auth

Documentation

Overview

Package auth implements GitHub OAuth device code flow authentication and Copilot API token management with automatic caching and refresh.

Index

• type AccessTokenResponse
• type Authenticator
  • func NewAuthenticator(tokenDir string) *Authenticator
  • func NewTestAuthenticator(token string) *Authenticator
  • func (a *Authenticator) GetToken(ctx context.Context) (string, error)
  • func (a *Authenticator) IsSignedIn() bool
  • func (a *Authenticator) PollForAuthorization(ctx context.Context, dcResp *DeviceCodeResponse) error
  • func (a *Authenticator) RequestDeviceCode(ctx context.Context) (*DeviceCodeResponse, error)
  • func (a *Authenticator) SignOut() error
• type CopilotTokenResponse
• type DeviceCodeResponse

Types

type AccessTokenResponse

type AccessTokenResponse struct {
	AccessToken      string `json:"access_token"`
	TokenType        string `json:"token_type"`
	Scope            string `json:"scope"`
	Error            string `json:"error,omitempty"`
	ErrorDescription string `json:"error_description,omitempty"`
}

AccessTokenResponse is the response from GitHub's OAuth access token endpoint.

type Authenticator

type Authenticator struct {

	// DisableAutoDeviceFlow prevents refreshToken from falling through to the
	// interactive device-code flow. When true, callers (e.g. the menubar app)
	// are expected to drive the flow themselves via RequestDeviceCode /
	// PollForAuthorization.
	DisableAutoDeviceFlow bool
	// contains filtered or unexported fields
}

Authenticator manages GitHub OAuth and Copilot API tokens. It handles the device code flow, token caching to disk, and automatic refresh using a read-write mutex for concurrent access.

func NewAuthenticator

func NewAuthenticator(tokenDir string) *Authenticator

NewAuthenticator creates an Authenticator that stores tokens in tokenDir. If tokenDir is empty, it defaults to ~/.config/copilot-proxy.

func NewTestAuthenticator

func NewTestAuthenticator(token string) *Authenticator

NewTestAuthenticator creates an Authenticator pre-loaded with a token for testing.

func (*Authenticator) GetToken

func (a *Authenticator) GetToken(ctx context.Context) (string, error)

GetToken returns a valid Copilot API token, refreshing it if necessary. It is safe for concurrent use.

func (*Authenticator) IsSignedIn

func (a *Authenticator) IsSignedIn() bool

IsSignedIn reports whether the authenticator has a GitHub access token either in memory or persisted on disk.

func (*Authenticator) PollForAuthorization

func (a *Authenticator) PollForAuthorization(ctx context.Context, dcResp *DeviceCodeResponse) error

PollForAuthorization polls GitHub until the user authorizes the device code, then saves the access token and exchanges it for a Copilot API token. It acquires the write lock internally.

func (*Authenticator) RequestDeviceCode

func (a *Authenticator) RequestDeviceCode(ctx context.Context) (*DeviceCodeResponse, error)

RequestDeviceCode initiates the GitHub device-code flow by requesting a device code and user code from GitHub. The caller should present the UserCode and VerificationURI to the user, then call PollForAuthorization. No lock is required — only immutable fields (client) are accessed.

func (*Authenticator) SignOut

func (a *Authenticator) SignOut() error

SignOut clears all authentication state from memory and removes persisted token files from disk. It is safe for concurrent use.

type CopilotTokenResponse

type CopilotTokenResponse struct {
	Token        string `json:"token"`
	ExpiresAt    int64  `json:"expires_at"`
	ErrorDetails string `json:"error_details,omitempty"`
}

CopilotTokenResponse is the response from the Copilot token exchange endpoint.

type DeviceCodeResponse

type DeviceCodeResponse struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`
	ExpiresIn       int    `json:"expires_in"`
	Interval        int    `json:"interval"`
}

DeviceCodeResponse is the response from GitHub's device code endpoint.