providerauth

package
v0.12.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 10, 2026 License: MIT Imports: 19 Imported by: 0

Documentation

Overview

Package providerauth manages OAuth-backed provider accounts without exposing durable secrets to provider configuration or UI/API callers.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrUnsupportedMethod     = errors.New("unsupported provider auth method")
	ErrUnsupportedGHES       = errors.New("GitHub Enterprise Server is not supported")
	ErrFlowNotFound          = errors.New("provider auth flow not found")
	ErrFlowExpired           = errors.New("provider auth flow expired")
	ErrAuthorizationPending  = errors.New("provider authorization pending")
	ErrAccessDenied          = errors.New("provider authorization denied")
	ErrAccountNotFound       = errors.New("provider auth account not found")
	ErrRequiresReauth        = errors.New("provider auth account requires reauthentication")
	ErrNoCopilotSubscription = errors.New("GitHub account has no Copilot subscription")
	ErrInvalidBinding        = errors.New("invalid provider auth binding")
)

Functions

This section is empty.

Types

type Account 

type Account struct {
	ID              string    `json:"id"`
	Login           string    `json:"login"`
	AuthenticatedAt time.Time `json:"authenticated_at"`
	RequiresReauth  bool      `json:"requires_reauth"`
}

Account is the non-secret account projection exposed to clients.

type Binding 

type Binding struct {
	Method    Method `json:"method"`
	AccountID string `json:"account_id,omitempty"`
}

Binding is the non-secret value stored on a Provider configuration.

type Credential 

type Credential struct {
	Token     string            `json:"-"`
	AccountID string            `json:"account_id"`
	BaseURL   string            `json:"base_url"`
	Protocol  Protocol          `json:"protocol"`
	Headers   map[string]string `json:"headers,omitempty"`
}

Credential is resolved immediately before an upstream request. Token is intentionally excluded from JSON serialization to prevent accidental API or log exposure.

type Endpoints 

type Endpoints struct {
	CodexDeviceStart   string
	CodexDevicePoll    string
	CodexToken         string
	CodexVerification  string
	CodexRuntime       string
	XAIDiscovery       string
	XAIRuntime         string
	CopilotDeviceStart string
	CopilotOAuthToken  string
	CopilotUser        string
	CopilotToken       string
	CopilotUsage       string
	CopilotRuntime     string
}

Endpoints contains managed upstream endpoints. The zero value selects the production endpoints. Non-zero overrides are intended only for hermetic tests and require AllowInsecureTestEndpoints when they are not trusted HTTPS origins.

type Flow 

type Flow struct {
	ID                      string    `json:"flow_id"`
	Method                  Method    `json:"method"`
	State                   FlowState `json:"state"`
	UserCode                string    `json:"user_code"`
	VerificationURI         string    `json:"verification_uri"`
	VerificationURIComplete string    `json:"verification_uri_complete,omitempty"`
	ExpiresAt               time.Time `json:"expires_at"`
	IntervalSeconds         int       `json:"interval_seconds,omitempty"`
	Account                 *Account  `json:"account,omitempty"`
	Error                   string    `json:"error,omitempty"`
}

Flow is the public device-flow projection. Upstream device tokens and PKCE material are deliberately absent and remain in process memory only.

type FlowState 

type FlowState string

FlowState is the public state of a device authorization flow. 

const (
	FlowStatePending    FlowState = "pending"
	FlowStateAuthorized FlowState = "authorized"
	FlowStateDenied     FlowState = "denied"
	FlowStateExpired    FlowState = "expired"
)

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager coordinates device flows, durable accounts, token refresh and runtime credential resolution for all managed login methods.

func Default 

func Default(configDir string) (*Manager, error)

Default returns a process-wide Manager keyed by absolute config directory.

func NewManager 

func NewManager(options Options) (*Manager, error)

NewManager creates an isolated manager with injectable dependencies.

func (*Manager) Cancel 

func (manager *Manager) Cancel(method Method, flowID string) error

Cancel destroys an in-memory device authorization flow.

func (*Manager) Credential 

func (manager *Manager) Credential(ctx context.Context, binding Binding) (Credential, error)

Credential resolves a fresh runtime token and the immutable managed runtime profile for a Provider binding.

func (*Manager) Logout 

func (manager *Manager) Logout(_ context.Context, method Method) error

Logout removes all accounts and pending flows for a login method.

func (*Manager) Models 

func (manager *Manager) Models(ctx context.Context, binding Binding) ([]Model, error)

Models returns the live, account-scoped model catalog for a managed login. Credentials are resolved immediately before the request and never included in the returned projection or an error body.

func (*Manager) Poll 

func (manager *Manager) Poll(ctx context.Context, method Method, flowID string) (Flow, error)

Poll advances a device authorization flow by one upstream poll.

func (*Manager) Remove 

func (manager *Manager) Remove(_ context.Context, method Method, accountID string) error

Remove removes one durable account without changing Provider bindings.

func (*Manager) SetDefault 

func (manager *Manager) SetDefault(_ context.Context, method Method, accountID string) error

SetDefault selects the default usable account for a login method.

func (*Manager) Start 

func (manager *Manager) Start(ctx context.Context, method Method) (Flow, error)

Start starts a provider device authorization flow.

func (*Manager) Status 

func (manager *Manager) Status(_ context.Context, method Method) (Status, error)

Status returns non-secret account information for one login method.

func (*Manager) ValidateBinding 

func (manager *Manager) ValidateBinding(_ context.Context, binding Binding) error

ValidateBinding verifies that a binding resolves to a usable local account.

type Method 

type Method string

Method identifies a managed provider login mechanism. 

const (
	MethodCodexOAuth    Method = "codex_oauth"
	MethodXAIOAuth      Method = "xai_oauth"
	MethodGitHubCopilot Method = "github_copilot"
)

type Model 

type Model struct {
	ID       string    `json:"id"`
	Name     string    `json:"name,omitempty"`
	Vendor   string    `json:"vendor,omitempty"`
	Protocol Protocol  `json:"protocol"`
	Kind     ModelKind `json:"kind"`
}

Model is a non-secret model projection returned by a managed provider's account-scoped catalog. Protocol is the wire format required by that model; Copilot may mix OpenAI Responses models with chat-completions models in one account catalog.

type ModelKind 

type ModelKind string

ModelKind separates inference catalogs that share /models but require different product surfaces and wire protocols. 

const (
	ModelKindChat  ModelKind = "chat"
	ModelKindImage ModelKind = "image"
	ModelKindVideo ModelKind = "video"
)

type Options 

type Options struct {
	ConfigDir                  string
	HTTPClient                 *http.Client
	Now                        func() time.Time
	Rand                       io.Reader
	Endpoints                  Endpoints
	AllowInsecureTestEndpoints bool
}

Options supplies dependencies for Manager. ConfigDir is required. HTTPClient, Now and Rand are injectable to keep tests deterministic and offline.

type Protocol 

type Protocol string

Protocol is the wire protocol required by a managed provider runtime. 

const (
	ProtocolResponses       Protocol = "responses"
	ProtocolChatCompletions Protocol = "chat_completions"
)

type Service 

type Service interface {
	Start(context.Context, Method) (Flow, error)
	Poll(context.Context, Method, string) (Flow, error)
	Cancel(Method, string) error
	Status(context.Context, Method) (Status, error)
	SetDefault(context.Context, Method, string) error
	Remove(context.Context, Method, string) error
	Logout(context.Context, Method) error
	ValidateBinding(context.Context, Binding) error
	Credential(context.Context, Binding) (Credential, error)
	Models(context.Context, Binding) ([]Model, error)
}

Service is the consuming-package-friendly contract implemented by Manager.

type Status 

type Status struct {
	Method           Method    `json:"method"`
	Accounts         []Account `json:"accounts"`
	DefaultAccountID string    `json:"default_account_id,omitempty"`
	Authenticated    bool      `json:"authenticated"`
}

Status describes all locally stored accounts for one login method.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.