auth

Documentation

Overview

Package auth handles authentication token storage and retrieval.

Index

• Variables
• func AuthorizeURL(supabaseURL, challenge, redirectTo, provider string) string
• func GenerateChallenge(verifier string) string
• func GenerateVerifier() (string, error)
• func GetToken() (string, error)
• func SaveCachedAuth(cfg *Config) error
• type CallbackServer
  • func NewCallbackServer(port int) (*CallbackServer, error)
  • func (cs *CallbackServer) RedirectURI() string
  • func (cs *CallbackServer) WaitForCode(ctx context.Context) (string, error)
• type Config
  • func Fetch(ctx context.Context, apiURL string) (*Config, error)
• type PKCEResult
  • func ExchangeCode(supabaseURL, supabaseAnonKey, code, verifier string) (*PKCEResult, error)
  • func RefreshAccessToken(supabaseURL, supabaseAnonKey, refreshToken string) (*PKCEResult, error)
• type ResolveResult
  • func Resolve(ctx context.Context, apiURL string) ResolveResult
• type ResolveSource
• type Storage
  • func NewStorage() *Storage
  • func (s *Storage) Delete() error
  • func (s *Storage) Load() (*Tokens, error)
  • func (s *Storage) Save(tokens *Tokens) error
  • func (s *Storage) SetFilePath(path string)
• type Tokens

Variables

var ErrPartialOverride = errors.New("--supabase-url and --supabase-anon-key (or WESIDE_SUPABASE_URL/WESIDE_SUPABASE_ANON_KEY) must be set together")

ErrPartialOverride is returned by overrideConfig (via Resolve.FetchError) when only one of supabase_url / supabase_anon_key is set. Exported so cmd/auth.go can errors.Is-match against it and print an unconditional warning to stderr — partial overrides always indicate a misconfiguration and must not silently mix a user-supplied URL with the prod-default key.

Functions

func AuthorizeURL

func AuthorizeURL(supabaseURL, challenge, redirectTo, provider string) string

AuthorizeURL builds the Supabase social login authorization URL (PKCE flow). supabaseURL comes from the resolved Config — never hardcoded here.

func GenerateChallenge

func GenerateChallenge(verifier string) string

GenerateChallenge creates the PKCE code challenge from a verifier.

func GenerateVerifier

func GenerateVerifier() (string, error)

GenerateVerifier creates a cryptographically random PKCE code verifier.

func GetToken

func GetToken() (string, error)

GetToken returns the current access token or an error if not logged in.

func SaveCachedAuth

func SaveCachedAuth(cfg *Config) error

SaveCachedAuth persists cfg to ~/.weside/config.yaml under the `auth.*` block. Sets FetchedAt to now (UTC, RFC3339) if empty. Used by Resolve on a successful live fetch and by `weside config refresh-auth`.

Routes through config.PersistUpdates rather than viper.WriteConfigAs so that flag values from the current invocation (--api-url, --supabase-url, …) are not silently persisted alongside the auth cache.

Types

type CallbackServer

type CallbackServer struct {
	// contains filtered or unexported fields
}

CallbackServer handles the OAuth callback on localhost.

func NewCallbackServer

func NewCallbackServer(port int) (*CallbackServer, error)

NewCallbackServer creates and starts a localhost HTTP server for OAuth callbacks on the given port (must match a Supabase-whitelisted redirect URL).

func (*CallbackServer) RedirectURI

func (cs *CallbackServer) RedirectURI() string

RedirectURI returns the callback URL to use in the authorization request.

func (*CallbackServer) WaitForCode

func (cs *CallbackServer) WaitForCode(ctx context.Context) (string, error)

WaitForCode blocks until an authorization code is received or the context expires.

type Config

type Config struct {
	SupabaseURL     string `json:"supabase_url"     mapstructure:"supabase_url"`
	SupabaseAnonKey string `json:"supabase_anon_key" mapstructure:"supabase_anon_key"`
	CallbackPort    int    `json:"callback_port"    mapstructure:"callback_port"`
	MCPURL          string `json:"mcp_url"          mapstructure:"mcp_url"`
	FetchedAt       string `json:"fetched_at,omitempty" mapstructure:"fetched_at,omitempty"`
}

Config holds the backend-derived auth/discovery values used during PKCE login.

Source of truth at runtime is the resolver (Resolve / Fetch); the hardcoded constants in this file are last-resort fallbacks for offline first-runs.

func Fetch

func Fetch(ctx context.Context, apiURL string) (*Config, error)

Fetch performs a single live GET against `<apiURL>/.well-known/weside-auth`. Returns an error on transport failure, non-2xx response, malformed JSON, or missing required fields. Used by Resolve and by `weside config refresh-auth`.

type PKCEResult

type PKCEResult struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int    `json:"expires_in"`
	TokenType    string `json:"token_type"`
}

PKCEResult contains the tokens from a successful PKCE flow.

func ExchangeCode

func ExchangeCode(supabaseURL, supabaseAnonKey, code, verifier string) (*PKCEResult, error)

ExchangeCode exchanges an authorization code for tokens via PKCE. supabaseURL + supabaseAnonKey come from the resolved Config.

func RefreshAccessToken

func RefreshAccessToken(supabaseURL, supabaseAnonKey, refreshToken string) (*PKCEResult, error)

RefreshAccessToken uses a refresh token to get a new access token. supabaseURL + supabaseAnonKey come from the resolved Config.

type ResolveResult

type ResolveResult struct {
	Config     *Config
	Source     ResolveSource
	FetchError error
}

ResolveResult bundles the resolved config with provenance metadata.

func Resolve

func Resolve(ctx context.Context, apiURL string) ResolveResult

Resolve picks a Config using a fixed precedence chain:

1. Override — `--supabase-url`/`--supabase-anon-key` flags or `WESIDE_SUPABASE_URL` / `WESIDE_SUPABASE_ANON_KEY` env vars.
2. Cache — `auth.*` block in ~/.weside/config.yaml (must be complete).
3. Live — single GET to `<apiURL>/.well-known/weside-auth` (5s timeout). On success the result is written back to the cache.
4. Fallback — hardcoded defaults in this file.

Resolve never returns nil — Source==SourceFallback indicates that the live fetch was attempted and failed; FetchError carries the underlying error so the caller can surface it under --verbose. A partial override (only one of supabase_url / supabase_anon_key set) is reported via FetchError on the fallback result so the caller can show the user a precise diagnosis.

type ResolveSource

type ResolveSource string

ResolveSource identifies which precedence level produced a Config.

const (
	SourceOverride ResolveSource = "override"
	SourceCache    ResolveSource = "cache"
	SourceLive     ResolveSource = "live"
	SourceFallback ResolveSource = "fallback"
)

Source labels for ResolveResult — see Resolve for the precedence chain.

type Storage

type Storage struct {
	// contains filtered or unexported fields
}

Storage handles token persistence.

func NewStorage

func NewStorage() *Storage

NewStorage creates a new token storage.

func (*Storage) Delete

func (s *Storage) Delete() error

Delete removes stored tokens.

func (*Storage) Load

func (s *Storage) Load() (*Tokens, error)

Load retrieves stored tokens.

func (*Storage) Save

func (s *Storage) Save(tokens *Tokens) error

Save stores tokens to the filesystem.

func (*Storage) SetFilePath

func (s *Storage) SetFilePath(path string)

SetFilePath overrides the storage file path (for testing).

type Tokens

type Tokens struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token,omitempty"`
}

Tokens holds the stored authentication tokens.