Documentation
¶
Overview ¶
Package auth provides simplified GitHub-based OAuth for local product edges.
This implements a minimal OAuth 2.1 authorization server that: - Delegates identity verification to GitHub - Issues signed bearer tokens with proper resource (audience) binding per RFC 8707 - Validates bearer tokens on protected endpoints
The flow is: 1. Client calls /auth/authorize with resource + PKCE 2. Server redirects to GitHub for authentication 3. GitHub redirects back to /auth/callback 4. Server verifies org membership, issues authorization code 5. Client exchanges code for bearer tokens at /auth/token 6. Client uses bearer tokens to access product endpoints
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthUser ¶
AuthUser is the authenticated user info attached to request context.
func GetAuthUser ¶
GetAuthUser returns the authenticated user from context.
type Config ¶
type Config struct {
Enabled bool `yaml:"enabled"`
GitHub *GitHubConfig `yaml:"github,omitempty"`
AllowedOrgs []string `yaml:"allowed_orgs,omitempty"`
Tokens TokensConfig `yaml:"tokens"`
SuccessPage *SuccessPageConfig `yaml:"success_page,omitempty"`
}
Config holds OAuth server configuration for a local product edge.
type GitHubConfig ¶
type GitHubConfig struct {
ClientID string `yaml:"client_id"`
ClientSecret string `yaml:"client_secret"`
}
GitHubConfig holds GitHub OAuth configuration.
type SimpleService ¶
type SimpleService interface {
Start(ctx context.Context) error
Stop() error
Enabled() bool
Middleware() func(http.Handler) http.Handler
MountRoutes(r chi.Router)
}
SimpleService is the simplified auth service interface.
func NewSimpleService ¶
func NewSimpleService(log logrus.FieldLogger, cfg Config) (SimpleService, error)
NewSimpleService creates a new simplified auth service. The base URL for OAuth metadata and token issuance is derived from each incoming request's Host header, so no static base URL is required.
type SuccessPageConfig ¶ added in v0.2.0
type SuccessPageConfig struct {
Rules []SuccessPageRule `yaml:"rules,omitempty"`
Default *SuccessPageDisplay `yaml:"default,omitempty"`
}
SuccessPageConfig defines rules for customizing the OAuth success page. Rules are evaluated in order; the first match wins.
func (*SuccessPageConfig) Resolve ¶ added in v0.2.0
func (c *SuccessPageConfig) Resolve(login string, orgs []string) SuccessPageDisplay
Resolve evaluates rules against the given user and returns the display configuration for the first matching rule, or the default.
type SuccessPageDisplay ¶ added in v0.2.0
type SuccessPageDisplay struct {
Tagline string `yaml:"tagline,omitempty"`
Media *SuccessPageMedia `yaml:"media,omitempty"`
}
SuccessPageDisplay holds the customizable content shown on the success page.
type SuccessPageMatch ¶ added in v0.2.0
type SuccessPageMatch struct {
Orgs []string `yaml:"orgs,omitempty"`
Users []string `yaml:"users,omitempty"`
}
SuccessPageMatch defines the conditions under which a rule applies. All specified fields must match (AND logic).
type SuccessPageMedia ¶ added in v0.2.0
type SuccessPageMedia struct {
// Type is "gif" or "ascii".
Type string `yaml:"type"`
// URL is the image source when Type is "gif".
URL string `yaml:"url,omitempty"`
// ASCIIArtBase64 is base64-encoded ASCII art when Type is "ascii".
ASCIIArtBase64 string `yaml:"ascii_art_base64,omitempty"`
}
SuccessPageMedia defines the media block shown on the success page.
type SuccessPageRule ¶ added in v0.2.0
type SuccessPageRule struct {
Match SuccessPageMatch `yaml:"match"`
SuccessPageDisplay `yaml:",inline"`
}
SuccessPageRule pairs a match condition with display content.
type TokensConfig ¶
type TokensConfig struct {
SecretKey string `yaml:"secret_key"`
}
TokensConfig holds signed access token configuration.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package client provides an OAuth PKCE client for local authentication.
|
Package client provides an OAuth PKCE client for local authentication. |
|
Package github provides GitHub OAuth integration.
|
Package github provides GitHub OAuth integration. |
|
Package store provides local credential storage for OAuth tokens.
|
Package store provides local credential storage for OAuth tokens. |