auth

type BasicAuth ¶

type BasicAuth struct {
	Email  string
	APIKey string
}

BasicAuth applies Freelo's HTTP Basic auth: email as username, API key as password. Both fields are required; Apply returns ErrMissingCredentials if either is empty so the caller fails fast rather than sending an unauthenticated request.

For static credentials read once at startup. For credentials that need to be looked up per request (env-var override → keyring fallback, etc.), use CredentialsFunc instead.

func (b BasicAuth) Apply(_ context.Context, req *http.Request) error

type CredentialsFunc ¶

type CredentialsFunc func(ctx context.Context) (email, apiKey string, err error)

CredentialsFunc adapts any per-request credential lookup to the Provider interface. The function is called on every outgoing request; the returned (email, apiKey) pair is applied as Basic auth.

Typical use:

auth.CredentialsFunc(func(ctx context.Context) (string, string, error) {
    if e, k := os.Getenv("FREELO_EMAIL"), os.Getenv("FREELO_API_KEY"); e != "" && k != "" {
        return e, k, nil
    }
    return myKeyring.Lookup(ctx)
})

Returning an error short-circuits the request — the transport surfaces the error to the caller without contacting the API.

func (f CredentialsFunc) Apply(ctx context.Context, req *http.Request) error

type Provider ¶

type Provider interface {
	Apply(ctx context.Context, req *http.Request) error
}

Provider authenticates an outgoing HTTP request. Implementations apply themselves by mutating the request (typically via SetBasicAuth or req.Header.Set("Authorization", ...)). Apply receives a context so implementations can call out to async credential sources (vaults, keyrings, token endpoints) without blocking indefinitely.

type Refresher ¶

type Refresher interface {
	Refresh(ctx context.Context) error
}

Refresher is implemented by providers whose credentials can be refreshed (OAuth access tokens, time-limited STS-style creds, ...). The transport calls Refresh at most once per response cycle, on 401, before retrying.

BasicAuth does not implement Refresher — its credentials don't expire.