Documentation
¶
Overview ¶
Package auth handles the Swile session: importing it from a browser's cookie store, persisting it, and refreshing the access token when it expires.
cantine never handles a password and never touches the two-factor flow. The user signs in on team.swile.co as usual; we borrow the session their browser already holds.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoSession = errors.New("aucune session : lance `cantine auth import`")
ErrNoSession means nothing usable is stored yet.
Functions ¶
func StorageLocation ¶
func StorageLocation() string
StorageLocation describes where the session lives, for `auth status`.
Types ¶
type Session ¶
type Session struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
ExpiresAt time.Time `json:"expires_at"`
Email string `json:"email"`
Source string `json:"source"` // browser it was imported from
}
Session is a Swile OAuth session. It is the only credential cantine holds.
func ImportFromBrowser ¶
ImportFromBrowser reads the Swile session cookies out of a browser's cookie store. browser is a name such as "chrome" or "firefox"; an empty string means "search every browser and take the freshest session". profile, when set, points at one specific Chromium profile directory (or Cookies file) instead of searching.
The cookies are non-HttpOnly, which is what makes this possible at all.
func (*Session) EnsureFresh ¶
EnsureFresh refreshes the token if needed and persists the result.
func (*Session) Refresh ¶
Refresh exchanges the refresh token for a fresh access token.
Swile rotates the refresh token but does not invalidate the previous one, so refreshing here does not sign the user out of their browser.
Source Files