oauth

package

v0.10.10 Latest Latest Go to latest Published: Nov 3, 2026 License: MIT Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Atmanity/atmee-toolkit

Links

Open Source Insights

Documentation ¶

Overview ¶

Package oauth signs a user in to the Avatar API with the browser, the way an MCP client does: the API names its authorization server (/.well-known/oauth-protected-resource), the CLI registers itself there as a public client for one loopback redirect, sends the user to the authorization page with PKCE, takes the code on that redirect and trades it for tokens. The access token is short-lived; Refresh trades the refresh token for a new pair.

Index ¶

func Email(accessToken string) string
type Server
- func Discover(ctx context.Context, hc *http.Client, baseURL string) (*Server, error)
type Tokens
- func Login(ctx context.Context, hc *http.Client, s *Server, open func(string) error, ...) (string, *Tokens, error)
- func Refresh(ctx context.Context, hc *http.Client, ...) (*Tokens, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Email ¶

func Email(accessToken string) string

Email is the email claim of a JWT access token, for display only (the token is not verified here; the API does that).

Types ¶

type Server ¶

type Server struct {
	// Resource is the protected resource the tokens are for.
	Resource      string
	Authorization string
	Token         string
	Registration  string
}

Server is the authorization server the Avatar API trusts.

func Discover ¶

func Discover(ctx context.Context, hc *http.Client, baseURL string) (*Server, error)

Discover reads the Avatar API's protected-resource metadata and its authorization server's metadata.

type Tokens ¶

type Tokens struct {
	AccessToken  string
	RefreshToken string
	ExpiresAt    time.Time
}

Tokens is one token answer.

func Login(ctx context.Context, hc *http.Client, s *Server, open func(string) error, show func(string)) (string, *Tokens, error)

Login runs the browser sign-in. open is given the authorization URL (and may fail: the URL is also handed to show, for the user to open by hand). It returns the registered client id with the tokens; refreshing needs it.

func Refresh ¶

func Refresh(ctx context.Context, hc *http.Client, tokenURL, clientID, refreshToken, resource string) (*Tokens, error)

Refresh trades a refresh token for a new pair, for the same resource. The server may rotate the refresh token; when it sends none back, the old one stays good.

Source Files ¶

View all Source files

oauth.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL