Help us shape the future of Go! Take the 2026 Go Developer Survey

gcpidentitytoolkit

package
v1.9.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 1, 2026 License: MIT Imports: 50 Imported by: 0

README

Identity Platform

Parity grade: B · SDK google.golang.org/api@v0.304.0 · last audited 2026-10-29 (185f8a81e)

Coverage

Metric Value
PARITY entries audited 1 (1 ok)
Feature families 6 (4 ok, 2 partial)
Known gaps 6
Deferred items 0
Resource leaks unknown
Known gaps
  • accounts:signInWithIdp, federated createAuthUri, OIDC/SAML/OAuth provider configs (v2 defaultSupportedIdpConfigs, oauthIdpConfigs, inboundSamlConfigs) and linking federated providers through sign-in are not implemented.
  • Multi-factor authentication (phone/TOTP enrollment and sign-in, mfaInfo) and phone-number sign-in (sendVerificationCode, signInWithPhoneNumber) are not implemented; mfaInfo on create is ignored.
  • No email is sent and the /emulator/action page that applies a link in a browser is not served; codes are read from the emulator oobCodes endpoint.
  • Out-of-band code lifetimes, batchCreate failure message texts, the passwordHashOrder default for HMAC/plain hashes (password then salt), the REDACTED placeholder in client lookups and the config defaults were chosen from documentation and SDK behaviour without a production reference.
  • TOO_MANY_ATTEMPTS_TRY_LATER and quotas, API key restrictions, authorized-domain checks of continueUrl, blocking functions, reCAPTCHA, SMS region policy and v2 passwordPolicy/recaptchaConfig client endpoints are not implemented.
  • The Admin SDKs in production mode fetch signing keys from googleapis.com and cannot be redirected to this emulator; only FIREBASE_AUTH_EMULATOR_HOST mode verifies tokens.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8145

DefaultPort is the dedicated Identity Platform listener's default TCP port (FIREBASE_AUTH_EMULATOR_HOST).

View Source 
const DefaultProject = "gopherstack-local"

DefaultProject is the project client calls resolve to when the request names none.

Variables

View Source 
var ErrNilAppContext = errors.New("gcpidentitytoolkit: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrSnapshotNull = errors.New("gcpidentitytoolkit: snapshot contains a null record")

ErrSnapshotNull is returned when a snapshot holds a null record.

Functions

This section is empty.

Types

type APIError 

type APIError struct {
	Message string
	Status  string
	HTTP    int
}

APIError is a Google JSON REST error; Message carries the Identity Toolkit error code.

func (*APIError) Error 

func (e *APIError) Error() string

Error implements error.

type ConfigProvider 

type ConfigProvider interface {
	GetGCPIdentityToolkitSettings() Settings
}

ConfigProvider extracts Identity Platform configuration from the AppContext Config.

type CustomTokenKeys 

type CustomTokenKeys func(email string) []*rsa.PublicKey

CustomTokenKeys resolves the public keys that may verify a custom token issued by a service account email.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port int
	// contains filtered or unexported fields
}

Handler serves the Identity Toolkit and Secure Token REST APIs on a dedicated listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port from Settings.

func (*Handler) Addr 

func (h *Handler) Addr() string

Addr returns the bound listener address, or "" before StartWorker.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name for metrics.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns project[/tenant] for metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler for every Identity Toolkit and Secure Token request.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset removes all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Identity Platform runs on its own listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the listener.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds all Identity Platform state under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) AdminCreate 

func (b *InMemoryBackend) AdminCreate(c call, r *authRequest) (map[string]any, error)

AdminCreate creates an account without issuing tokens (projects/{p}/accounts).

func (*InMemoryBackend) BatchCreate 

func (b *InMemoryBackend) BatchCreate(c call, r *uploadRequest) (map[string]any, error)

BatchCreate imports accounts with optional password hashes (accounts:batchCreate).

func (*InMemoryBackend) BatchDelete 

func (b *InMemoryBackend) BatchDelete(c call, ids []string, force bool, tenant string) (map[string]any, error)

BatchDelete deletes accounts; without force only disabled accounts are deleted.

func (*InMemoryBackend) BatchGet 

func (b *InMemoryBackend) BatchGet(c call, tenant, token string, maxResults int) (map[string]any, error)

BatchGet pages through accounts with their full password hashes.

func (*InMemoryBackend) ClearAccounts 

func (b *InMemoryBackend) ClearAccounts(project, tenant string) error

ClearAccounts deletes every account in a project or tenant (emulator reset endpoint).

func (*InMemoryBackend) CreateAuthURI 

func (b *InMemoryBackend) CreateAuthURI(c call, r *authRequest) (map[string]any, error)

CreateAuthURI reports sign-in methods for an identifier, honouring email enumeration protection.

func (*InMemoryBackend) CreateSessionCookie 

func (b *InMemoryBackend) CreateSessionCookie(c call, r *authRequest) (map[string]string, error)

CreateSessionCookie mints a session cookie from an ID token.

func (*InMemoryBackend) CreateTenant 

func (b *InMemoryBackend) CreateTenant(
	project string,
	in *idtkv2.GoogleCloudIdentitytoolkitAdminV2Tenant,
) (*idtkv2.GoogleCloudIdentitytoolkitAdminV2Tenant, error)

CreateTenant creates a tenant with a generated id.

func (*InMemoryBackend) DeleteAccount 

func (b *InMemoryBackend) DeleteAccount(c call, r *authRequest) error

DeleteAccount deletes the caller's account (ID token) or any account (admin, by uid).

func (*InMemoryBackend) DeleteTenant 

func (b *InMemoryBackend) DeleteTenant(project, id string) error

DeleteTenant removes a tenant and its accounts.

func (*InMemoryBackend) GetConfig 

func (b *InMemoryBackend) GetConfig(project string) *idtkv2.GoogleCloudIdentitytoolkitAdminV2Config

GetConfig returns the project configuration.

func (*InMemoryBackend) GetTenant 

func (b *InMemoryBackend) GetTenant(project, id string) (*idtkv2.GoogleCloudIdentitytoolkitAdminV2Tenant, error)

GetTenant returns one tenant.

func (*InMemoryBackend) ListTenants 

func (b *InMemoryBackend) ListTenants(
	project, token string,
	size int,
) (page.Page[*idtkv2.GoogleCloudIdentitytoolkitAdminV2Tenant], error)

ListTenants pages through a project's tenants.

func (*InMemoryBackend) Lookup 

func (b *InMemoryBackend) Lookup(c call, r *authRequest) (map[string]any, error)

Lookup returns accounts by ID token (client) or by uid, email, phone or provider id (admin).

func (*InMemoryBackend) OOBCodes 

func (b *InMemoryBackend) OOBCodes(project, tenant string) ([]OOBCode, error)

OOBCodes lists the live codes of a project, oldest first. No email is ever sent; tests read codes here.

func (*InMemoryBackend) ProjectIDs 

func (b *InMemoryBackend) ProjectIDs() []string

ProjectIDs lists the project IDs with stored state, always including the default project.

func (*InMemoryBackend) Query 

func (b *InMemoryBackend) Query(c call, r *queryRequest) (map[string]any, error)

Query filters, sorts and pages accounts (accounts:query).

func (*InMemoryBackend) Refresh 

func (b *InMemoryBackend) Refresh(grantType, token string) (map[string]string, error)

Refresh exchanges a refresh token for a new ID token (securetoken v1/token).

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset removes all state, including signing keys.

func (*InMemoryBackend) ResetPassword 

func (b *InMemoryBackend) ResetPassword(c call, r *authRequest) (map[string]any, error)

ResetPassword checks (no newPassword) or applies (newPassword) a password reset code.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) SendOobCode 

func (b *InMemoryBackend) SendOobCode(c call, r *authRequest) (*oobResponse, error)

SendOobCode records a reset, verification or sign-in code; no email is sent.

func (*InMemoryBackend) SetClock 

func (b *InMemoryBackend) SetClock(now func() time.Time)

SetClock replaces the backend clock.

func (*InMemoryBackend) SetCustomTokenKeys 

func (b *InMemoryBackend) SetCustomTokenKeys(f CustomTokenKeys)

SetCustomTokenKeys installs the resolver used to verify RS256 custom tokens.

func (*InMemoryBackend) SignInWithCustomToken 

func (b *InMemoryBackend) SignInWithCustomToken(c call, r *authRequest) (*tokenResponse, error)

SignInWithCustomToken exchanges a custom token for an ID token, creating the account on first use. 

func (b *InMemoryBackend) SignInWithEmailLink(c call, r *authRequest) (*tokenResponse, error)

SignInWithEmailLink completes passwordless sign-in, creating the account on first use.

func (*InMemoryBackend) SignInWithPassword 

func (b *InMemoryBackend) SignInWithPassword(c call, r *authRequest) (*tokenResponse, error)

SignInWithPassword authenticates by email and password.

func (*InMemoryBackend) SignUp 

func (b *InMemoryBackend) SignUp(c call, r *authRequest) (*tokenResponse, error)

SignUp creates an email/password or anonymous account, or links email/password to an anonymous one.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state, including the token signing key.

func (*InMemoryBackend) Update 

func (b *InMemoryBackend) Update(c call, r *authRequest) (*setAccountResponse, error)

Update modifies an account: self-service with an ID token, by oobCode, or by uid for admins.

func (*InMemoryBackend) UpdateConfig 

func (b *InMemoryBackend) UpdateConfig(
	project string,
	patch map[string]any,
	mask string,
) (*idtkv2.GoogleCloudIdentitytoolkitAdminV2Config, error)

UpdateConfig merges a patch into the project configuration.

func (*InMemoryBackend) UpdateTenant 

func (b *InMemoryBackend) UpdateTenant(
	project, id string,
	patch map[string]any,
	mask string,
) (*idtkv2.GoogleCloudIdentitytoolkitAdminV2Tenant, error)

UpdateTenant merges a patch into a tenant.

type OOBCode 

type OOBCode struct {
	Email       string `json:"email"`
	OobCode     string `json:"oobCode"`
	OobLink     string `json:"oobLink"`
	RequestType string `json:"requestType"`
}

OOBCode is one stored out-of-band code, as listed by the emulator endpoint.

type Provider 

type Provider struct{}

Provider implements service.Provider for Identity Platform. It serves REST on its own listener (see Handler.StartWorker) and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type Settings 

type Settings struct {
	DefaultProject string `` //nolint:lll // config struct tags are intentionally verbose
	/* 188-byte string literal not displayed */
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 248-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI as CLI.GCPIdentityToolkit.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.