Documentation
¶
Overview ¶
Package auth implements the device-code login flow against the cloud API.
Index ¶
- func GitEmail(ctx context.Context, deps cliruntime.Deps) string
- func SaveCredentials(credentials Credentials) error
- type Credentials
- type DeviceCodeRefusedError
- type LoginSavedError
- type Service
- func (s Service) LoginWithBrowser(ctx context.Context, cfg *config.Config, w io.Writer) (Credentials, error)
- func (s Service) LoginWithDeviceCode(ctx context.Context, cfg *config.Config, deviceCode, project string, ...) (Credentials, error)
- func (s Service) LoginWithToken(ctx context.Context, cfg *config.Config, token, project string) (Credentials, error)
- func (s Service) Logout() error
- func (s Service) SelectInLink(ctx context.Context, cfg *config.Config, credentials Credentials) (cliproject.UseResult, error)
- func (s Service) Signup(ctx context.Context, cfg *config.Config, email string, w io.Writer) (Credentials, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GitEmail ¶ added in v0.48.0
func GitEmail(ctx context.Context, deps cliruntime.Deps) string
GitEmail returns `git config --global user.email`, or "" when it is unset or git fails. Signup offers it as the default email address.
func SaveCredentials ¶ added in v0.48.0
func SaveCredentials(credentials Credentials) error
SaveCredentials saves a login's credentials to ~/.volcano/config.json.
Types ¶
type Credentials ¶
type Credentials struct {
Token string
UserID string
// Project is the project login validated the token against, to be
// selected: saved as the active project, or, inside a linked directory, in
// the link. Nil when login resolved no project.
Project *config.ProjectConfig
// APIURL is the API that issued or validated Token. It is not saved: the
// same run uses it to update the directory's link.
APIURL string
}
Credentials are the platform credentials produced by a successful login.
type DeviceCodeRefusedError ¶ added in v0.48.0
type DeviceCodeRefusedError struct {
// Reason completes "The code from the dashboard ...", e.g. "has expired".
Reason string
Err error
}
DeviceCodeRefusedError is a device code from the dashboard that the API would not trade for a login: expired, denied, already used, or not valid. It counts as not signed in for the exit code.
func (*DeviceCodeRefusedError) Error ¶ added in v0.48.0
func (e *DeviceCodeRefusedError) Error() string
func (*DeviceCodeRefusedError) Is ¶ added in v0.48.0
func (e *DeviceCodeRefusedError) Is(target error) bool
Is makes a refused code exit as not signed in.
func (*DeviceCodeRefusedError) Unwrap ¶ added in v0.48.0
func (e *DeviceCodeRefusedError) Unwrap() error
type LoginSavedError ¶ added in v0.48.0
type LoginSavedError struct{ Err error }
LoginSavedError is a failure after the API traded a device code from the dashboard for a login, and that login was saved. The code is spent, but the saved login works without it.
func (*LoginSavedError) Error ¶ added in v0.48.0
func (e *LoginSavedError) Error() string
func (*LoginSavedError) Unwrap ¶ added in v0.48.0
func (e *LoginSavedError) Unwrap() error
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service performs Volcano authentication workflows.
func NewService ¶
func NewService(deps cliruntime.Deps) Service
NewService returns an authentication service.
func (Service) LoginWithBrowser ¶
func (s Service) LoginWithBrowser(ctx context.Context, cfg *config.Config, w io.Writer) (Credentials, error)
LoginWithBrowser runs the OAuth device flow and opens the browser at the verification URI the device-authorization response returned, unmodified. That page (for Volcano's first-party CLI client, the API's own managed hosted-auth page, action=device) is self-contained: it signs the user in and asks them to approve the code itself, so login needs no Volcano Web routing of its own (see docs/api-reference/cli-authentication.md and docs/authentication/managed-hosted-pages.md in volcano-hosting).
func (Service) LoginWithDeviceCode ¶ added in v0.48.0
func (s Service) LoginWithDeviceCode(ctx context.Context, cfg *config.Config, deviceCode, project string, w io.Writer) (Credentials, error)
LoginWithDeviceCode signs in with a device code the dashboard started and already approved, so it skips device authorization and the browser and goes straight to polling. project is validated and selected as LoginWithToken does.
The login is saved as soon as the API trades the code for it: the code works once, so a failure after that must not throw the login away. Such a failure is a *LoginSavedError. A code the API refuses is a *DeviceCodeRefusedError.
func (Service) LoginWithToken ¶
func (s Service) LoginWithToken(ctx context.Context, cfg *config.Config, token, project string) (Credentials, error)
LoginWithToken validates token, an account or project access token, and returns credentials to persist. project names the project to validate against and select, by ID or by name; it is optional for an account token and required for a project access token, which cannot list projects and so cannot tell the CLI which project it belongs to.
func (Service) SelectInLink ¶ added in v0.48.0
func (s Service) SelectInLink(ctx context.Context, cfg *config.Config, credentials Credentials) (cliproject.UseResult, error)
SelectInLink saves the project a --project login selected to cfg's link, as `volcano use` does inside a linked directory: the link would otherwise keep overriding the selection. It talks to the API with the new login.
func (Service) Signup ¶ added in v0.0.4
func (s Service) Signup(ctx context.Context, cfg *config.Config, email string, w io.Writer) (Credentials, error)
Signup routes the browser through Volcano Web's own signup page (account creation isn't something the device-authorization response's verification page handles), then to a same-origin /device path. cfg.WebURLForAPIURL (explicit VOLCANO_WEB_URL, else derived from apiURL, else the compiled default) is the signup origin: the verification response's own URI can't be used for this, since for Volcano's first-party CLI client it now points at the API's own managed-hosted-auth page (a different origin, per docs/api-reference/cli-authentication.md in volcano-hosting), and Volcano Web's signup page only accepts a same-origin relative `next` value anyway (isSafeInternalPath in volcano-web rejects absolute URLs).
Source Files