Help us shape the future of Go! Take the 2026 Go Developer Survey

oidc

package
v2.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 13, 2026 License: BSD-3-Clause Imports: 41 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func RegisterOidc

func RegisterOidc(
	api huma.API,
	authService *auth.AuthService,
	passkeyService *passkey.PasskeyService,
	oidcService *OidcService,
	roleService *role.RoleService,
	userService *user.UserService,
	cfg *config.Config,
)

RegisterOidc registers all OIDC authentication endpoints (plus the OIDC group → role mapping CRUD) using Huma.

Types

type CreateOidcRoleMappingInput

type CreateOidcRoleMappingInput struct {
	Body roletypes.CreateOidcRoleMapping
}

type DeleteOidcRoleMappingInput

type DeleteOidcRoleMappingInput struct {
	ID string `path:"id" doc:"Mapping ID"`
}

type DeleteOidcRoleMappingOutput

type DeleteOidcRoleMappingOutput struct {
	Body struct {
		Success bool   `json:"success"`
		Message string `json:"message"`
	}
}

type ExchangeDeviceTokenInput

type ExchangeDeviceTokenInput struct {
	UserAgent string `header:"User-Agent"`
	Body      authtypes.OidcDeviceTokenRequest
}

type ExchangeDeviceTokenOutput

type ExchangeDeviceTokenOutput struct {
	Body authtypes.AuthenticationResponse
}

type GetOidcAuthUrlInput

type GetOidcAuthUrlInput struct {
	OidcHeaders

	Body authtypes.OidcAuthUrlRequest
}

type GetOidcAuthUrlOutput

type GetOidcAuthUrlOutput struct {
	SetCookie string `header:"Set-Cookie" doc:"OIDC state cookie"`
	Body      authtypes.OidcAuthUrlResponse
}

type GetOidcConfigInput

type GetOidcConfigInput struct {
	OidcHeaders
}

type GetOidcConfigOutput

type GetOidcConfigOutput struct {
	Body authtypes.OidcConfigResponse
}

type GetOidcStatusInput

type GetOidcStatusInput struct{}

type GetOidcStatusOutput

type GetOidcStatusOutput struct {
	Body authtypes.OidcStatusInfo
}

type HandleOidcCallbackInput

type HandleOidcCallbackInput struct {
	OidcHeaders

	OidcStateCookie string `cookie:"oidc_state" doc:"OIDC state cookie from auth URL request"`
	Body            authtypes.OidcCallbackRequest
}

type HandleOidcCallbackOutput

type HandleOidcCallbackOutput struct {
	SetCookie []string `header:"Set-Cookie" doc:"Session and clear state cookies"`
	Body      authtypes.OidcCallbackResponse
}

type InitiateDeviceAuthInput

type InitiateDeviceAuthInput struct{}

type InitiateDeviceAuthOutput

type InitiateDeviceAuthOutput struct {
	Body authtypes.OidcDeviceAuthResponse
}

type ListOidcRoleMappingsInput

type ListOidcRoleMappingsInput struct{}

type OidcHandler

type OidcHandler struct {
	// contains filtered or unexported fields
}

OidcHandler handles OIDC authentication endpoints, plus OIDC group → role mapping management (since mappings only make sense in the OIDC context).

func (*OidcHandler) CreateOidcRoleMapping

func (*OidcHandler) DeleteOidcRoleMapping

func (h *OidcHandler) DeleteOidcRoleMapping(ctx context.Context, input *DeleteOidcRoleMappingInput) (*DeleteOidcRoleMappingOutput, error)

func (*OidcHandler) ExchangeDeviceToken

func (h *OidcHandler) ExchangeDeviceToken(ctx context.Context, input *ExchangeDeviceTokenInput) (*ExchangeDeviceTokenOutput, error)

ExchangeDeviceToken exchanges a device code for authentication tokens.

func (*OidcHandler) GetOidcAuthUrl

func (h *OidcHandler) GetOidcAuthUrl(ctx context.Context, input *GetOidcAuthUrlInput) (*GetOidcAuthUrlOutput, error)

GetOidcAuthUrl generates an OIDC authorization URL and sets the state cookie.

func (*OidcHandler) GetOidcConfig

func (h *OidcHandler) GetOidcConfig(ctx context.Context, input *GetOidcConfigInput) (*GetOidcConfigOutput, error)

GetOidcConfig returns the OIDC client configuration.

func (*OidcHandler) GetOidcStatus

GetOidcStatus returns the OIDC configuration status.

func (*OidcHandler) HandleOidcCallback

func (h *OidcHandler) HandleOidcCallback(ctx context.Context, input *HandleOidcCallbackInput) (*HandleOidcCallbackOutput, error)

HandleOidcCallback processes the OIDC callback and completes authentication.

func (*OidcHandler) InitiateDeviceAuth

InitiateDeviceAuth initiates the OIDC device authorization flow.

func (*OidcHandler) ListOidcRoleMappings

func (*OidcHandler) UpdateOidcRoleMapping

type OidcHeaders

type OidcHeaders struct {
	Origin          string `header:"Origin"`
	XForwardedHost  string `header:"X-Forwarded-Host"`
	XForwardedProto string `header:"X-Forwarded-Proto"`
	Host            string `header:"Host"`
	UserAgent       string `header:"User-Agent"`
}

type OidcService

type OidcService struct {
	// contains filtered or unexported fields
}

func NewOidcService

func NewOidcService(authService *auth.AuthService, settingsService *settings.SettingsService, cfg *config.Config, httpClient *http.Client, keySetManager *oidcjwk.KeySetManager) *OidcService

func (*OidcService) ExchangeDeviceToken

func (s *OidcService) ExchangeDeviceToken(ctx context.Context, deviceCode string) (_ *authtypes.OidcUserInfo, _ *authtypes.OidcTokenResponse, err error)

ExchangeDeviceToken exchanges a device code for tokens.

func (*OidcService) GenerateAuthURL

func (s *OidcService) GenerateAuthURL(ctx context.Context, redirectTo, origin, mobileRedirectURI string) (string, string, error)

func (*OidcService) GetMobileRedirectAllowlist

func (s *OidcService) GetMobileRedirectAllowlist(ctx context.Context) []string

GetMobileRedirectAllowlist returns the configured list of acceptable mobile OAuth redirect URIs.

func (*OidcService) GetOidcRedirectURL

func (s *OidcService) GetOidcRedirectURL(origin string) string

func (*OidcService) HandleCallback

func (s *OidcService) HandleCallback(ctx context.Context, code, state, storedState, origin, mobileRedirectURI string) (_ *authtypes.OidcUserInfo, _ *authtypes.OidcTokenResponse, err error)

func (*OidcService) InitiateDeviceAuth

func (s *OidcService) InitiateDeviceAuth(ctx context.Context) (_ *authtypes.OidcDeviceAuthResponse, err error)

InitiateDeviceAuth initiates the OIDC device authorization flow.

func (*OidcService) ValidateMobileRedirectURI

func (s *OidcService) ValidateMobileRedirectURI(ctx context.Context, uri string) error

ValidateMobileRedirectURI requires an exact allowlist match; partial matches would allow open redirects.

type OidcState

type OidcState struct {
	State        string    `json:"state"`
	Nonce        string    `json:"nonce"`
	CodeVerifier string    `json:"code_verifier"`
	RedirectTo   string    `json:"redirect_to"`
	CreatedAt    time.Time `json:"created_at"`
}

type UpdateOidcRoleMappingInput

type UpdateOidcRoleMappingInput struct {
	ID   string `path:"id" doc:"Mapping ID"`
	Body roletypes.UpdateOidcRoleMapping
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL