credential

package

v0.5.1 Latest Latest Go to latest Published: Aug 28, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/agent-guide/agent-gateway

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func DecodeCredential(data []byte) (any, error)
func ProviderIDCredentialScope(providerID string) string
func ProviderTypeCredentialScope(providerType string) string
func WithSkipPersist(ctx context.Context) context.Context
type CommandRefresher
- func NewCommandRefresher(command string, args ...string) *CommandRefresher
- func (r *CommandRefresher) Refresh(ctx context.Context, cred *Credential) (*Credential, error)
type Credential
type CredentialLifecycleListener
type Error
type Filter
type ManagedCredential
type Manager
- func NewManager(store configstore.ConfigStore) *Manager
type ModelState
type QuotaState
type Refresher

Constants ¶

View Source

const (
	// DefaultRefreshCommand is the executable used by gateway entrypoints when
	// no external credential refresh command is configured.
	DefaultRefreshCommand = "agw-auth"
	// DefaultRefreshCommandArg is the default static argument paired with
	// DefaultRefreshCommand by gateway entrypoints.
	DefaultRefreshCommandArg = "refresh"
)

View Source

const (
	TypeAPIKey     = "api_key"
	TypeOAuthToken = "oauth_token"

	CredentialScopeProviderTypePrefix = "type:"
	CredentialScopeProviderIDPrefix   = "id:"
)

View Source

const (
	MetadataRefreshExpiryDeltaKey = "refresh_expiry_delta"

	// RefreshFailureCooldown prevents concurrent and immediately subsequent
	// requests from repeatedly invoking a failing external refresh command.
	RefreshFailureCooldown = 30 * time.Second
)

Variables ¶

This section is empty.

Functions ¶

func DecodeCredential ¶

func DecodeCredential(data []byte) (any, error)

func ProviderIDCredentialScope ¶

func ProviderIDCredentialScope(providerID string) string

func ProviderTypeCredentialScope ¶

func ProviderTypeCredentialScope(providerType string) string

func WithSkipPersist ¶

func WithSkipPersist(ctx context.Context) context.Context

Types ¶

type CommandRefresher ¶

type CommandRefresher struct {
	Command string
	Args    []string
	// contains filtered or unexported fields
}

CommandRefresher implements the generic external refresh protocol. It sends one credential as JSON on stdin and expects the refreshed credential as JSON on stdout. Provider-specific OAuth behavior remains outside the gateway.

func NewCommandRefresher ¶

func NewCommandRefresher(command string, args ...string) *CommandRefresher

func (*CommandRefresher) Refresh ¶

func (r *CommandRefresher) Refresh(ctx context.Context, cred *Credential) (*Credential, error)

type Credential ¶

type Credential = model.Credential

type CredentialLifecycleListener ¶

type CredentialLifecycleListener interface {
	OnCredentialRegistered(ctx context.Context, cred *ManagedCredential)
	OnCredentialUpdated(ctx context.Context, cred *ManagedCredential)
	OnCredentialDeregistered(ctx context.Context, cred *ManagedCredential)
	OnCredentialsReplaced(ctx context.Context, creds []*ManagedCredential)
}

type Error ¶

type Error = model.Error

type Filter ¶

type Filter struct {
	Type         string
	ProviderType string
	ProviderID   string
	Model        string
}

Filter identifies credentials for manager-side listing and storage operations.

type ManagedCredential ¶

type ManagedCredential = model.ManagedCredential

type Manager ¶

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager ¶

func NewManager(store configstore.ConfigStore) *Manager

func (*Manager) AddListener ¶

func (m *Manager) AddListener(listener CredentialLifecycleListener)

func (*Manager) DeregisterCredential ¶

func (m *Manager) DeregisterCredential(ctx context.Context, id string) error

func (*Manager) GetCredential ¶

func (m *Manager) GetCredential(id string) *ManagedCredential

func (*Manager) ListCredentials ¶

func (m *Manager) ListCredentials(filter Filter) []*ManagedCredential

func (*Manager) Load ¶

func (m *Manager) Load(ctx context.Context) error

func (*Manager) RefreshCredentialIfNeeded ¶

func (m *Manager) RefreshCredentialIfNeeded(ctx context.Context, credID string) (*ManagedCredential, error)

func (*Manager) Refresher ¶

func (m *Manager) Refresher() Refresher

func (*Manager) RegisterCredential ¶

func (m *Manager) RegisterCredential(ctx context.Context, cred *Credential) error

func (*Manager) ReloadFromStore ¶

func (m *Manager) ReloadFromStore(ctx context.Context) error

func (*Manager) SetRefresher ¶

func (m *Manager) SetRefresher(refresher Refresher)

SetRefresher installs the request-time credential refresh transport. The transport decides how the configured refresh command is executed.

func (*Manager) UpdateCredential ¶

func (m *Manager) UpdateCredential(ctx context.Context, cred *Credential) error

type ModelState ¶

type ModelState = model.ModelState

type QuotaState ¶

type QuotaState = model.QuotaState

type Refresher ¶

type Refresher interface {
	Refresh(ctx context.Context, cred *Credential) (*Credential, error)
}

Refresher delegates a named credential refresh implementation. The gateway owns expiry detection and persistence, while an external tool owns the provider-specific refresh behavior.

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
model
scheduler

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL