auth

package
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 18, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package auth implements the OAuth 2.0 Device Authorization Grant (RFC 8628) over OIDC discovery: discover the issuer's endpoints, request a device code, prompt the user to approve in a browser, then poll for the token. One code path serves any OIDC provider with discovery and the device grant — e.g. Keycloak or Okta for self-hosted, Auth0 for DBOS-managed.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config 

type Config struct {
	Issuer     string
	ClientID   string
	Audience   string   // optional; Auth0 requires it, Keycloak ignores it
	Scopes     []string // e.g. "openid", "offline_access"
	HTTPClient *http.Client
}

Config configures a device-flow login.

type DeviceAuth 

type DeviceAuth struct {
	DeviceCode              string
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	ExpiresIn               int
	Interval                int
}

DeviceAuth is what the user must act on to approve the login.

type Provider 

type Provider struct {
	Issuer                      string
	DeviceAuthorizationEndpoint string
	TokenEndpoint               string
}

Provider holds the OIDC endpoints discovered from an issuer.

func Discover 

func Discover(ctx context.Context, hc *http.Client, issuer string) (*Provider, error)

Discover fetches {issuer}/.well-known/openid-configuration.

type Token 

type Token struct {
	AccessToken  string
	RefreshToken string
	TokenType    string
	ExpiresIn    int
}

Token is a successful device-flow result.

func Login 

func Login(ctx context.Context, cfg Config, prompt func(DeviceAuth)) (*Token, error)

Login runs the full device flow: discover → request device code → prompt → poll → token. prompt is called once with the verification details so the caller can tell the user where to approve.

func Refresh 

func Refresh(ctx context.Context, cfg Config, refreshToken string) (*Token, error)

Refresh exchanges a refresh token for a fresh access token (RFC 6749 §6), rediscovering the token endpoint from the issuer. A rotated refresh token, if the provider returns one, is on the result.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.