oidc

Nov 12, 2026

Changes in this version

type AccessToken

+ Audience []string

+ func (t *AccessToken) For(resource string) bool

type AuthCode

+ Resource string

type Consent

+ Returns string

type Options

+ ClientMetadataDocuments bool

+ MetadataClient *http.Client

+ Resources []string

type Plugin

+ func (p *Plugin) Issuer() string

type RefreshToken

+ Resource string

Nov 10, 2026

Changes in this version

+ type Consent struct

+ Action string

+ Client string

+ Params map[string]string

+ Scopes []string

type Options

+ ConsentURL string

type Plugin

+ func (p *Plugin) ConsentRequest(ctx *kit.Ctx) (Consent, error)

Nov 10, 2026

Changes in this version

+ var ErrInvalidToken = errors.New("oidc: invalid access token")

+ var ErrNotFound = errors.New("oidc: not found")

+ type AccessToken struct

+ ClientID string

+ Expires time.Time

+ ID string

+ Scopes []string

+ Subject string

+ func (t *AccessToken) HasScope(scope string) bool

+ type AuthCode struct

+ AuthTime time.Time

+ ClientID string

+ CodeChallenge string

+ Expires time.Time

+ Nonce string

+ RedirectURI string

+ Scopes []string

+ Subject string

+ type Client struct

+ GrantTypes []string

+ ID string

+ Name string

+ Public bool

+ RedirectURIs []string

+ Scopes []string

+ Secret string

+ Trusted bool

+ type MemoryStore struct

+ func NewMemoryStore() *MemoryStore

+ func (s *MemoryStore) AccessRevoked(_ context.Context, jti string) (bool, error)

+ func (s *MemoryStore) Consent(_ context.Context, sub, client string) ([]string, error)

+ func (s *MemoryStore) GetRefresh(_ context.Context, h string) (RefreshToken, error)

+ func (s *MemoryStore) RevokeAccess(_ context.Context, jti string, exp time.Time) error

+ func (s *MemoryStore) RevokeFamily(_ context.Context, family string) error

+ func (s *MemoryStore) RevokeRefresh(_ context.Context, h string) error

+ func (s *MemoryStore) SaveCode(_ context.Context, h string, c AuthCode) error

+ func (s *MemoryStore) SaveConsent(_ context.Context, sub, client string, scopes []string) error

+ func (s *MemoryStore) SaveRefresh(_ context.Context, h string, t RefreshToken) error

+ func (s *MemoryStore) SaveSigningKey(_ context.Context, pem []byte) error

+ func (s *MemoryStore) SigningKey(context.Context) ([]byte, error)

+ func (s *MemoryStore) TakeCode(_ context.Context, h string) (AuthCode, error)

+ func (s *MemoryStore) UseRefresh(_ context.Context, h string) (bool, error)

+ type Options struct

+ AccessTokenTTL time.Duration

+ Authenticate func(ctx *kit.Ctx) (string, error)

+ Claims func(ctx context.Context, subject string, scopes []string) (map[string]any, error)

+ Clients []Client

+ CodeTTL time.Duration

+ IDTokenTTL time.Duration

+ Issuer string

+ LoginURL string

+ Path string

+ RefreshTokenTTL time.Duration

+ Scopes []string

+ SigningKey []byte

+ Store Store

+ type Plugin struct

+ func New(opts Options) *Plugin

+ func (*Plugin) Name() string

+ func (p *Plugin) Bearer(ctx *kit.Ctx, scopes ...string) (*AccessToken, error)

+ func (p *Plugin) Setup(s *kit.Setup) error

+ func (p *Plugin) Verify(ctx context.Context, raw string) (*AccessToken, error)

+ type RefreshToken struct

+ AuthTime time.Time

+ ClientID string

+ Expires time.Time

+ Family string

+ Scopes []string

+ Subject string

+ Used bool

+ type SQLStore struct

+ func NewSQLStore(db *sql.DB) (*SQLStore, error)

+ func (s *SQLStore) AccessRevoked(ctx context.Context, jti string) (bool, error)

+ func (s *SQLStore) Consent(ctx context.Context, sub, client string) ([]string, error)

+ func (s *SQLStore) GetRefresh(ctx context.Context, h string) (RefreshToken, error)

+ func (s *SQLStore) RevokeAccess(ctx context.Context, jti string, exp time.Time) error

+ func (s *SQLStore) RevokeFamily(ctx context.Context, family string) error

+ func (s *SQLStore) RevokeRefresh(ctx context.Context, h string) error

+ func (s *SQLStore) SaveCode(ctx context.Context, h string, c AuthCode) error

+ func (s *SQLStore) SaveConsent(ctx context.Context, sub, client string, scopes []string) error

+ func (s *SQLStore) SaveRefresh(ctx context.Context, h string, t RefreshToken) error

+ func (s *SQLStore) SaveSigningKey(ctx context.Context, pem []byte) error

+ func (s *SQLStore) SigningKey(ctx context.Context) ([]byte, error)

+ func (s *SQLStore) TakeCode(ctx context.Context, h string) (AuthCode, error)

+ func (s *SQLStore) UseRefresh(ctx context.Context, h string) (bool, error)

+ type Store interface

+ AccessRevoked func(ctx context.Context, jti string) (bool, error)

+ Consent func(ctx context.Context, subject, clientID string) ([]string, error)

+ GetRefresh func(ctx context.Context, hash string) (RefreshToken, error)

+ RevokeAccess func(ctx context.Context, jti string, expires time.Time) error

+ RevokeFamily func(ctx context.Context, family string) error

+ RevokeRefresh func(ctx context.Context, hash string) error

+ SaveCode func(ctx context.Context, hash string, c AuthCode) error

+ SaveConsent func(ctx context.Context, subject, clientID string, scopes []string) error

+ SaveRefresh func(ctx context.Context, hash string, t RefreshToken) error

+ SaveSigningKey func(ctx context.Context, pem []byte) error

+ SigningKey func(ctx context.Context) ([]byte, error)

+ TakeCode func(ctx context.Context, hash string) (AuthCode, error)

+ UseRefresh func(ctx context.Context, hash string) (bool, error)