oidc

type AuthStores ¶

type AuthStores interface {
	auth.UserStore
	auth.LoginIdentityStore
	auth.SessionStore
	auth.CredentialStore
}

AuthStores combines all store interfaces needed for OIDC auth setup.

type Config ¶

type Config struct {
	ProviderName string
	IssuerURL    string
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string
}

Config holds the configuration for a generic OIDC provider. All values are loaded from the server config snapshot via configFrom.

func (c *Config) Validate() error

type LocalConfig ¶ added in v0.60.0

type LocalConfig struct {
	AllowRegistration   string
	AllowedEmailDomains string
}

LocalConfig holds the raw local-password auth values, preferring the LOCAL_PASSWORD_ names and falling back to the legacy LOCAL_OIDC_ names.

type LoginConfig ¶ added in v0.60.0

type LoginConfig struct {
	// OAuth is the validated AUTH_OAUTH_* provider block. Empty when no OAuth
	// login providers are configured.
	OAuth []*OAuthConfig
	// Local carries the raw LOCAL_PASSWORD_/LOCAL_OIDC_ values for local
	// password auth; the local package interprets them.
	Local LocalConfig
}

LoginConfig is the dynamic login-provider configuration, parsed once at the startup boundary (mirroring config.ServerConfig): the AUTH_OAUTH_* multi-provider block and the LOCAL_PASSWORD_/LOCAL_OIDC_ local-auth block. Setup consumes it instead of reading the process environment, so the oidc package has no os.Getenv of its own. It may hold secrets (OAuth client secrets) and must never be logged.

func LoadLoginConfig(lookup Lookup, baseURL string) (LoginConfig, error)

type Lookup ¶ added in v0.60.0

type Lookup = func(string) (string, bool)

Lookup mirrors os.LookupEnv: it returns a variable's value and whether it was set. The login-config loaders take it so the oidc package never reads the process environment itself — the value flows in from the startup boundary (serverAction passes os.LookupEnv), exactly like config.LoadServerConfig.

type OAuthConfig ¶ added in v0.40.0

type OAuthConfig struct {
	ProviderName string
	Kind         string
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string

	AuthURL           string
	TokenURL          string
	TokenRequestStyle string
	UserInfoURL       string
	UserEmailsURL     string

	AllowedEmailDomains  []string
	AllowedTenantKeys    []string
	RequireEmailVerified bool
}

func OAuthConfigForProvider(lookup Lookup, providerName, baseURL string) (*OAuthConfig, error)

func OAuthConfigs(lookup Lookup, baseURL string) ([]*OAuthConfig, error)

func (c *OAuthConfig) Validate() error

type OAuthProvider ¶ added in v0.40.0

type OAuthProvider struct {
	// contains filtered or unexported fields
}

func NewOAuthProvider(cfg *OAuthConfig) (*OAuthProvider, error)

func NewOAuthProviderWithClient(cfg *OAuthConfig, client *http.Client) (*OAuthProvider, error)

func (p *OAuthProvider) ClientID() string

func (p *OAuthProvider) HandleCallback(ctx context.Context, r *http.Request, state auth.AuthState) (*auth.ExternalIdentity, error)

func (p *OAuthProvider) LoginURL(_ context.Context, state auth.AuthState) (string, error)

func (p *OAuthProvider) Name() string

type Provider ¶

type Provider struct {
	// contains filtered or unexported fields
}

Provider implements auth.AuthProvider for a generic OIDC identity provider. It uses OIDC Discovery to find endpoints and go-oidc to verify ID tokens.

func NewProvider(ctx context.Context, cfg *Config) (*Provider, error)

func (p *Provider) HandleCallback(ctx context.Context, r *http.Request, state auth.AuthState) (*auth.ExternalIdentity, error)

func (p *Provider) LoginURL(ctx context.Context, state auth.AuthState) (string, error)

func (p *Provider) Name() string

type SetupParams ¶

type SetupParams struct {
	DB       *pgxpool.Pool
	VaultKey string
	// OIDC is the static OIDC_* block from the server config snapshot. It drives
	// both the external-vs-local mode decision and the external provider config,
	// so both observe one generation.
	OIDC config.OIDCConfig
	// Login is the dynamic login-provider config (AUTH_OAUTH_*, LOCAL_*) parsed
	// at the startup boundary. Setup reads no environment of its own.
	Login LoginConfig
	// AuthStores is a store that implements all auth store interfaces.
	// In practice this is *db.OIDCStore.
	AuthStores AuthStores
}

SetupParams contains dependencies for OIDC setup.

type SetupResult ¶

type SetupResult struct {
	Providers  []auth.AuthProvider
	AuthSvc    *auth.AuthService
	SessionMgr *auth.SessionManager
	StateMgr   *StateManager
	LocalAuth  *local.Service
}

SetupResult contains the OIDC components created by Setup.

func Setup(ctx context.Context, p SetupParams) (*SetupResult, error)

type StateCookiePayload ¶

type StateCookiePayload struct {
	State        string    `json:"state"`
	CodeVerifier string    `json:"code_verifier"`
	ProviderName string    `json:"provider_name"`
	CreatedAt    time.Time `json:"created_at"`
}

StateCookiePayload is the signed state stored in the OIDC state cookie. It ties the CSRF state string and PKCE code verifier together so they can be validated when the IdP redirects back to the callback endpoint.

type StateManager ¶

type StateManager struct {
	// contains filtered or unexported fields
}

StateManager creates and validates signed OIDC state cookies. The cookie payload is JSON-encoded then HMAC-SHA256 signed using a key derived from STELLA_VAULT_KEY. The signature is appended as a hex suffix after a "." separator: base64(payload).hex(sig).

func NewStateManager(vaultKey string) (*StateManager, error)

func (m *StateManager) Generate() (StateCookiePayload, error)

func (m *StateManager) SetCookie(w http.ResponseWriter, payload StateCookiePayload, secure bool) error

func (m *StateManager) ValidateAndClear(w http.ResponseWriter, r *http.Request, queryState string) (StateCookiePayload, error)