auth

package
v0.1.13 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: Apache-2.0 Imports: 29 Imported by: 0

Documentation

Overview

Package auth places a credential on an upstream call. Operators of the binary use login, client credentials, token exchange, env, invoke, or a command. Library code implements credentials.Provider.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Caller 

func Caller(ctx context.Context) string

func CredentialSecrets 

func CredentialSecrets(c credentials.Credential) []string

CredentialSecrets lists header values, query values, and a bearer token without its prefix.

func DefaultTokenDir 

func DefaultTokenDir() string

func Fixed 

func Fixed(a catalog.Auth, token string) credentials.Provider

Fixed places one already-known secret. It is the provider for a static auth map.

func HasAccessToken 

func HasAccessToken(dir, scheme string) bool

HasAccessToken reports a pasted or minted access token on disk.

func HasBrowser 

func HasBrowser() bool

func HasRefreshToken 

func HasRefreshToken(dir, scheme string) bool

HasRefreshToken reports a stored refresh token.

func Login 

func Login(ctx context.Context, opt LoginOptions) error

Login runs authorization code with PKCE, or device code when there is no browser. It stores the refresh token and does not run during invoke.

func OpenBrowser 

func OpenBrowser(ctx context.Context, raw string) error

func OrLocal added in v0.1.6 

func OrLocal(id string) string

OrLocal is the caller name on the wire. Empty is local.

func Redact 

func Redact(s string, secrets, queryKeys []string) string

Redact removes secret values and named query credentials from s.

func RedactURL 

func RedactURL(raw string, keys []string) string

RedactURL clears query parameters named in keys.

func SetToken 

func SetToken(dir, scheme, token string) error

SetToken stores a token the operator already holds. The file mode is 0600.

func UserToken 

func UserToken(ctx context.Context) string

func WithCaller 

func WithCaller(ctx context.Context, id string) context.Context

WithCaller records who is calling veto. The value is an identity, not a credential.

func WithEnvProxy 

func WithEnvProxy(c *http.Client) *http.Client

WithEnvProxy returns a client that still honors HTTPS_PROXY when Transport is *http.Transport. A nil Transport uses the default transport, which already reads the proxy environment. Any other RoundTripper is left alone. The caller owns its proxy.

func WithForce 

func WithForce(ctx context.Context) context.Context

WithForce tells a provider to skip a cached credential and obtain a new one.

func WithUserToken 

func WithUserToken(ctx context.Context, token string) context.Context

WithUserToken attaches the token the MCP host passed on this invoke. Login and client credentials ignore it. An invoke source sends it. A command receives it only when it is set.

Types

type Endpoints 

type Endpoints struct {
	Authorization string
	Token         string
	Device        string
}

func Discover 

func Discover(ctx context.Context, client *http.Client, issuer string) (Endpoints, error)

type LoginOptions 

type LoginOptions struct {
	Scheme      Scheme
	Dir         string
	Device      bool
	Open        func(context.Context, string) error
	HTTP        *http.Client
	RedirectURL string
	Out         io.Writer
}

type Material 

type Material struct {
	Headers map[string]string
	Query   map[string]string
	Expires time.Time
	Secrets []string
	Sign    func(*http.Request) error
}

type Options 

type Options struct {
	Schemes        []Scheme
	Dir            string
	HTTP           *http.Client
	Now            func() time.Time
	Env            func(string) string
	CommandTimeout time.Duration
	JSON           jsonopts.Set
}

type Resolver 

type Resolver struct {
	// contains filtered or unexported fields
}

func New 

func New(opt Options) *Resolver

func (*Resolver) Blockers added in v0.1.5 

func (r *Resolver) Blockers(a catalog.Auth) []string

Blockers lists process-level reasons this scheme cannot run. An invoke token that arrives on the call is not a blocker.

func (*Resolver) Configured 

func (r *Resolver) Configured(name string) (Scheme, bool)

Configured returns the scheme named in config.

func (*Resolver) Has 

func (r *Resolver) Has(name string) bool

func (*Resolver) Material 

func (r *Resolver) Material(ctx context.Context, op *catalog.Operation, a catalog.Auth, method, endpoint string, force bool) (Material, error)

Material returns headers and query values for one scheme. force skips a cached token and refreshes once. It does not open a browser.

func (*Resolver) Provider 

func (r *Resolver) Provider(a catalog.Auth) (credentials.Provider, bool)

Provider returns the provider that obtains material for one scheme.

func (*Resolver) Ready 

func (r *Resolver) Ready(ctx context.Context, a catalog.Auth) bool

func (*Resolver) Refreshable 

func (r *Resolver) Refreshable(name string) bool

func (*Resolver) SetProvider 

func (r *Resolver) SetProvider(name string, src credentials.Provider)

SetProvider registers a library Provider for one scheme name.

func (*Resolver) SuppliesUserHeader added in v0.1.5 

func (r *Resolver) SuppliesUserHeader(name, header string) bool

SuppliesUserHeader reports whether a login scheme can place the user token on header.

func (*Resolver) UnsetError 

func (r *Resolver) UnsetError(a catalog.Auth) error

type Scheme 

type Scheme struct {
	Name                   string
	Source                 string
	Env                    string
	ClientID               string
	ClientSecretEnv        string
	AuthorizationURL       string
	TokenURL               string
	Issuer                 string
	DeviceAuthorizationURL string
	RedirectURL            string
	Scopes                 []string
	Audience               string
	Header                 string
	Command                []string
	Timeout                time.Duration
	// AuthToken is the token-response field sent as the app credential. Empty means access_token.
	AuthToken string
	// UserToken is the token-response field that names the person. Empty means id_token.
	UserToken string
	// UserHeader is the upstream header that carries the person token.
	UserHeader string
	// Subject is "invoke" or the name of a login scheme whose stored token is exchanged.
	Subject string
	// SubjectTokenType is sent on token exchange. Empty means an access token.
	SubjectTokenType string
}

Scheme is one configured security scheme. Secrets are not stored here.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.