Directories
¶
| Path | Synopsis |
|---|---|
|
api_key
|
|
|
api_key_cruder
Package api_key_cruder reads and writes the keys an account registers, and records what they mint with.
|
Package api_key_cruder reads and writes the keys an account registers, and records what they mint with. |
|
assertion
Package assertion verifies what a client signs to mint a token: a short-lived JWT, signed by the private half of a key the account registered, saying which key is asking and what it is asking of.
|
Package assertion verifies what a client signs to mint a token: a short-lived JWT, signed by the private half of a key the account registered, saying which key is asking and what it is asking of. |
|
client
Package client is the holder's side of an API key: the assertion it signs with the private half of a key its account registered, wherever that half is kept -- a file, a key manager, a TPM, anything a crypto.Signer reaches -- and the exchange of the assertion for a session token at the login service's token endpoint.
|
Package client is the holder's side of an API key: the assertion it signs with the private half of a key its account registered, wherever that half is kept -- a file, a key manager, a TPM, anything a crypto.Signer reaches -- and the exchange of the assertion for a session token at the login service's token endpoint. |
|
endpoint/create_api_key_endpoint
Package create_api_key_endpoint registers a public key for the signed-in account.
|
Package create_api_key_endpoint registers a public key for the signed-in account. |
|
endpoint/mint_token_endpoint
Package mint_token_endpoint mints an access token for a client that can sign for a registered key.
|
Package mint_token_endpoint mints an access token for a client that can sign for a registered key. |
|
endpoint/read_own_api_keys_endpoint
Package read_own_api_keys_endpoint lists the keys the signed-in account registered.
|
Package read_own_api_keys_endpoint lists the keys the signed-in account registered. |
|
endpoint/revoke_api_key_endpoint
Package revoke_api_key_endpoint takes one of the account's keys out of use.
|
Package revoke_api_key_endpoint takes one of the account's keys out of use. |
|
public_key
Package public_key reads the public keys accounts register for API access.
|
Package public_key reads the public keys accounts register for API access. |
|
testing
Package testing is what the API key packages' tests share: a database of a test package's own, on the server TEST_DATABASE_URL names, with the library's tables in it; accounts in it; and session tokens for them, signed by a key the tests hold, as a browser or a minted token would carry them.
|
Package testing is what the API key packages' tests share: a database of a test package's own, on the server TEST_DATABASE_URL names, with the library's tables in it; accounts in it; and session tokens for them, signed by a key the tests hold, as a browser or a minted token would carry them. |
|
types
Package types holds what the API key endpoints take and answer with.
|
Package types holds what the API key endpoints take and answer with. |
|
types/api_key
Package api_key holds the public keys an account registers to mint tokens with.
|
Package api_key holds the public keys an account registers to mint tokens with. |
|
types/api_key_assertion
Package api_key_assertion remembers the assertions a key has already minted with, for as long as they could still be presented again.
|
Package api_key_assertion remembers the assertions a key has already minted with, for as long as they could still be presented again. |
|
types/api_key_authentication
Package api_key_authentication links a sign-in to the key that minted it.
|
Package api_key_authentication links a sign-in to the key that minted it. |
|
types/oauth_authorization
Package oauth_authorization is what the OAuth authorization server keeps, as tables.
|
Package oauth_authorization is what the OAuth authorization server keeps, as tables. |
|
Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with.
|
Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with. |
|
testing
Package testing makes the keys and proofs that tests of DPoP need.
|
Package testing makes the keys and proofs that tests of DPoP need. |
|
types/memory_replay_detector
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused.
|
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused. |
|
types/proof_key
Package proof_key reads the public key a DPoP proof carries in its "jwk" header.
|
Package proof_key reads the public key a DPoP proof carries in its "jwk" header. |
|
types/proof_verifier
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to.
|
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to. |
|
types/proof_verifier/proof_verifier_config
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice.
|
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice. |
|
types/token_extractor
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under.
|
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under. |
|
Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are.
|
Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are. |
|
testing
Package testing holds what the tests of the endpoints' logging share.
|
Package testing holds what the tests of the endpoints' logging share. |
|
magic_link
|
|
|
Package oauth is an OAuth 2.1 authorization server for the resources of the apps a sign-in service fronts -- an app's MCP server, say -- beside the service's own sessions rather than in place of them.
|
Package oauth is an OAuth 2.1 authorization server for the resources of the apps a sign-in service fronts -- an app's MCP server, say -- beside the service's own sessions rather than in place of them. |
|
testing
Package testing holds what tests of the OAuth authorization server share: the behaviour every store must have, as a test any of them can be run through.
|
Package testing holds what tests of the OAuth authorization server share: the behaviour every store must have, as a test any of them can be run through. |
|
types/access_token
Package access_token is an OAuth access token as the authorization server issues it: a JWT (RFC 9068) for one resource, signed with a key of its own.
|
Package access_token is an OAuth access token as the authorization server issues it: a JWT (RFC 9068) for one resource, signed with a key of its own. |
|
types/access_token_parser
Package access_token_parser is how a resource accepts the authorization server's access tokens: a request parser that takes a bearer token only of the server's type, signed with its key, for this resource and with the scope the resource requires.
|
Package access_token_parser is how a resource accepts the authorization server's access tokens: a request parser that takes a bearer token only of the server's type, signed with its key, for this resource and with the scope the resource requires. |
|
types/cimd_fetcher
Package cimd_fetcher reads a client's metadata document (Client ID Metadata Documents, as the MCP authorization specification has clients register): a client's id is the HTTPS URL of a JSON document saying what the client is called and where it may be sent back to, which the authorization server fetches when the client first asks for authorization.
|
Package cimd_fetcher reads a client's metadata document (Client ID Metadata Documents, as the MCP authorization specification has clients register): a client's id is the HTTPS URL of a JSON document saying what the client is called and where it may be sent back to, which the authorization server fetches when the client first asks for authorization. |
|
types/client
Package client is an OAuth client as the authorization server knows it: what it is called and where it may be sent back to.
|
Package client is an OAuth client as the authorization server knows it: what it is called and where it may be sent back to. |
|
types/client_registrar
Package client_registrar is dynamic client registration (RFC 7591) without a store: a client's id is what it registered, signed, and resolving it is checking the signature and reading it back.
|
Package client_registrar is dynamic client registration (RFC 7591) without a store: a client's id is what it registered, signed, and resolving it is checking the signature and reading it back. |
|
types/client_resolver
Package client_resolver is how the authorization server knows a client: one registered with it beforehand, one that registered itself and holds the id it was given, or one whose id is the URL of a metadata document on a host it allows.
|
Package client_resolver is how the authorization server knows a client: one registered with it beforehand, one that registered itself and holds the id it was given, or one whose id is the URL of a metadata document on a host it allows. |
|
types/endpoint/authorization_server_metadata_endpoint
Package authorization_server_metadata_endpoint serves the authorization server's metadata (RFC 8414), which is how a client learns where to send the user and where to redeem a code, and what the server supports -- among it that a client may register by its metadata document, which is what has Claude use one rather than register dynamically.
|
Package authorization_server_metadata_endpoint serves the authorization server's metadata (RFC 8414), which is how a client learns where to send the user and where to redeem a code, and what the server supports -- among it that a client may register by its metadata document, which is what has Claude use one rather than register dynamically. |
|
types/endpoint/authorize_endpoint
Package authorize_endpoint is the authorization endpoint (RFC 6749 section 3.1, OAuth 2.1): where a client sends the user to be asked whether it may act for them on a resource.
|
Package authorize_endpoint is the authorization endpoint (RFC 6749 section 3.1, OAuth 2.1): where a client sends the user to be asked whether it may act for them on a resource. |
|
types/endpoint/decision_endpoint
Package decision_endpoint takes the user's answer to the consent page: on allowing, an authorization code for the client; on denying, the refusal.
|
Package decision_endpoint takes the user's answer to the consent page: on allowing, an authorization code for the client; on denying, the refusal. |
|
types/endpoint/protected_resource_metadata_endpoint
Package protected_resource_metadata_endpoint serves a resource's metadata (RFC 9728), which is how a client that was refused by the resource learns which authorization server to ask, and for what scope.
|
Package protected_resource_metadata_endpoint serves a resource's metadata (RFC 9728), which is how a client that was refused by the resource learns which authorization server to ask, and for what scope. |
|
types/endpoint/registration_endpoint
Package registration_endpoint is the client registration endpoint (RFC 7591): where a client with no metadata document of its own -- Gemini's -- registers, and is given an id.
|
Package registration_endpoint is the client registration endpoint (RFC 7591): where a client with no metadata document of its own -- Gemini's -- registers, and is given an id. |
|
types/endpoint/revocation_endpoint
Package revocation_endpoint is the revocation endpoint (RFC 7009): where a client gives up what it was granted, as Claude does when the user removes a connector.
|
Package revocation_endpoint is the revocation endpoint (RFC 7009): where a client gives up what it was granted, as Claude does when the user removes a connector. |
|
types/endpoint/token_endpoint
Package token_endpoint is the token endpoint (RFC 6749 section 3.2, OAuth 2.1): where a client redeems an authorization code, or a refresh token, for an access token to a resource.
|
Package token_endpoint is the token endpoint (RFC 6749 section 3.2, OAuth 2.1): where a client redeems an authorization code, or a refresh token, for an access token to a resource. |
|
types/memory_store
Package memory_store keeps what the OAuth authorization server hands out in memory, for tests: nothing expired is ever swept, so a server kept running on it would grow without end.
|
Package memory_store keeps what the OAuth authorization server hands out in memory, for tests: nothing expired is ever swept, so a server kept running on it would grow without end. |
|
types/page
Package page is the authorization server's pages: the consent page, and the message a request is refused with where it cannot be sent back to its client.
|
Package page is the authorization server's pages: the consent page, and the message a request is refused with where it cannot be sent back to its client. |
|
types/postgres_store
Package postgres_store keeps what the OAuth authorization server hands out in the tables of database/types/oauth_authorization, alongside the service's accounts.
|
Package postgres_store keeps what the OAuth authorization server hands out in the tables of database/types/oauth_authorization, alongside the service's accounts. |
|
Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it.
|
Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it. |
|
types/active_session_processor
Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on.
|
Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on. |
|
types/authentication_method
Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it.
|
Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it. |
|
types/navigation_refresh_handler
Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid.
|
Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid. |
|
types/session_instructions
Package session_instructions holds the session instructions a server returns to a browser for a device bound session.
|
Package session_instructions holds the session instructions a server returns to a browser for a device bound session. |
|
sso
|
|
|
types/endpoint/login_endpoint
Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider.
|
Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider. |
Click to show internal directories.
Click to hide internal directories.