auth

Jun 2, 2026

Changes in this version

+ func ExportPortableAuthBundle(configDir string, w io.Writer) error

+ func PortableAuthSourceReady() bool

+ func PortableAuthTargetPopulated(configDir string) bool

+ func PortableExportSupported() bool

+ type PortableImportReport struct

+ BundleOS string

+ OSMismatch bool

+ func ImportPortableAuthBundle(configDir string, r io.Reader) (PortableImportReport, error)

Apr 28, 2026

Changes in this version

+ const AgentCodeEnv

+ const AppAccessTokenURL

+ func DeleteAppTokenData(clientID string) error

+ func FetchAppToken(ctx context.Context, appKey, appSecret string) (token string, expiresIn int64, err error)

+ func HostOwnsPATFlow() bool

+ func SaveAppTokenData(data *AppTokenData) error

+ type AppTokenData struct

+ AccessToken string

+ ClientID string

+ ExpiresAt time.Time

+ UpdatedAt time.Time

+ func LoadAppTokenData(clientID string) (*AppTokenData, error)

+ func (d *AppTokenData) IsTokenValid() bool

+ type AppTokenProvider struct

+ AppKey string

+ AppSecret string

+ ConfigDir string

+ HTTPClient *http.Client

+ func (p *AppTokenProvider) GetToken(ctx context.Context) (string, error)

type DevicePollResponse

+ Result DevicePollData

+ func (r DevicePollResponse) EffectiveData() DevicePollData

Apr 24, 2026

Changes in this version

+ func MarkAccessTokenStale(configDir string) error

Apr 22, 2026

Changes in this version

type CLIAuthResult

+ ChannelConfigEnabled bool

Apr 20, 2026

Changes in this version

+ const DefaultTerminalBaseURL

+ const DeveloperSettingsPath

+ const DevicePollPath

+ const StatusApproved

+ const StatusCancelled

+ const StatusExpired

+ const StatusPending

+ const StatusRejected

+ func GetDeveloperSettingsURL() string

+ func GetTerminalBaseURL() string

+ func ParseDeviceFlowStatus(rawStatus string, success bool) string

+ type CLIAuthResult struct

+ AllowedChannels []string

+ AllowedUsers []string

+ CLIAuthEnabled bool

+ ChannelScope string

+ UserScope string

type DeviceAuthResponse

+ FlowID string

type DeviceFlowProvider

+ func (p *DeviceFlowProvider) SetScope(scope string)

+ func (p *DeviceFlowProvider) SetTerminalBaseURL(baseURL string)

+ type DevicePollData struct

+ AuthCode string

+ FlowID string

+ Status string

+ type DevicePollResponse struct

+ Code string

+ Data DevicePollData

+ Message string

+ Success bool

type TokenData

+ func ExchangeCodeForToken(ctx context.Context, configDir, code string) (*TokenData, error)

Apr 16, 2026

Changes in this version

+ func DeleteTokenMarker(configDir string) error

+ func WriteTokenMarker(configDir string) error

+ type TokenMarker struct

+ UpdatedAt string

Apr 1, 2026

Changes in this version

+ func DeleteClientSecret(clientID string) error

+ func LoadClientSecret(clientID string) string

+ func SaveClientSecret(clientID, clientSecret string) error

Apr 1, 2026

Changes in this version

+ const CLIAuthEnabledPath

+ const ClientIDPath

+ const DefaultMCPBaseURL

+ const MCPOAuthTokenPath

+ const MCPRefreshTokenPath

+ const MCPRevokeTokenPath

+ const SendCliAuthApplyPath

+ const SuperAdminPath

+ func FetchClientIDFromMCP(ctx context.Context) (string, error)

+ func GetMCPBaseURL() string

+ func GetRefreshTokenURL() string

+ func GetRevokeTokenURL() string

+ func GetUserAccessTokenURL() string

+ func HasValidClientSecret() bool

+ func IsClientIDFromMCP() bool

+ func SetClientIDFromMCP(id string)

+ type CLIAuthStatus struct

+ ErrorCode string

+ ErrorMsg string

+ Result struct{ ... }

+ Success bool

+ type ClientIDResponse struct

+ ErrorCode string

+ ErrorMsg string

+ Result string

+ Success bool

type OAuthProvider

+ func (p *OAuthProvider) CheckCLIAuthEnabled(ctx context.Context, accessToken string) (*CLIAuthStatus, error)

+ type SendApplyResponse struct

+ ErrorCode string

+ ErrorMsg string

+ Result bool

+ Success bool

+ func SendCliAuthApply(ctx context.Context, accessToken, adminStaffID string) (*SendApplyResponse, error)

+ type SuperAdmin struct

+ Name string

+ StaffID string

+ type SuperAdminResponse struct

+ ErrorCode string

+ ErrorMsg string

+ Result []SuperAdmin

+ Success bool

+ func GetSuperAdmins(ctx context.Context, accessToken string) (*SuperAdminResponse, error)

Mar 30, 2026

Changes in this version

+ var ValidSecretSources = map[string]bool

+ func DeleteAppConfig(configDir string) error

+ func GetAppConfigPath(configDir string) string

+ func HasAppConfig(configDir string) bool

+ func RemoveSecretStore(input SecretInput)

+ func ResolveAppCredentials(configDir string) (clientID, clientSecret string)

+ func ResolveSecret(input SecretInput) (string, error)

+ func SaveAppConfig(configDir string, config *AppConfig) error

+ type AppConfig struct

+ ClientID string

+ ClientSecret SecretInput

+ CreatedAt time.Time

+ UpdatedAt time.Time

+ func GetCachedAppConfig(configDir string) *AppConfig

+ func LoadAppConfig(configDir string) (*AppConfig, error)

+ func ReloadAppConfig(configDir string) (*AppConfig, error)

+ type SecretInput struct

+ Plain string

+ Ref *SecretRef

+ func PlainSecret(s string) SecretInput

+ func StoreSecret(clientID string, input SecretInput) (SecretInput, error)

+ func (s *SecretInput) UnmarshalJSON(data []byte) error

+ func (s SecretInput) IsPlain() bool

+ func (s SecretInput) IsSecretRef() bool

+ func (s SecretInput) IsZero() bool

+ func (s SecretInput) MarshalJSON() ([]byte, error)

+ type SecretRef struct

+ ID string

+ Source string

type TokenData

+ ClientID string

Mar 27, 2026

Changes in this version

+ func LoadExportedCredentials(ctx context.Context, path, configDir string) (string, error)

+ type ExportedCredentials struct

+ CorpID string

+ CorpName string

+ ExportedAt string

+ PersistentCode string

+ RefreshToken string

+ UserID string

+ UserName string

Mar 29, 2026

Changes in this version

+ const AuthorizeURL

+ const CallbackPath

+ const DefaultClientID

+ const DefaultClientSecret

+ const DefaultDeviceBaseURL

+ const DefaultScopes

+ const DeviceCodePath

+ const DeviceGrantType

+ const DeviceTokenPath

+ const LogoutContinueURL

+ const LogoutURL

+ const UserAccessTokenURL

+ const UserInfoURL

+ var ErrTokenDecryption = errors.New("token decryption failed")

+ func ClientID() string

+ func ClientSecret() string

+ func DeleteSecureData(configDir string) error

+ func DeleteTokenData(configDir string) error

+ func DeleteTokenDataKeychain() error

+ func EnsureMigration(configDir string, logger *slog.Logger)

+ func IsMigrationDone() bool

+ func RevokeTokenRemote(ctx context.Context) error

+ func SaveSecureTokenData(configDir string, data *TokenData) error

+ func SaveTokenData(configDir string, data *TokenData) error

+ func SaveTokenDataKeychain(data *TokenData) error

+ func SecureDataExists(configDir string) bool

+ func SetClientID(id string)

+ func SetClientSecret(secret string)

+ func TokenDataExistsKeychain() bool

+ type DeviceAuthResponse struct

+ DeviceCode string

+ ExpiresIn int

+ Interval int

+ UserCode string

+ VerificationURI string

+ VerificationURIComplete string

+ type DeviceFlowProvider struct

+ Output io.Writer

+ func NewDeviceFlowProvider(configDir string, logger *slog.Logger) *DeviceFlowProvider

+ func (p *DeviceFlowProvider) Login(ctx context.Context) (*TokenData, error)

+ func (p *DeviceFlowProvider) SetBaseURL(baseURL string)

+ type DeviceTokenResponse struct

+ AuthCode string

+ Error string

+ RedirectURL string

+ type DualLock struct

+ Waited bool

+ func AcquireDualLock(ctx context.Context, configDir string) (*DualLock, error)

+ func (d *DualLock) Release()

+ type Identity struct

+ AgentID string

+ Source string

+ func EnsureExists(configDir string) *Identity

+ func Load(configDir string) *Identity

+ func (id *Identity) Headers() map[string]string

+ type Manager struct

+ func NewManager(configDir string, logger *slog.Logger) *Manager

+ func (m *Manager) DeleteToken() error

+ func (m *Manager) GetMCPURL() (string, error)

+ func (m *Manager) GetToken() (string, string, error)

+ func (m *Manager) IsAuthenticated() bool

+ func (m *Manager) SaveMCPURL(url string) error

+ func (m *Manager) SaveToken(token string) error

+ func (m *Manager) Status() (authenticated bool, source string, maskedToken string)

+ type OAuthProvider struct

+ Output io.Writer

+ func NewOAuthProvider(configDir string, logger *slog.Logger) *OAuthProvider

+ func (p *OAuthProvider) ExchangeAuthCode(ctx context.Context, authCode, uid string) (*TokenData, error)

+ func (p *OAuthProvider) GetAccessToken(ctx context.Context) (string, error)

+ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, error)

+ func (p *OAuthProvider) Logout() error

+ func (p *OAuthProvider) Status() (*TokenData, error)

+ type TokenData struct

+ AccessToken string

+ CorpID string

+ CorpName string

+ ExpiresAt time.Time

+ PersistentCode string

+ RefreshExpAt time.Time

+ RefreshToken string

+ Source string

+ UpdatedAt string

+ UserID string

+ UserName string

+ func LoadSecureTokenData(configDir string) (*TokenData, error)

+ func LoadTokenData(configDir string) (*TokenData, error)

+ func LoadTokenDataKeychain() (*TokenData, error)

+ func (t *TokenData) HasPersistentCode() bool

+ func (t *TokenData) IsAccessTokenValid() bool

+ func (t *TokenData) IsRefreshTokenValid() bool