Documentation
¶
Index ¶
- Constants
- Variables
- func Identity(instance, user string) string
- func MatchGitInstance(request GitRequest, hosts map[string]settings.Host, ...) (string, error)
- type Credential
- type GitRequest
- type HTTPSign
- type HostOptions
- type Keyring
- type Manager
- func (m Manager) GitCredential(ctx context.Context, instance, user string, client *http.Client, now time.Time) (Credential, error)
- func (m Manager) Logout(instance, user string) (Credential, error)
- func (m Manager) Refresh(ctx context.Context, instance, user string, httpClient *http.Client, ...) (Credential, error)
- func (m Manager) Register(instance, user, backend, method string, options HostOptions, ...) error
- func (m Manager) RegisterHTTPSign(instance, user string, account settings.Account, options HostOptions) error
- type OAuthOptions
- type Store
- type SystemKeyring
Constants ¶
const DefaultClientID = "d57cb8c4-630c-4168-8324-ec79935e18d4"
DefaultClientID identifies the public gt OAuth application.
Variables ¶
var DefaultScopes = []string{"write:issue", "write:misc", "write:notification", "write:organization", "write:package", "write:repository", "write:user"}
DefaultScopes are the token scopes gt requests through OAuth: read and write access to everything but instance administration.
var ErrAccountExists = errors.New("account already configured")
ErrAccountExists rejects a registration of a configured account without HostOptions.Replace.
Functions ¶
func MatchGitInstance ¶
func MatchGitInstance(request GitRequest, hosts map[string]settings.Host, explicit, environment string) (string, error)
MatchGitInstance selects the most specific configured installation. A pinned helper declines a request belonging to a different installation on that origin.
Types ¶
type Credential ¶
type Credential struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
ExpiresAt time.Time `json:"expires_at,omitzero"`
}
Credential holds the secret token material kept outside instance metadata.
func OAuthLogin ¶
func OAuthLogin(ctx context.Context, opts OAuthOptions) (Credential, error)
OAuthLogin exchanges a PKCE authorization code through a loopback callback.
type GitRequest ¶
type GitRequest struct{ Protocol, Host, Path, Username string }
GitRequest contains only the credential-routing parts of Git's input protocol.
func ReadGitRequest ¶
func ReadGitRequest(input io.Reader) (GitRequest, error)
ReadGitRequest limits input and rejects ambiguous routing without echoing values.
type HTTPSign ¶
HTTPSign signs Gitea API requests with an SSH private key or certificate.
func SignerForAccount ¶
func SignerForAccount(account settings.Account, passphrase func() ([]byte, error)) (*HTTPSign, error)
SignerForAccount builds an HTTP signer from persisted account SSH metadata. passphrase is called only for an encrypted key file; when it is nil, such a key fails with advice to use ssh-agent.
func (*HTTPSign) SignRequest ¶
SignRequest attaches Signature and Digest headers required by Gitea HTTPSign.
type HostOptions ¶
type HostOptions struct {
OAuthClientID string
Insecure bool
// Headers are added to the instance's headers, replacing those of the same name.
Headers map[string]string
// ClientCert and ClientKey replace the instance's TLS client certificate when set.
ClientCert, ClientKey string
// Replace lets a registration replace the metadata and stored credential of an account that is
// already configured, as when logging in again with a new token.
Replace bool
}
HostOptions are instance settings recorded together with a new account.
type Keyring ¶
type Keyring interface {
Get(string, string) (string, error)
Set(string, string, string) error
Delete(string, string) error
}
Keyring is the operating-system credential storage boundary.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager coordinates account metadata and credential changes under one lock.
func NewManager ¶
NewManager couples the settings and credential stores that account changes keep consistent.
func (Manager) GitCredential ¶
func (m Manager) GitCredential(ctx context.Context, instance, user string, client *http.Client, now time.Time) (Credential, error)
GitCredential loads or refreshes one explicitly selected stored account. It never accepts Git's store/erase protocol as an authentication mutation.
func (Manager) Logout ¶
func (m Manager) Logout(instance, user string) (Credential, error)
Logout removes one account, restores its credential if publication fails and returns the removed credential. An unreadable credential does not prevent removing the account.
func (Manager) Refresh ¶
func (m Manager) Refresh(ctx context.Context, instance, user string, httpClient *http.Client, force bool, now time.Time) (Credential, error)
Refresh locks by instance and account, then reads again before rotating secrets. A nil httpClient uses http.DefaultClient.
func (Manager) Register ¶
func (m Manager) Register(instance, user, backend, method string, options HostOptions, credential Credential) error
Register publishes account metadata and compensates credential writes on failure.
func (Manager) RegisterHTTPSign ¶
func (m Manager) RegisterHTTPSign(instance, user string, account settings.Account, options HostOptions) error
RegisterHTTPSign publishes SSH/HTTP-signature account metadata without storing a token.
type OAuthOptions ¶
type OAuthOptions struct {
Instance string
ClientID string
// HTTP sends the token exchange; nil uses http.DefaultClient.
HTTP *http.Client
Authorize func(context.Context, string) error
Timeout time.Duration
// Scopes are the token scopes to request; none requests DefaultScopes.
Scopes []string
}
OAuthOptions supplies the instance, client, and authorization interaction.
type Store ¶
Store selects secure storage or explicitly opted-in private files.
type SystemKeyring ¶
type SystemKeyring struct{}
SystemKeyring delegates to the platform credential manager.
func (SystemKeyring) Delete ¶
func (SystemKeyring) Delete(service, user string) error
Delete removes only the selected instance/account credential.
func (SystemKeyring) Get ¶
func (SystemKeyring) Get(service, user string) (string, error)
Get retrieves a secret from the platform credential manager.
func (SystemKeyring) Set ¶
func (SystemKeyring) Set(service, user, value string) error
Set persists a secret in the platform credential manager.