auth

func CheckAuth ¶

func CheckAuth(ctx context.Context) (token string, ok bool)

CheckAuth reports whether a usable token is already available, without running the interactive login flow on a miss. Unlike EnsureAuth, this never opens a browser: it's for callers (like the 'context' discovery tool) that want to report auth status rather than force it.

func EnsureAuth ¶

func EnsureAuth(ctx context.Context) (string, error)

func Reauthenticate ¶

func Reauthenticate(ctx context.Context) (string, error)

Reauthenticate is EnsureAuth, deduplicated against concurrent callers (see reauthenticate). Intended for a 401 retry path: EnsureAuth already tries a silent token refresh before falling back to an interactive login, so this never forces a browser login when a refresh would do - and when a refresh genuinely isn't enough, concurrent requests share one login attempt instead of each opening their own browser window.

func RunLoginFlow ¶

func RunLoginFlow(ctx context.Context, verbose bool) error

RunLoginFlow performs the PKCE OAuth2 login and stores credentials in keyring.