions) ([]string, error)

func ScopesForServices 

func ScopesForServices(services []Service) ([]string, error)

func ServicesMarkdown 

func ServicesMarkdown(infos []ServiceInfo) string

func UserServiceCSV 

func UserServiceCSV() string

Types

type AccountInfo 

type AccountInfo struct {
	Email     string   `json:"email"`
	Services  []string `json:"services"`
	IsDefault bool     `json:"isDefault"`
}

AccountInfo represents an account for the UI

type AuthorizeOptions 

type AuthorizeOptions struct {
	Services                    []Service
	Scopes                      []string
	Manual                      bool
	ForceConsent                bool
	DisableIncludeGrantedScopes bool
	Timeout                     time.Duration
	Client                      string
	AuthCode                    string
	AuthURL                     string
	ListenAddr                  string
	RedirectURI                 string
	RequireState                bool
	ManualStateStore            *ManualStateStore
}

type DriveScopeMode 

type DriveScopeMode string
const (
	DriveScopeFull     DriveScopeMode = "full"
	DriveScopeReadonly DriveScopeMode = "readonly"
	DriveScopeFile     DriveScopeMode = "file"
)

type EmailReferenceUpdater 

type EmailReferenceUpdater func(oldEmail, newEmail string) error

type FetchIdentityFunc 

type FetchIdentityFunc func(context.Context, *oauth2.Token) (Identity, error)

type GmailScopeMode 

type GmailScopeMode string
const (
	GmailScopeFull     GmailScopeMode = "full"
	GmailScopeReadonly GmailScopeMode = "readonly"
)

type Identity 

type Identity struct {
	Subject string `json:"subject,omitempty"`
	Email   string `json:"email"`
}

func FetchUserIdentity 

func FetchUserIdentity(ctx context.Context, tok *oauth2.Token) (Identity, error)

FetchUserIdentity resolves an OAuth token to a stable Google identity.

func IdentityForRefreshToken 

func IdentityForRefreshToken(ctx context.Context, client string, refreshToken string, scopes []string, timeout time.Duration) (Identity, error)

IdentityForRefreshToken exchanges a refresh token and returns the authorized Google account identity. Subject is Google's stable OIDC sub claim when available; Email is the display/contact address.

func IdentityFromIDToken 

func IdentityFromIDToken(idToken string) (Identity, error)

type ManageServerOptions 

type ManageServerOptions struct {
	Timeout      time.Duration
	Services     []Service
	ForceConsent bool
	Client       string
	ListenAddr   string
	RedirectURI  string
}

ManageServerOptions configures the accounts management server.

type ManagerApplication 

type ManagerApplication struct {
	// contains filtered or unexported fields
}

ManagerApplication handles the accounts management UI.

func NewManagerApplication 

func NewManagerApplication(opts ManagerOptions, deps ManagerDependencies) (*ManagerApplication, error)

NewManagerApplication builds the accounts manager HTTP application.

func (*ManagerApplication) Handler 

func (app *ManagerApplication) Handler() http.Handler

Handler returns the accounts manager HTTP handler.

type ManagerDependencies 

type ManagerDependencies struct {
	Tokens                secrets.Store
	ReadCredentials       func(client string) (config.ClientCredentials, error)
	UpdateEmailReferences EmailReferenceUpdater
	FetchIdentity         FetchIdentityFunc
	EnsureKeychainAccess  func(context.Context) error
	Random                io.Reader
	OAuthEndpoint         oauth2.Endpoint
}

ManagerDependencies contains the accounts manager's external operations.

type ManagerLauncher 

type ManagerLauncher struct {
	// contains filtered or unexported fields
}

ManagerLauncher owns the loopback listener and browser lifecycle.

func NewManagerLauncher 

func NewManagerLauncher(deps ManagerLauncherDependencies) (*ManagerLauncher, error)

NewManagerLauncher validates and captures launcher dependencies.

func (*ManagerLauncher) Start 

func (launcher *ManagerLauncher) Start(ctx context.Context, opts ManageServerOptions) error

Start starts the accounts manager and waits for timeout or cancellation.

type ManagerLauncherDependencies 

type ManagerLauncherDependencies struct {
	OpenTokens            func(context.Context) (secrets.Store, error)
	ReadCredentials       func(context.Context, string) (config.ClientCredentials, error)
	UpdateEmailReferences func(context.Context, string, string) error
	FetchIdentity         FetchIdentityFunc
	EnsureKeychainAccess  func(context.Context) error
	OpenBrowser           func(context.Context, string) error
	Out                   io.Writer
	Listen                ManagerListenFunc
	Random                io.Reader
	OAuthEndpoint         oauth2.Endpoint
}

ManagerLauncherDependencies contains loopback server and application dependencies.

type ManagerListenFunc 

type ManagerListenFunc func(context.Context, string, string) (net.Listener, error)

type ManagerOptions 

type ManagerOptions struct {
	Services     []Service
	ForceConsent bool
	Client       string
	RedirectURI  string
}

ManagerOptions configures the accounts manager application.

type ManualAuthURLResult 

type ManualAuthURLResult struct {
	URL         string
	StateReused bool
}

func ManualAuthURL 

func ManualAuthURL(ctx context.Context, opts AuthorizeOptions) (ManualAuthURLResult, error)

type ManualStateStore 

type ManualStateStore struct {
	// contains filtered or unexported fields
}

func NewManualStateStore 

func NewManualStateStore(layout config.Layout) (*ManualStateStore, error)

func (*ManualStateStore) Dir 

func (s *ManualStateStore) Dir() string

type ReauthOptions added in v0.36.0 

type ReauthOptions struct {
	Email    string
	Client   string
	Services []string
	Scopes   []string
	// StoredToken, if non-nil, provides the full scope/service set from the
	// original authorization. When present, its Scopes and Services are used
	// for the re-authorization instead of the triggering request's narrower
	// scopes, preventing silent grant narrowing.
	StoredToken *secrets.Token
	// EnsureKeychainAccess ensures the keychain is accessible for writes.
	// May be nil if keychain access is not needed (e.g. file backend).
	EnsureKeychainAccess func(context.Context) error
	// AuthorizeFunc performs the OAuth authorization flow. If nil,
	// googleauth.Authorize is used.
	AuthorizeFunc func(context.Context, AuthorizeOptions) (string, error)
	// FetchIdentityFunc fetches the authorized identity. If nil,
	// googleauth.IdentityForRefreshToken is used.
	FetchIdentityFunc func(context.Context, string, string, []string, time.Duration) (Identity, error)
	// Confirm obtains explicit user consent before opening a browser. Auto-
	// reauthorization fails closed when no confirmation callback is provided.
	Confirm func(context.Context, string) (bool, error)
	// Timeout for the browser flow. If zero, defaults to 2 minutes.
	Timeout time.Duration
	// Stderr is where progress messages are written. If nil, os.Stderr is used.
	Stderr interface {
		Write([]byte) (int, error)
	}
}

ReauthOptions configures an automatic re-authorization flow triggered when the stored refresh token is expired or revoked.

type ScopeOptions 

type ScopeOptions struct {
	Readonly    bool
	DriveScope  DriveScopeMode
	GmailScope  GmailScopeMode
	ExtraScopes []string
}

type Service 

type Service string
const (
	ServiceGmail         Service = "gmail"
	ServiceCalendar      Service = "calendar"
	ServiceChat          Service = "chat"
	ServiceClassroom     Service = "classroom"
	ServiceDrive         Service = "drive"
	ServiceDriveActivity Service = "driveactivity"
	ServiceDriveLabels   Service = "drivelabels"
	ServiceDocs          Service = "docs"
	ServiceSlides        Service = "slides"
	ServiceContacts      Service = "contacts"
	ServiceTasks         Service = "tasks"
	ServicePeople        Service = "people"
	ServiceSheets        Service = "sheets"
	ServiceForms         Service = "forms"
	ServiceSites         Service = "sites"
	ServiceMeet          Service = "meet"
	ServiceAppScript     Service = "appscript"
	ServiceAnalytics     Service = "analytics"
	ServiceSearchConsole Service = "searchconsole"
	ServiceAds           Service = "ads"
	ServiceGroups        Service = "groups"
	ServiceKeep          Service = "keep"
	ServiceAdmin         Service = "admin"
	ServiceYouTube       Service = "youtube"
	ServicePhotos        Service = "photos"
	ServicePhotosPicker  Service = "photospicker"
)

func AllServices 

func AllServices() []Service

func ParseService 

func ParseService(s string) (Service, error)

func UserServices 

func UserServices() []Service

UserServices are the default OAuth services intended for consumer ("regular") accounts.

type ServiceInfo 

type ServiceInfo struct {
	Service Service  `json:"service"`
	User    bool     `json:"user"`
	Scopes  []string `json:"scopes"`
	APIs    []string `json:"apis,omitempty"`
	Note    string   `json:"note,omitempty"`
}

func ServicesInfo 

func ServicesInfo() []ServiceInfo

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.