Documentation
¶
Overview ¶
Package oauth provides OAuth 2.0 PKCE support for Airlock credential management. Ported from gateway/internal/tokenbroker — simplified to flat params, no discovery.
Index ¶
- Variables
- func GeneratePKCE() (verifier, challenge string, err error)
- func GenerateState() (string, error)
- func ValidatePKCESupport(meta *AuthServerMeta) error
- type AuthServerMeta
- type Client
- func (c *Client) BuildAuthURL(authURL, clientID, redirectURI, state, codeChallenge, scopes string) (string, error)
- func (c *Client) ExchangeCode(ctx context.Context, ...) (*TokenResponse, error)
- func (c *Client) RefreshToken(ctx context.Context, tokenURL, refreshToken, clientID, clientSecret string) (*TokenResponse, error)
- type DiscoveryResult
- type OAuthError
- type ProtectedResourceMeta
- type RefreshJob
- type TokenResponse
Constants ¶
This section is empty.
Variables ¶
var ( // ErrDiscoveryFailed indicates that metadata discovery did not succeed. ErrDiscoveryFailed = errors.New("metadata discovery failed") // ErrPKCENotSupported indicates the authorization server does not support S256 PKCE. ErrPKCENotSupported = errors.New("authorization server does not support S256 PKCE") )
Functions ¶
func GeneratePKCE ¶
GeneratePKCE generates a PKCE code verifier and S256 challenge.
func GenerateState ¶
GenerateState generates a random state token for CSRF protection.
func ValidatePKCESupport ¶
func ValidatePKCESupport(meta *AuthServerMeta) error
ValidatePKCESupport checks that the authorization server supports S256 PKCE.
Types ¶
type AuthServerMeta ¶
type AuthServerMeta struct {
Issuer string `json:"issuer"`
AuthorizationEndpoint string `json:"authorization_endpoint"`
TokenEndpoint string `json:"token_endpoint"`
RegistrationEndpoint string `json:"registration_endpoint,omitempty"`
ScopesSupported []string `json:"scopes_supported,omitempty"`
CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
}
AuthServerMeta represents RFC 8414 Authorization Server Metadata.
func FetchAuthServerMetadata ¶
func FetchAuthServerMetadata(ctx context.Context, httpClient *http.Client, authServerURL string) (*AuthServerMeta, error)
FetchAuthServerMetadata fetches RFC 8414 Authorization Server Metadata. Tries /.well-known/oauth-authorization-server first, then falls back to /.well-known/openid-configuration.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client handles OAuth 2.0 operations.
func (*Client) BuildAuthURL ¶
func (c *Client) BuildAuthURL(authURL, clientID, redirectURI, state, codeChallenge, scopes string) (string, error)
BuildAuthURL constructs an OAuth 2.0 authorization URL with PKCE.
func (*Client) ExchangeCode ¶
func (c *Client) ExchangeCode(ctx context.Context, tokenURL, code, codeVerifier, redirectURI, clientID, clientSecret string) (*TokenResponse, error)
ExchangeCode exchanges an authorization code for tokens.
func (*Client) RefreshToken ¶
func (c *Client) RefreshToken(ctx context.Context, tokenURL, refreshToken, clientID, clientSecret string) (*TokenResponse, error)
RefreshToken uses a refresh token to obtain a new access token.
type DiscoveryResult ¶
type DiscoveryResult struct {
ResourceURI string
AuthorizationURL string
TokenURL string
RegistrationEndpoint string // RFC 7591 dynamic client registration endpoint
ScopesSupported []string
}
DiscoveryResult contains the result of upstream OAuth discovery.
func DiscoverUpstream ¶
func DiscoverUpstream(ctx context.Context, httpClient *http.Client, serverURL string) (*DiscoveryResult, error)
DiscoverUpstream orchestrates the full upstream discovery flow:
type OAuthError ¶
OAuthError represents an error returned by the OAuth provider.
func (*OAuthError) Error ¶
func (e *OAuthError) Error() string
type ProtectedResourceMeta ¶
type ProtectedResourceMeta struct {
Resource string `json:"resource"`
AuthorizationServers []string `json:"authorization_servers"`
ScopesSupported []string `json:"scopes_supported,omitempty"`
}
ProtectedResourceMeta represents RFC 9728 Protected Resource Metadata.
func DiscoverProtectedResource ¶
func DiscoverProtectedResource(ctx context.Context, httpClient *http.Client, serverURL string) (*ProtectedResourceMeta, error)
DiscoverProtectedResource fetches RFC 9728 Protected Resource Metadata. Tries /.well-known/oauth-protected-resource/{path} first, then falls back to root.
type RefreshJob ¶
type RefreshJob struct {
// contains filtered or unexported fields
}
RefreshJob refreshes OAuth tokens before they expire.
func NewRefreshJob ¶
func NewRefreshJob(database *db.DB, encryptor *crypto.Encryptor, client *Client, logger *zap.Logger) *RefreshJob
NewRefreshJob creates a RefreshJob with default interval (5 min) and buffer (10 min).
func (*RefreshJob) Run ¶
func (j *RefreshJob) Run(ctx context.Context)
Run starts the background refresh loop. Blocks until ctx is cancelled. Runs an immediate refresh on startup so tokens that expired while the process was down are caught without waiting for the first tick.
Source Files