oauth

package

v0.4.4 Latest Latest Go to latest Published: Jun 7, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/T4cceptor/centian

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
type AuthorizationRequiredError
- func IsAuthorizationRequired(err error) (*AuthorizationRequiredError, bool)
- func (e *AuthorizationRequiredError) Error() string
type Binding
type Manager
- func NewManager(publicBaseURL string, onAuthorized func(Binding), ...) (*Manager, error)
type PendingAuthorization
type PendingStatus
type ResolvedMetadata
type StoredToken
type Transport
- func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error)

Constants ¶

View Source

const (
	// AuthorizationReasonRequired marks errors that need an initial browser login.
	AuthorizationReasonRequired = "authorization required"
	// AuthorizationReasonRefreshFailed marks errors caused by a failed token refresh.
	AuthorizationReasonRefreshFailed = "refresh failed"
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type AuthorizationRequiredError ¶

type AuthorizationRequiredError struct {
	Binding   Binding
	AuthURL   string
	StatusURL string
	PendingID string
	Reason    string
}

AuthorizationRequiredError reports that a downstream HTTP request must be authorized in the browser first.

func IsAuthorizationRequired ¶

func IsAuthorizationRequired(err error) (*AuthorizationRequiredError, bool)

IsAuthorizationRequired unwraps errors returned when a downstream request must be authorized in the browser.

func (*AuthorizationRequiredError) Error ¶

func (e *AuthorizationRequiredError) Error() string

type Binding ¶

type Binding struct {
	PrincipalID string
	Gateway     string
	Server      string
}

Binding identifies one persisted downstream OAuth token.

type Manager ¶

type Manager struct {
	// contains filtered or unexported fields
}

Manager owns downstream OAuth token storage and pending browser-based authorization flows.

func NewManager ¶

func NewManager(publicBaseURL string, onAuthorized func(Binding), onRequired func(Binding, string)) (*Manager, error)

NewManager creates the downstream OAuth manager used by proxy endpoints.

func (*Manager) Close ¶

func (m *Manager) Close()

Close waits for all background goroutines spawned by the Manager to finish.

func (*Manager) CreatePending ¶

func (m *Manager) CreatePending(binding Binding, clientID, clientSecret string, metadata *ResolvedMetadata, verifier string) (*PendingAuthorization, error)

CreatePending allocates a new browser-based authorization flow for a downstream server.

func (*Manager) DeleteToken ¶

func (m *Manager) DeleteToken(binding Binding) error

DeleteToken removes the persisted downstream token for the provided binding.

func (*Manager) EnsurePending ¶

func (m *Manager) EnsurePending(binding Binding, clientID, clientSecret string, metadata *ResolvedMetadata) (*PendingAuthorization, bool, error)

EnsurePending reuses an active flow when possible or creates a new one.

func (*Manager) LoadToken ¶

func (m *Manager) LoadToken(binding Binding) (*StoredToken, error)

LoadToken loads the persisted downstream token for the provided binding.

func (*Manager) NewTransport ¶

func (m *Manager) NewTransport(
	base http.RoundTripper,
	binding Binding,
	downstreamURL string,
	oauthConfig *config.OAuthConfig,
	headers map[string]string,
) http.RoundTripper

NewTransport wraps one downstream HTTP transport with OAuth token management.

func (*Manager) PendingForBinding ¶

func (m *Manager) PendingForBinding(binding Binding) *PendingAuthorization

PendingForBinding returns the active pending authorization flow for a downstream binding, if any.

func (*Manager) RegisterRoutes ¶

func (m *Manager) RegisterRoutes(mux *http.ServeMux)

RegisterRoutes registers the HTTP handlers needed to complete downstream OAuth flows.

func (*Manager) SaveToken ¶

func (m *Manager) SaveToken(binding Binding, token *StoredToken) error

SaveToken persists the downstream token for the provided binding.

func (*Manager) StartURL ¶

func (m *Manager) StartURL(id string) string

StartURL returns the browser entrypoint for a pending downstream authorization flow.

func (*Manager) StatusURL ¶

func (m *Manager) StatusURL(id string) string

StatusURL returns the status page for a pending downstream authorization flow.

type PendingAuthorization ¶

type PendingAuthorization struct {
	ID           string
	State        string
	Status       PendingStatus
	Binding      Binding
	ClientID     string
	ClientSecret string
	Metadata     ResolvedMetadata
	CodeVerifier string
	RedirectURL  string
	AuthURL      string
	CreatedAt    time.Time
	ExpiresAt    time.Time
	LastError    string
}

PendingAuthorization tracks one downstream OAuth flow waiting on browser interaction.

type PendingStatus ¶

type PendingStatus string

PendingStatus describes the current state of a browser-based downstream OAuth flow.

const (
	// PendingStatusReady means the flow has been created but the browser step has not started yet.
	PendingStatusReady PendingStatus = "ready"
	// PendingStatusInProgress means the user has started the browser flow but it is not complete yet.
	PendingStatusInProgress PendingStatus = "in_progress"
	// PendingStatusCompleted means the flow completed and the token has been saved.
	PendingStatusCompleted PendingStatus = "completed"
	// PendingStatusFailed means the flow failed and LastError contains the reason.
	PendingStatusFailed PendingStatus = "failed"
)

type ResolvedMetadata ¶

type ResolvedMetadata struct {
	Resource              string
	Scopes                []string
	Issuer                string
	AuthorizationEndpoint string
	TokenEndpoint         string
	ClientAuthMethod      string
}

ResolvedMetadata is the downstream OAuth metadata required to authorize and refresh tokens.

type StoredToken ¶

type StoredToken struct {
	AccessToken           string    `json:"accessToken"`
	TokenType             string    `json:"tokenType,omitempty"`
	RefreshToken          string    `json:"refreshToken,omitempty"`
	Expiry                time.Time `json:"expiry,omitempty"`
	Resource              string    `json:"resource,omitempty"`
	Scopes                []string  `json:"scopes,omitempty"`
	Issuer                string    `json:"issuer,omitempty"`
	AuthorizationEndpoint string    `json:"authorizationEndpoint,omitempty"`
	TokenEndpoint         string    `json:"tokenEndpoint,omitempty"`
	ClientAuthMethod      string    `json:"clientAuthMethod,omitempty"`
}

StoredToken is the serialized OAuth token record persisted for one binding.

type Transport ¶

type Transport struct {
	Base          http.RoundTripper
	Manager       *Manager
	Binding       Binding
	DownstreamURL string
	Config        *config.OAuthConfig
	Headers       map[string]string
}

Transport wraps a downstream HTTP transport with OAuth token loading, refresh, and authorization flow handling.

func (*Transport) RoundTrip ¶

func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error)

RoundTrip adds downstream OAuth headers, retries after refresh, and surfaces interactive authorization requirements.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL