oidcauth

package

Go to main page

Versions in this module

v0

v0.0.7

Oct 27, 2026

v0.0.6

Oct 16, 2026

v0.0.5

Oct 12, 2026

Changes in this version

+ const AuditDeviceApproved

+ const AuditDeviceCodeIssued

+ const AuditDeviceDenied

+ const AuditSessionRenewalMismatch

+ const CLICredentialPrefix

+ const DefaultDeviceApprovalMaxAge

+ const DefaultDevicePollInterval

+ const DeviceCodeLifetime

+ const DeviceErrDenied

+ const DeviceErrExpired

+ const DeviceErrInvalidGrant

+ const DeviceErrPending

+ const DeviceErrSlowDown

+ const DeviceGrantType

+ const DevicePath

+ const LoginPath

+ const LogoutPath

+ const ReasonAbsoluteTTL

+ const ReasonAdminRevoked

+ const ReasonDeviceUncollected

+ const ReasonIdleTimeout

+ const ReasonLogoutAll

+ const ReasonSessionQuota

+ const ReasonUserLogout

+ const RenewPath

+ const ScriptPath

+ const UserCodeLength

+ var ErrDeviceBusy = errors.New(...)

+ var ErrDeviceDecided = errors.New("oidcauth: this code has already been used")

+ var ErrDeviceExpired = errors.New("oidcauth: this code has expired — start `cloop login` again")

+ var ErrDeviceLoginDisabled = errors.New("oidcauth: terminal sign-in is not enabled on this hub")

+ var ErrDeviceNotFound = errors.New("oidcauth: device authorization not found")

+ var ErrDeviceRequestInvalid = errors.New("oidcauth: invalid device authorization request")

+ var ErrNeedsBrowserSession = errors.New("oidcauth: approving a terminal sign-in takes a browser signed in to this hub")

+ func CLISessionID(credentialHash string) string

+ func CookieSecureFollowsRequest(mode string) bool

+ func DeviceID(deviceHash string) string

+ func FormatUserCode(code string) string

+ func ForwardedProtoHTTPS(h http.Header) bool

+ func IsCLICredential(s string) bool

+ func NewCLICredential() (credential, digest string, err error)

+ func NormalizeUserCode(s string) string

+ func PresentsCLICredential(r *http.Request) bool

+ func ServeScript(w http.ResponseWriter, r *http.Request)

+ func StateOwner(state string) string

+ func ValidateRedirectURL(raw string) (*url.URL, error)

type Authenticator

+ func (a *Authenticator) BeginDeviceApproval(ctx context.Context, r *http.Request, userCode string) (DeviceApproval, error)

+ func (a *Authenticator) BeginDeviceAuthorization(req DeviceRequest) (DeviceGrant, error)

+ func (a *Authenticator) BeginRenew(w http.ResponseWriter, r *http.Request) RenewOutcome

+ func (a *Authenticator) BrowserRenewIn(id string) (time.Duration, bool)

+ func (a *Authenticator) CLIIdleTimeout() time.Duration

+ func (a *Authenticator) CLISessionTTL() time.Duration

+ func (a *Authenticator) CheckSession(id string) (SessionRecord, SessionState)

+ func (a *Authenticator) DenyDevice(r *http.Request, userCode string) error

+ func (a *Authenticator) DeviceApprovalMaxAge() time.Duration

+ func (a *Authenticator) DeviceLoginEnabled() bool

+ func (a *Authenticator) EvictAllCachedSessions()

+ func (a *Authenticator) EvictCachedSession(sessionID string)

+ func (a *Authenticator) ExchangeDeviceCode(deviceCode string) (DeviceSession, error)

+ func (a *Authenticator) FrameOrigins() []string

+ func (a *Authenticator) LiveSessionCount() (int, error)

+ func (a *Authenticator) LookupDevice(r *http.Request, userCode string) (DeviceView, error)

+ func (a *Authenticator) PeekIdentity(r *http.Request) *Identity

+ func (a *Authenticator) RedirectURL() string

+ func (a *Authenticator) SessionClock(rec SessionRecord) SessionClock

+ func (a *Authenticator) SweepDevices() int

type ClaimFreshnessError

+ func (e *ClaimFreshnessError) Renewable() bool

type Config

+ CLIIdleTimeout time.Duration

+ CLISessionTTL time.Duration

+ DeviceApprovalMaxAge time.Duration

+ DeviceLogin bool

+ Devices DeviceStore

+ OnCacheInvalidate func(sessionID string)

+ RefreshLock func(ctx context.Context, sessionID string) (release func(), err error)

+ RenewObserver func(RenewOutcome)

+ RequestIsTLS func(*http.Request) bool

+ SessionGate func(Identity) error

+ StatePrefix string

+ type ConfigError struct

+ Err error

+ Field string

+ func (e *ConfigError) Error() string

+ func (e *ConfigError) Unwrap() error

+ type DeviceApproval struct

+ Reauth bool

+ RedirectURL string

+ type DeviceAuditDetail struct

+ ClientHostname string

+ ClientIP string

+ ClientUserAgent string

+ ExpiresAt time.Time

+ ID string

+ Reauth bool

+ type DeviceGrant struct

+ DeviceCode string

+ ExpiresIn time.Duration

+ Interval time.Duration

+ UserCode string

+ type DeviceRecord struct

+ Approver string

+ ApproverSession string

+ ClientHostname string

+ ClientIP string

+ ClientUserAgent string

+ CreatedAt time.Time

+ CredentialHash string

+ DecidedAt time.Time

+ DeviceHash string

+ ExpiresAt time.Time

+ Interval time.Duration

+ LastPolledAt time.Time

+ Reason string

+ Status DeviceStatus

+ Subject string

+ UserCodeHash string

+ type DeviceRequest struct

+ CredentialHash string

+ Hostname string

+ IP string

+ UserAgent string

+ type DeviceSession struct

+ ExpiresAt time.Time

+ ExpiresIn time.Duration

+ Identity Identity

+ IdleTimeout time.Duration

+ Revalidated bool

+ SessionID string

+ type DeviceStatus string

+ const DeviceStatusApproved

+ const DeviceStatusConsumed

+ const DeviceStatusDenied

+ const DeviceStatusPending

+ type DeviceStore interface

+ CountDevicesSince func(since time.Time) (int, error)

+ DeleteDevicesBefore func(cutoff time.Time) ([]DeviceRecord, error)

+ GetDevice func(deviceHash string) (DeviceRecord, error)

+ GetDeviceByUserCode func(userCodeHash string) (DeviceRecord, error)

+ PutDevice func(DeviceRecord) error

+ UpdateDevice func(deviceHash string, change func(*DeviceRecord) (bool, error)) (DeviceRecord, error)

+ func NewMemoryDeviceStore() DeviceStore

+ type DeviceTokenError struct

+ Code string

+ Description string

+ Interval time.Duration

+ func (e *DeviceTokenError) Error() string

+ type DeviceView struct

+ ClientHostname string

+ ClientIP string

+ ClientUserAgent string

+ CreatedAt time.Time

+ DecidedAt time.Time

+ DecidedByCaller bool

+ Expired bool

+ ExpiresAt time.Time

+ ExpiresIn time.Duration

+ Identity Identity

+ Reauth bool

+ SignedInAt time.Time

+ Status DeviceStatus

+ UserCode string

+ type ExpiryCutoffs struct

+ Absolute time.Time

+ CLIIdle time.Time

+ Idle time.Time

type Identity

+ AuthTime time.Time

+ OID string

+ Username string

+ type LiveCounter interface

+ CountLive func(c ExpiryCutoffs) (int, error)

type LoginOutcome

+ const LoginDevice

+ const LoginRenewal

+ type RenewOutcome string

+ const RenewDisabled

+ const RenewDiscoveryFailed

+ const RenewExchangeFailed

+ const RenewIdPError

+ const RenewInteractionRequired

+ const RenewInvalidState

+ const RenewNoSession

+ const RenewOK

+ const RenewPending

+ const RenewStateError

+ const RenewStoreError

+ const RenewSubjectMismatch

+ const RenewTokenInvalid

+ func (o RenewOutcome) Recorded() bool

type SessionAudit

+ Client string

+ Device *DeviceAuditDetail

+ Kind SessionKind

+ Via string

+ type SessionClock struct

+ ClaimAge time.Duration

+ ExpiresIn time.Duration

+ HasExpiry bool

+ MaxClaimAge time.Duration

+ Renew bool

+ RenewIn time.Duration

+ type SessionKind string

+ const SessionKindBrowser

+ const SessionKindCLI

type SessionRecord

+ Client string

+ Kind SessionKind

+ func (s SessionRecord) IsCLI() bool

+ func (s SessionRecord) KindName() string

+ type SessionState string

+ const SessionExpired

+ const SessionGone

+ const SessionIdle

+ const SessionLive

v0.0.4

Sep 27, 2026

v0.0.3

Sep 27, 2026

Changes in this version

+ const DefaultCallbackPath

type Authenticator

+ func (a *Authenticator) CallbackPath() string

v0.0.2

Sep 17, 2026

Changes in this version

+ const AuditSessionClaimsRejected

+ const AuditSessionClaimsStale

+ const AuditSessionClaimsUnverified

+ const AuditSessionRoleNarrowed

+ const DefaultClockSkew

+ const DefaultMaxClaimAge

+ const DefaultPreflightTimeout

+ const MaxClockSkew

+ const MaxMaxClaimAge

+ const PreflightIssuerMismatch

+ const PreflightMalformed

+ const PreflightNoJWKSURI

+ const PreflightNoKeys

+ const PreflightNotConfigured

+ const PreflightUnreachable

+ const PreflightUnverified

+ const StageDiscovery

+ const StageJWKS

+ var ErrClaimsRepudiated = errors.New("oidcauth: the identity provider refused to confirm this session's claims")

+ var ErrClaimsUnverifiable = errors.New(...)

type Authenticator

+ func (a *Authenticator) ClaimsRefused() uint64

+ func (a *Authenticator) EnsureFreshClaims(ctx context.Context, sessionID string) (SessionRecord, error)

+ func (a *Authenticator) IdPReady() error

+ func (a *Authenticator) MaxClaimAge() time.Duration

+ func (a *Authenticator) Preflight(ctx context.Context) (*PreflightResult, error)

+ func (a *Authenticator) RefreshClaimStats() (asserted, unverified uint64)

+ type ClaimFreshnessError struct

+ Age time.Duration

+ Err error

+ Limit time.Duration

+ Reason string

+ func (e *ClaimFreshnessError) Error() string

+ func (e *ClaimFreshnessError) Unwrap() error

type Config

+ ClockSkew time.Duration

+ EffectiveRole func(identity string, groups, roles []string) (role string, rank int)

+ MaxClaimAge time.Duration

+ type LoginOutcome string

+ const LoginDiscoveryFailed

+ const LoginExchangeFailed

+ const LoginIdPError

+ const LoginInvalidRequest

+ const LoginInvalidState

+ const LoginPending

+ const LoginSessionError

+ const LoginStateError

+ const LoginSuccess

+ const LoginTokenInvalid

+ func (o LoginOutcome) Recorded() bool

+ type PreflightError struct

+ Detail string

+ Err error

+ Issuer string

+ Reason string

+ Resolved *PreflightResult

+ Stage string

+ Status int

+ URL string

+ func (e *PreflightError) Error() string

+ func (e *PreflightError) Remediation() string

+ func (e *PreflightError) Unwrap() error

+ type PreflightOptions struct

+ Client *http.Client

+ Timeout time.Duration

+ type PreflightResult struct

+ AuthorizationEndpoint string

+ EndSessionEndpoint string

+ Issuer string

+ JWKSURI string

+ SigningKeys int

+ TokenEndpoint string

+ func Preflight(ctx context.Context, issuer string, opts PreflightOptions) (*PreflightResult, error)

+ type RefreshResult struct

+ CheckedAt time.Time

+ ClaimsAsOf time.Time

+ ClaimsAsserted bool

+ ClaimsExpireAt time.Time

+ Groups []string

+ RefreshToken string

+ Roles []string

type SessionAudit

+ DroppedClaims []string

+ PriorRole string

+ Role string

type SessionRecord

+ ClaimsAsOf time.Time

+ ClaimsExpireAt time.Time

+ func (s SessionRecord) ClaimAge(now time.Time) time.Duration

+ func (s SessionRecord) ClaimsAssertedAt() time.Time

+ func (s SessionRecord) ClaimsStale(now time.Time, maxAge time.Duration) bool

type SessionStore

+ ApplyRefresh func(id string, res RefreshResult) error

v0.0.1

Sep 13, 2026

Changes in this version

+ const AuditSessionCreated

+ const AuditSessionExpired

+ const AuditSessionIdPRevoked

+ const AuditSessionRevoked

+ const DefaultIdleTimeout

+ const DefaultRefreshInterval

+ const DefaultSessionTTL

+ const SessionCookieName

+ var ErrSessionNotFound = errors.New("oidcauth: session not found")

+ func HashSessionID(sessionID string) string

+ func RequestIP(r *http.Request) string

+ type Authenticator struct

+ func New(cfg Config) (*Authenticator, error)

+ func (a *Authenticator) BeginLogin(w http.ResponseWriter, r *http.Request)

+ func (a *Authenticator) Enabled() bool

+ func (a *Authenticator) EndSessionURL() string

+ func (a *Authenticator) HandleCallback(w http.ResponseWriter, r *http.Request)

+ func (a *Authenticator) IdentityFromRequest(r *http.Request) *Identity

+ func (a *Authenticator) IdleTimeout() time.Duration

+ func (a *Authenticator) IsAdmin(id *Identity) bool

+ func (a *Authenticator) Issuer() string

+ func (a *Authenticator) ListSessions() ([]SessionRecord, error)

+ func (a *Authenticator) Logout(w http.ResponseWriter, r *http.Request) *Identity

+ func (a *Authenticator) LogoutAll(subject, keepID, actor string) (int, error)

+ func (a *Authenticator) RevalidateDue(ctx context.Context) (int, int)

+ func (a *Authenticator) RevokeSession(id, actor, reason string) (bool, error)

+ func (a *Authenticator) RunJanitor(ctx context.Context)

+ func (a *Authenticator) SessionCount() int

+ func (a *Authenticator) SessionFromRequest(r *http.Request) (SessionRecord, bool)

+ func (a *Authenticator) SessionTTL() time.Duration

+ func (a *Authenticator) SweepExpired() int

+ type Config struct

+ AdminEmails []string

+ Audit func(SessionAudit)

+ ClientID string

+ ClientSecret string

+ Clock func() time.Time

+ CookieSecure string

+ Enabled bool

+ IdleTimeout time.Duration

+ Issuer string

+ RedirectURL string

+ RefreshInterval time.Duration

+ Scopes []string

+ SessionLimit func(identity string, groups, roles []string) int

+ SessionTTL time.Duration

+ Store SessionStore

+ type Identity struct

+ Email string

+ Groups []string

+ Name string

+ Roles []string

+ Sub string

+ func (id *Identity) DisplayName() string

+ func (id *Identity) OwnerKey() string

+ type SessionAudit struct

+ Actor string

+ At time.Time

+ Email string

+ Event string

+ IP string

+ Reason string

+ SessionID string

+ Subject string

+ UserAgent string

+ type SessionRecord struct

+ ExpiresAt time.Time

+ ID string

+ IP string

+ Identity Identity

+ IssuedAt time.Time

+ LastSeen time.Time

+ RefreshCheckedAt time.Time

+ RefreshToken string

+ UserAgent string

+ func (s SessionRecord) Expired(now time.Time) bool

+ func (s SessionRecord) Idle(now time.Time, timeout time.Duration) bool

+ type SessionStore interface

+ Delete func(id string) (bool, error)

+ DeleteBySubject func(subject, keepID string) ([]SessionRecord, error)

+ DeleteExpired func(absoluteCutoff, idleCutoff time.Time) ([]SessionRecord, error)

+ DueForRefresh func(cutoff time.Time, limit int) ([]SessionRecord, error)

+ Get func(id string) (SessionRecord, error)

+ List func() ([]SessionRecord, error)

+ Put func(SessionRecord) error

+ SetRefresh func(id, refreshToken string, checkedAt time.Time) error

+ Touch func(id string, t time.Time) error

+ func NewMemorySessionStore(max int) SessionStore

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL