Documentation
¶
Overview ¶
Package auth handles the Swile session: importing it from a browser's cookie store, persisting it, and refreshing the access token when it expires.
cantine never handles a password and never touches the two-factor flow. The user signs in on team.swile.co as usual; we borrow the session their browser already holds.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidGrant = errors.New("session expirée côté Swile")
ErrInvalidGrant means Swile rejected the refresh token: it was revoked, or the browser session it came from has ended. Callers wrap it with advice that fits how the token got here — re-importing does not help on a headless host.
var ErrNoSession = errors.New("aucune session : lance `cantine auth import`")
ErrNoSession means nothing usable is stored yet.
Functions ¶
func StorageLocation ¶
func StorageLocation() string
StorageLocation describes where the session lives, for `auth status`.
Types ¶
type Session ¶
type Session struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
ExpiresAt time.Time `json:"expires_at"`
Email string `json:"email"`
Source string `json:"source"` // browser it was imported from
}
Session is a Swile OAuth session. It is the only credential cantine holds.
func FromRefreshToken ¶ added in v0.2.0
FromRefreshToken builds a session from a refresh token pasted by hand.
This is the escape hatch for machines with no browser: a headless VPS, a container, a box reached only over SSH. The user reads the lunchr:rt cookie from any device they are already signed in on and pipes it in here.
Swile's authorization server supports neither the device authorization grant nor OIDC discovery, so there is no "open this URL on your phone" flow to implement — pasting the token is the whole protocol.
func ImportFromBrowser ¶
ImportFromBrowser reads the Swile session cookies out of a browser's cookie store. browser is a name such as "chrome" or "firefox"; an empty string means "search every browser and take the freshest session". profile, when set, points at one specific Chromium profile directory (or Cookies file) instead of searching.
The cookies are non-HttpOnly, which is what makes this possible at all.
func (*Session) EnsureFresh ¶
EnsureFresh refreshes the token if needed and persists the result.
func (*Session) Refresh ¶
Refresh exchanges the refresh token for a fresh access token.
Swile rotates the refresh token but does not invalidate the previous one, so refreshing here does not sign the user out of their browser.
Source Files