Documentation
¶
Overview ¶
Package models holds the persisted Passport (OAuth2 server) tables: clients, authorization codes, access tokens, and refresh tokens.
Secrets and tokens are stored as SHA-256 hashes — plaintext values are returned to the caller only once, at creation time.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Migrations ¶
Migrations creates the Passport (OAuth2 server) tables. Exposed via the plugin's Migrations() so they run alongside application migrations.
Types ¶
type OAuthAccessToken ¶
type OAuthAccessToken struct {
database.Model
Token string `json:"-" gorm:"uniqueIndex;size:64;not null"` // SHA-256 hash
ClientID string `json:"client_id" gorm:"index;not null"`
UserID string `json:"user_id" gorm:"index"`
Name string `json:"name"`
Scopes string `json:"scopes" gorm:"type:text"`
Revoked bool `json:"revoked" gorm:"index"`
ExpiresAt time.Time `json:"expires_at"`
}
OAuthAccessToken is an issued bearer token. Stored hashed; opaque to clients. UserID is empty for client_credentials tokens (machine-to-machine).
func (*OAuthAccessToken) HasScope ¶
func (t *OAuthAccessToken) HasScope(scope string) bool
HasScope reports whether the token was granted a scope ("*" grants all).
func (*OAuthAccessToken) IsExpired ¶
func (t *OAuthAccessToken) IsExpired() bool
IsExpired reports whether the access token has passed its expiry.
func (*OAuthAccessToken) ScopeList ¶
func (t *OAuthAccessToken) ScopeList() []string
ScopeList splits the granted scopes.
func (OAuthAccessToken) TableName ¶
func (OAuthAccessToken) TableName() string
type OAuthAuthCode ¶
type OAuthAuthCode struct {
database.Model
Code string `json:"-" gorm:"uniqueIndex;size:64;not null"` // SHA-256 hash
ClientID string `json:"client_id" gorm:"index;not null"`
UserID string `json:"user_id" gorm:"index;not null"`
Scopes string `json:"scopes" gorm:"type:text"`
RedirectURI string `json:"redirect_uri"`
CodeChallenge string `json:"-"` // PKCE challenge
CodeChallengeMethod string `json:"-"` // "S256" or "plain"
Used bool `json:"used" gorm:"index"`
ExpiresAt time.Time `json:"expires_at"`
}
OAuthAuthCode is a short-lived, single-use code issued from /oauth/authorize and exchanged at /oauth/token for tokens.
func (*OAuthAuthCode) IsExpired ¶
func (a *OAuthAuthCode) IsExpired() bool
IsExpired reports whether the code has passed its expiry.
func (OAuthAuthCode) TableName ¶
func (OAuthAuthCode) TableName() string
type OAuthClient ¶
type OAuthClient struct {
database.Model
ClientID string `json:"client_id" gorm:"uniqueIndex;size:64;not null"`
Secret string `json:"-" gorm:"size:64"` // SHA-256 hash; empty for public clients
Name string `json:"name" gorm:"not null"`
UserID string `json:"user_id" gorm:"index"` // owner (first-party clients may leave empty)
RedirectURIs string `json:"redirect_uris" gorm:"type:text"` // space-separated allowlist
Grants string `json:"grants" gorm:"type:text"` // space-separated: authorization_code refresh_token client_credentials
Scopes string `json:"scopes" gorm:"type:text"` // space-separated allowed scopes ("*" = any)
Confidential bool `json:"confidential"` // false = public (PKCE required); always set explicitly by CreateClient
FirstParty bool `json:"first_party"` // skip the consent screen
Revoked bool `json:"revoked" gorm:"index"`
}
OAuthClient is a registered application allowed to request tokens. Confidential clients authenticate with a secret; public clients (SPAs, mobile, CLIs) have no secret and MUST use PKCE on the authorization_code grant.
func (*OAuthClient) AllowsGrant ¶
func (c *OAuthClient) AllowsGrant(grant string) bool
AllowsGrant reports whether the client may use a grant type.
func (*OAuthClient) AllowsRedirect ¶
func (c *OAuthClient) AllowsRedirect(uri string) bool
AllowsRedirect reports whether uri exactly matches an allowlisted redirect.
func (*OAuthClient) AllowsScope ¶
func (c *OAuthClient) AllowsScope(scope string) bool
AllowsScope reports whether the client is permitted to request a scope.
func (*OAuthClient) GrantList ¶
func (c *OAuthClient) GrantList() []string
GrantList splits the stored allowed grants.
func (*OAuthClient) RedirectList ¶
func (c *OAuthClient) RedirectList() []string
RedirectList splits the stored redirect allowlist.
func (OAuthClient) TableName ¶
func (OAuthClient) TableName() string
type OAuthRefreshToken ¶
type OAuthRefreshToken struct {
database.Model
Token string `json:"-" gorm:"uniqueIndex;size:64;not null"` // SHA-256 hash
AccessTokenID uint `json:"access_token_id" gorm:"index;not null"`
Revoked bool `json:"revoked" gorm:"index"`
ExpiresAt time.Time `json:"expires_at"`
}
OAuthRefreshToken lets a client obtain a fresh access token without the user.
func (*OAuthRefreshToken) IsExpired ¶
func (t *OAuthRefreshToken) IsExpired() bool
IsExpired reports whether the refresh token has passed its expiry.
func (OAuthRefreshToken) TableName ¶
func (OAuthRefreshToken) TableName() string
Source Files