auth

Documentation

Index

• Constants
• type Credentials
  • func LoginOpenAI(ctx context.Context, opts LoginOptions) (Credentials, error)
  • func RefreshOpenAI(ctx context.Context, httpc *http.Client, refreshToken string) (Credentials, error)
  • func (c Credentials) Expired(skew time.Duration) bool
• type LoginOptions
• type Store
  • func DefaultStore() (*Store, error)
  • func NewStore(path string) *Store
  • func (s *Store) Delete(key string) error
  • func (s *Store) Get(key string) (Credentials, bool, error)
  • func (s *Store) Path() string
  • func (s *Store) Set(key string, creds Credentials) error
• type TokenSource
  • func NewTokenSource(store *Store, key string) *TokenSource
  • func (ts *TokenSource) Token(ctx context.Context) (Credentials, error)

Constants

const ProviderOpenAICodex = "openai-codex"

ProviderOpenAICodex is the auth.json key under which ChatGPT/Codex subscription credentials are stored.

Types

type Credentials

type Credentials struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	ExpiresAt    time.Time `json:"expires_at"`
	AccountID    string    `json:"account_id"`
}

Credentials is a stored token set for one provider.

func LoginOpenAI

func LoginOpenAI(ctx context.Context, opts LoginOptions) (Credentials, error)

LoginOpenAI runs the Codex device-code flow against auth.openai.com and returns the resulting credentials. It blocks until the browser approval is completed, ctx is cancelled, or the timeout elapses.

func RefreshOpenAI

func RefreshOpenAI(ctx context.Context, httpc *http.Client, refreshToken string) (Credentials, error)

RefreshOpenAI exchanges a refresh token for a fresh credential set.

func (Credentials) Expired

func (c Credentials) Expired(skew time.Duration) bool

Expired reports whether the access token is past its expiry, treating tokens within skew of expiry as already expired so callers refresh proactively.

type LoginOptions

type LoginOptions struct {
	// OnDeviceCode is invoked once with the URL and code the user must enter in
	// a browser to authorize.
	OnDeviceCode func(verificationURL, userCode string)
	// HTTPClient overrides the client used for token exchange (tests).
	HTTPClient *http.Client
	// Timeout bounds the wait for device-code approval (default 15 minutes).
	Timeout time.Duration
}

LoginOptions configures the interactive OpenAI login flow.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store persists subscription credentials to a JSON file (default ~/.neo/auth.json), keyed by provider id. The file holds bearer/refresh tokens, so it is written with 0600 permissions. Each mutation does a read-modify-write with an atomic rename; there is no cross-process lock, which is sufficient for a single interactive CLI.

func DefaultStore

func DefaultStore() (*Store, error)

DefaultStore returns the Store at ~/.neo/auth.json.

func NewStore

func NewStore(path string) *Store

NewStore returns a Store backed by path.

func (*Store) Delete

func (s *Store) Delete(key string) error

Delete removes the entry for key. Removing a missing key is not an error.

func (*Store) Get

func (s *Store) Get(key string) (Credentials, bool, error)

Get returns the credentials stored for key, and whether they were present.

func (*Store) Path

func (s *Store) Path() string

Path is the file backing this store.

func (*Store) Set

func (s *Store) Set(key string, creds Credentials) error

Set stores creds under key, replacing any existing entry.

type TokenSource

type TokenSource struct {
	// contains filtered or unexported fields
}

TokenSource yields a valid OpenAI subscription access token, refreshing and persisting it through the Store when it nears expiry. It is safe for concurrent use.

func NewTokenSource

func NewTokenSource(store *Store, key string) *TokenSource

NewTokenSource builds a TokenSource for the given provider key.

func (*TokenSource) Token

func (ts *TokenSource) Token(ctx context.Context) (Credentials, error)

Token returns current, non-expired credentials, refreshing if needed. It returns an error if no credentials are stored (the user must log in).