auth

package
v0.644.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 3, 2026 License: MIT Imports: 21 Imported by: 0

Documentation

Index

Constants

View Source
const (
	ClaudeClientID          = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
	ClaudeAuthorizeURL      = "https://claude.ai/oauth/authorize"
	ClaudeTokenURL          = "https://platform.claude.com/v1/oauth/token"
	ClaudeProfileURL        = "https://api.anthropic.com/api/oauth/profile"
	ClaudeOAuthBetaHeader   = "oauth-2025-04-20"
	ClaudeManualRedirectURL = "https://platform.claude.com/oauth/code/callback"
	ClaudeSuccessURL        = "https://claude.ai/oauth/code/success?app=claude-code"
	ClaudeOAuthScopes       = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload"
)
View Source
const (
	CopilotClientID = "Ov23li8tweQw6odWQebz"
)

Variables

This section is empty.

Functions

func CheckCopilotModelsAPI

func CheckCopilotModelsAPI(token, baseURL string) error

CheckCopilotModelsAPI verifies that the Copilot models API endpoint is reachable using the provided bearer token and base URL.

func ClaudeLogout added in v0.16.0

func ClaudeLogout() error

func CopilotAPIBaseURL

func CopilotAPIBaseURL(enterpriseURL string) string

func CopilotDeviceFlowInstructions

func CopilotDeviceFlowInstructions(deviceCode CopilotDeviceCode) string

func CopilotSessionFilePath

func CopilotSessionFilePath() (string, error)

func CopilotTokenExchangeDisabled added in v0.644.0

func CopilotTokenExchangeDisabled() bool

CopilotTokenExchangeDisabled reports whether the user opted out of the token exchange, forcing the legacy behaviour of sending the raw OAuth token.

func DeleteCopilotSession

func DeleteCopilotSession() error

func InstallOAuthTokens added in v0.236.0

func InstallOAuthTokens(tokens *ClaudeOAuthToken) error

func IsCopilotAPIToken added in v0.644.0

func IsCopilotAPIToken(token string) bool

IsCopilotAPIToken reports whether the token already is an exchanged Copilot API token (they are opaque "tid=...;exp=..." strings) rather than a GitHub OAuth token. Exchanging one of these again is not possible.

func LoadClaudeBearerToken added in v0.503.5

func LoadClaudeBearerToken() (string, error)

LoadClaudeBearerToken returns a valid Claude.ai OAuth access token, refreshing and persisting it when expired. It mirrors the token resolution the Anthropic provider performs at request time (see provider.go) so model-listing code paths can authenticate OAuth-based Anthropic accounts that have no API key. Returns an empty string (and no error) when no Claude credentials are configured.

func LoadGitHubOAuthToken

func LoadGitHubOAuthToken() (string, error)

func NormalizeGitHubDomain

func NormalizeGitHubDomain(value string) string

func OpenBrowser

func OpenBrowser(url string) error

func ResolveCopilotAPIAccess added in v0.644.0

func ResolveCopilotAPIAccess(ctx context.Context, token, enterpriseURL, configuredBaseURL string) (string, string)

ResolveCopilotAPIAccess returns the bearer token and API base URL to use for Copilot requests. It exchanges the GitHub OAuth token for a Copilot API token so that organization BYOK custom models become visible, and falls back to the supplied token and base URL when the exchange is unavailable.

configuredBaseURL, when non-empty, always wins: an explicitly configured host must not be silently replaced by the one advertised by GitHub.

func SaveClaudeCodeCredentials added in v0.220.0

func SaveClaudeCodeCredentials(creds *ClaudeCredentials) error

func SaveClaudeCredentials added in v0.16.0

func SaveClaudeCredentials(creds *ClaudeCredentials) error

func SaveCopilotSession

func SaveCopilotSession(session CopilotSession) error

func ValidateCopilotToken

func ValidateCopilotToken(ctx context.Context, session CopilotSession) error

Types

type ClaudeAuthStatus added in v0.16.0

type ClaudeAuthStatus struct {
	Authenticated    bool
	AccessToken      string
	SubscriptionType string
	DisplayName      string
	Email            string
	Source           string
}

func GetClaudeAuthStatus added in v0.16.0

func GetClaudeAuthStatus() (*ClaudeAuthStatus, error)

type ClaudeAutoCode added in v0.20.0

type ClaudeAutoCode struct {
	Code        string
	RedirectURI string
	Err         error
}

type ClaudeCredentials added in v0.16.0

type ClaudeCredentials struct {
	ClaudeAiOauth    *ClaudeOAuthToken `json:"claudeAiOauth"`
	OrganizationUUID string            `json:"organizationUuid,omitempty"`
}

func ClaudeLoginFinish added in v0.20.0

func ClaudeLoginFinish(session *ClaudeLoginSession, code, redirectURI string) (*ClaudeCredentials, string, error)

func GetClaudeToken added in v0.236.0

func GetClaudeToken(creds *ClaudeCredentials) (string, *ClaudeCredentials, error)

func LoadClaudeCredentials added in v0.16.0

func LoadClaudeCredentials() (*ClaudeCredentials, string, error)

type ClaudeLoginSession added in v0.20.0

type ClaudeLoginSession struct {
	ManualURL       string
	AutoURL         string
	AutoCodeCh      <-chan ClaudeAutoCode
	AutoRedirectURI string
	// contains filtered or unexported fields
}

func ClaudeLoginStart added in v0.20.0

func ClaudeLoginStart() (*ClaudeLoginSession, error)

func (*ClaudeLoginSession) Cancel added in v0.20.0

func (s *ClaudeLoginSession) Cancel()

func (*ClaudeLoginSession) ExtractCodeFromInput added in v0.20.0

func (s *ClaudeLoginSession) ExtractCodeFromInput(input string) string

type ClaudeOAuthToken added in v0.16.0

type ClaudeOAuthToken struct {
	AccessToken      string   `json:"accessToken"`
	RefreshToken     string   `json:"refreshToken,omitempty"`
	ExpiresAt        int64    `json:"expiresAt"`
	Scopes           []string `json:"scopes,omitempty"`
	SubscriptionType string   `json:"subscriptionType,omitempty"`
	RateLimitTier    string   `json:"rateLimitTier,omitempty"`
}

func RefreshOAuthToken added in v0.236.0

func RefreshOAuthToken(refreshToken string, scopes []string) (*ClaudeOAuthToken, error)

type ClaudeProfile added in v0.16.0

type ClaudeProfile struct {
	Account      ClaudeProfileAccount      `json:"account"`
	Organization ClaudeProfileOrganization `json:"organization"`
}

func GetClaudeProfile added in v0.16.0

func GetClaudeProfile(accessToken string) (*ClaudeProfile, error)

type ClaudeProfileAccount added in v0.20.0

type ClaudeProfileAccount struct {
	DisplayName  string `json:"display_name"`
	EmailAddress string `json:"email_address"`
	CreatedAt    string `json:"created_at"`
}

type ClaudeProfileOrganization added in v0.20.0

type ClaudeProfileOrganization struct {
	UUID                  string `json:"uuid"`
	OrganizationType      string `json:"organization_type"`
	RateLimitTier         string `json:"rate_limit_tier"`
	HasExtraUsageEnabled  bool   `json:"has_extra_usage_enabled"`
	BillingType           string `json:"billing_type"`
	SubscriptionCreatedAt string `json:"subscription_created_at"`
}

type CopilotAPIToken added in v0.644.0

type CopilotAPIToken struct {
	Token         string
	ExpiresAt     int64
	APIEndpoint   string
	Organizations []string
	SKU           string
}

CopilotAPIToken is the result of exchanging a GitHub OAuth token for a short-lived Copilot API token.

func ExchangeCopilotAPIToken added in v0.644.0

func ExchangeCopilotAPIToken(ctx context.Context, oauthToken, enterpriseURL string) (*CopilotAPIToken, error)

ExchangeCopilotAPIToken trades a GitHub OAuth token for a short-lived Copilot API token. Results are cached in memory until shortly before expiry.

type CopilotAuthStatus

type CopilotAuthStatus struct {
	Authenticated bool
	Source        string
	EnterpriseURL string
	Message       string
}

func GetCopilotAuthStatus

func GetCopilotAuthStatus() CopilotAuthStatus

type CopilotDeviceCode

type CopilotDeviceCode struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`
	Interval        int    `json:"interval"`
	ExpiresIn       int    `json:"expires_in"`
}

func StartCopilotDeviceFlow

func StartCopilotDeviceFlow(ctx context.Context, enterpriseURL string) (*CopilotDeviceCode, error)

type CopilotSession

type CopilotSession struct {
	Provider      string `json:"provider,omitempty"`
	AccessToken   string `json:"access_token"`
	TokenType     string `json:"token_type,omitempty"`
	Scope         string `json:"scope,omitempty"`
	ExpiresAt     int64  `json:"expires_at,omitempty"`
	EnterpriseURL string `json:"enterprise_url,omitempty"`
	CreatedAt     int64  `json:"created_at,omitempty"`
}

func CompleteCopilotDeviceFlow

func CompleteCopilotDeviceFlow(ctx context.Context, enterpriseURL string, deviceCode *CopilotDeviceCode) (*CopilotSession, error)

func LoadCopilotSession

func LoadCopilotSession() (*CopilotSession, error)

func PollCopilotDeviceFlow

func PollCopilotDeviceFlow(ctx context.Context, enterpriseURL string, deviceCode *CopilotDeviceCode) (*CopilotSession, error)

type GitHubTokenCandidate added in v0.644.0

type GitHubTokenCandidate struct {
	Source string
	Token  string
}

GitHubTokenCandidate is a GitHub OAuth token discovered locally, tagged with where it came from.

func GitHubOAuthTokenCandidates added in v0.644.0

func GitHubOAuthTokenCandidates() []GitHubTokenCandidate

GitHubOAuthTokenCandidates returns every usable GitHub OAuth token found on this machine, in the same priority order LoadGitHubOAuthToken applies. Not all of them can be exchanged for a Copilot API token (only tokens issued to an app with Copilot entitlement can), so callers that need the exchanged token walk the list instead of taking just the first entry.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL