Documentation
¶
Overview ¶
Package device provides DataTug's shared auth.sneat.co device-login command.
Package device provides DataTug's shared auth.sneat.co device-login command.
Index ¶
- Variables
- func Command() *cobra.Command
- func LoginCommand() *cobra.Command
- func LogoutCommand() *cobra.Command
- func ProductBearer(ctx context.Context, options ProductOptions) (string, error)
- func ProductCommand() *cobra.Command
- func SavedTokenSource(ctx context.Context, insecure bool) (oauth2.TokenSource, error)
- func StatusCommand() *cobra.Command
- func WhoamiCommand() *cobra.Command
- type ProductOptions
- type ProductReadCredential
- type RefreshSession
- type Session
- type SignInOptions
- type TokenSource
Constants ¶
This section is empty.
Variables ¶
var ErrNotSignedIn = errors.New("not signed in to DataTug")
ErrNotSignedIn is returned by EnsureSignedIn when there is no saved login and signing in was not allowed.
Functions ¶
func Command ¶
Command returns the DataTug auth.sneat.co commands. It is separate from auth google and the GitHub repository authorization flow, which grant different provider permissions and remain unchanged.
func LoginCommand ¶
LoginCommand, StatusCommand, and LogoutCommand are mounted directly under `datatug auth` so the shared sign-in has the conventional CLI shape.
func LogoutCommand ¶
func ProductBearer ¶ added in v0.132.0
func ProductBearer(ctx context.Context, options ProductOptions) (string, error)
ProductBearer validates current product state for each request. No cached credential or successful earlier call can extend the original hard expiry.
func ProductCommand ¶ added in v0.132.0
ProductCommand is additive: the existing auth login/status/logout retain their legacy behavior until the coordinated credential-family cutover.
func SavedTokenSource ¶ added in v0.51.0
SavedTokenSource loads the DataTug CLI's own audience- and product-scoped login. It never borrows a Sneat or Google credential. The insecure flag must match the explicit --insecure-storage choice made during auth login.
func StatusCommand ¶
func WhoamiCommand ¶ added in v0.131.0
WhoamiCommand returns the top-level `datatug whoami` command. It reports the signed-in DataTug account (auth.sneat.co) in the same human-facing style as `wrangler whoami`. It is mounted at the root because it is the everyday "am I signed in, and as whom?" command; it is not a credential-management verb the way login/status/logout are.
Types ¶
type ProductOptions ¶ added in v0.132.0
ProductOptions selects a separate credential family. It never loads the legacy Firebase account, exchanges a custom token, or refreshes a session.
type ProductReadCredential ¶ added in v0.132.1
ProductReadCredential preserves the verified login identity and its original hard expiry through buffered reads. It is never an authorization decision.
func ProductCredentialForRead ¶ added in v0.132.1
func ProductCredentialForRead(ctx context.Context, options ProductOptions) (ProductReadCredential, error)
type RefreshSession ¶
RefreshSession exchanges a Firebase refresh token for the current session. It is injected so the identity endpoint is never hard-wired in tests.
type Session ¶ added in v0.141.0
type Session struct {
Token func(context.Context) (string, error)
// Email is the signed-in account's email from the session's claims, for
// messages only; "" when unknown.
Email string
}
Session is a saved DataTug login. Token refreshes the Firebase session a minute before it expires and is safe for concurrent use.
func EnsureSignedIn ¶ added in v0.141.0
func EnsureSignedIn(ctx context.Context, opts SignInOptions) (Session, error)
EnsureSignedIn returns the saved login, running the same device flow as `datatug auth login` first when there is none and opts.Interactive is set. The login is stored only where `auth login` stores it.
type SignInOptions ¶ added in v0.141.0
type SignInOptions struct {
// Issuer overrides DATATUG_AUTH_HOST and the default issuer when set.
Issuer string
// Insecure uses the 0600 file store of --insecure-storage.
Insecure bool
// Interactive lets EnsureSignedIn run the device flow when no login is
// saved; otherwise a missing login is ErrNotSignedIn.
Interactive bool
// Out and ErrOut receive the device flow's URL, code and warnings.
Out, ErrOut io.Writer
}
SignInOptions say where the login is kept and whether EnsureSignedIn may start the device flow.
type TokenSource ¶
type TokenSource struct {
// contains filtered or unexported fields
}
TokenSource loads the DataTug Firebase session, refreshes it before expiry, and atomically replaces the scoped credential before returning a bearer. Authenticated DataTug commands use this rather than a static one-shot token.
func (*TokenSource) TokenContext ¶ added in v0.51.0
TokenContext lets a long-running client bound a refresh by its individual request deadline. Token() retains oauth2.TokenSource compatibility.
Source Files