Documentation
¶
Overview ¶
Package auth provides simplified GitHub-based OAuth for local product edges.
This implements a minimal OAuth 2.1 authorization server that: - Delegates identity verification to GitHub - Issues signed bearer tokens with proper resource (audience) binding per RFC 8707 - Validates bearer tokens on protected endpoints
The flow is: 1. Client calls /auth/authorize with resource + PKCE 2. Server redirects to GitHub for authentication 3. GitHub redirects back to /auth/callback 4. Server verifies org membership, issues authorization code 5. Client exchanges code for bearer tokens at /auth/token 6. Client uses bearer tokens to access product endpoints
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthUser ¶
AuthUser is the authenticated user info attached to request context.
func GetAuthUser ¶
GetAuthUser returns the authenticated user from context.
type Config ¶
type Config struct {
Enabled bool `yaml:"enabled"`
GitHub *GitHubConfig `yaml:"github,omitempty"`
AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
Tokens TokensConfig `yaml:"tokens"`
}
Config holds OAuth server configuration for a local product edge.
type GitHubConfig ¶
type GitHubConfig struct {
ClientID string `yaml:"client_id"`
ClientSecret string `yaml:"client_secret"`
}
GitHubConfig holds GitHub OAuth configuration.
type SimpleService ¶
type SimpleService interface {
Start(ctx context.Context) error
Stop() error
Enabled() bool
Middleware() func(http.Handler) http.Handler
MountRoutes(r chi.Router)
}
SimpleService is the simplified auth service interface.
func NewSimpleService ¶
func NewSimpleService(log logrus.FieldLogger, cfg Config, baseURL string) (SimpleService, error)
NewSimpleService creates a new simplified auth service.
type TokensConfig ¶
type TokensConfig struct {
SecretKey string `yaml:"secret_key"`
}
TokensConfig holds signed access token configuration.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package client provides an OAuth PKCE client for local authentication.
|
Package client provides an OAuth PKCE client for local authentication. |
|
Package github provides GitHub OAuth integration.
|
Package github provides GitHub OAuth integration. |
|
Package store provides local credential storage for OAuth tokens.
|
Package store provides local credential storage for OAuth tokens. |