Documentation
¶
Index ¶
Constants ¶
const ( // ClientID is the first-party public OAuth client pre-registered on every // Flagsmith instance. ClientID = "flagsmith-cli" Scope = "admin-api" )
const (
// SourceKeychain labels credentials loaded from the OS keychain.
SourceKeychain = "keychain"
)
Variables ¶
var ( ErrServerSideKey = errors.New("FLAGSMITH_API_KEY contains a server-side environment key") ErrLegacyAuthtoken = errors.New("FLAGSMITH_API_KEY contains a legacy user authtoken, which is not supported") ErrNotMasterKey = errors.New("FLAGSMITH_API_KEY is not a Master API key (expected {prefix}.{secret})") )
ValidateMasterKey's rejections.
var ( // ErrNotLoggedIn means no credential is available for the instance. ErrNotLoggedIn = errors.New("not logged in") // sessions are stored only in the keychain; when it is unavailable the // user must supply credentials via FLAGSMITH_API_KEY instead. ErrKeychainUnavailable = errors.New("OS keychain unavailable") )
var ErrRefreshFailed = errors.New("refreshing session failed")
ErrRefreshFailed means an expired session's refresh-token exchange failed, so the stored session is unusable.
Functions ¶
func KeychainAvailable ¶
func KeychainAvailable() bool
KeychainAvailable probes the OS keychain with a write+delete round-trip.
func Save ¶
func Save(c *Credentials) error
Save stores a login session for its instance in the OS keychain.
func ValidateMasterKey ¶
ValidateMasterKey checks that a FLAGSMITH_API_KEY value is a Master API key. Each Admin API env var maps to exactly one credential kind, so the scheme is never guessed from token shape; this only turns common paste-mistakes into actionable errors instead of a silently rejected request.
Types ¶
type Credentials ¶
type Credentials struct {
Kind Kind `json:"kind,omitempty"` // empty means KindOAuth (back-compat)
APIURL string `json:"api_url"`
AccessToken string `json:"access_token,omitempty"`
RefreshToken string `json:"refresh_token,omitempty"`
ExpiresAt time.Time `json:"expires_at,omitzero"`
MasterKey string `json:"master_key,omitempty"`
}
Credentials is a stored login session for one Flagsmith instance.
func EnsureFresh ¶
func EnsureFresh(ctx context.Context, httpClient *http.Client, c *Credentials) (creds *Credentials, refreshed bool, err error)
EnsureFresh refreshes the access token if it is expired or about to expire. The server rotates refresh tokens (120s grace), so refreshed credentials must be saved by the caller.
func Load ¶
func Load(apiURL string) (*Credentials, error)
Load returns the stored session for an instance, or ErrNotLoggedIn when the keychain holds none. A keychain that cannot be read at all is reported as ErrKeychainUnavailable: telling that user to log in sends them through the whole browser flow only to fail at Save.
func Login ¶
func Login(ctx context.Context, httpClient *http.Client, apiURL string, openBrowser func(string) error, out io.Writer) (*Credentials, error)
Login runs the authorization-code + PKCE flow on a loopback listener. openBrowser may be nil (--no-browser); the URL is always written to out.
func (*Credentials) EffectiveKind ¶
func (c *Credentials) EffectiveKind() Kind
EffectiveKind returns the credential kind, defaulting to KindOAuth for entries stored before kinds existed.
func (*Credentials) Token ¶
func (c *Credentials) Token() string
type Kind ¶
type Kind string
Kind is the credential type, which determines the Authorization scheme.
const ( // Browser-login session: Bearer access token + refresh token. KindOAuth Kind = "oauth" // Organisation Master API key: `Api-Key {prefix}.{secret}`. KindMaster Kind = "master" // OAuth-style access token from FLAGSMITH_ACCESS_TOKEN (OIDC-exchanged in CI): `Bearer {token}`. KindBearer Kind = "bearer" )
Source Files