oidc

package
v2.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 19, 2026 License: BSD-3-Clause Imports: 36 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func RegisterOidc

func RegisterOidc(api huma.API, authService *auth.AuthService, passkeyService *passkey.PasskeyService, oidcService *OidcService, roleService *role.RoleService, userService *user.UserService, cfg *config.Config)

RegisterOidc registers all OIDC authentication endpoints (plus the OIDC group → role mapping CRUD) using Huma.

Types

type CreateOidcRoleMappingInput

type CreateOidcRoleMappingInput struct {
	Body roletypes.CreateOidcRoleMapping
}

type CreateOidcRoleMappingOutput

type CreateOidcRoleMappingOutput struct {
	Body base.ApiResponse[roletypes.OidcRoleMapping]
}

type DeleteOidcRoleMappingInput

type DeleteOidcRoleMappingInput struct {
	ID string `path:"id" doc:"Mapping ID"`
}

type DeleteOidcRoleMappingOutput

type DeleteOidcRoleMappingOutput struct {
	Body struct {
		Success bool   `json:"success"`
		Message string `json:"message"`
	}
}

type ExchangeDeviceTokenInput

type ExchangeDeviceTokenInput struct {
	UserAgent string `header:"User-Agent"`
	Body      authtypes.OidcDeviceTokenRequest
}

type ExchangeDeviceTokenOutput

type ExchangeDeviceTokenOutput struct {
	SetCookie []string `header:"Set-Cookie" doc:"Session token cookie"`
	Body      authtypes.AuthenticationResponse
}

type GetOidcAuthUrlInput

type GetOidcAuthUrlInput struct {
	OidcHeaders

	Body authtypes.OidcAuthUrlRequest
}

type GetOidcAuthUrlOutput

type GetOidcAuthUrlOutput struct {
	SetCookie string `header:"Set-Cookie" doc:"OIDC state cookie"`
	Body      authtypes.OidcAuthUrlResponse
}

type GetOidcConfigInput

type GetOidcConfigInput struct {
	OidcHeaders
}

type GetOidcConfigOutput

type GetOidcConfigOutput struct {
	Body authtypes.OidcConfigResponse
}

type GetOidcStatusInput

type GetOidcStatusInput struct{}

type GetOidcStatusOutput

type GetOidcStatusOutput struct {
	Body authtypes.OidcStatusInfo
}

type HandleOidcCallbackInput

type HandleOidcCallbackInput struct {
	OidcHeaders

	OidcStateCookie string `cookie:"oidc_state" doc:"OIDC state cookie from auth URL request"`
	Body            authtypes.OidcCallbackRequest
}

type HandleOidcCallbackOutput

type HandleOidcCallbackOutput struct {
	SetCookie []string `header:"Set-Cookie" doc:"Session and clear state cookies"`
	Body      authtypes.OidcCallbackResponse
}

type InitiateDeviceAuthInput

type InitiateDeviceAuthInput struct{}

type InitiateDeviceAuthOutput

type InitiateDeviceAuthOutput struct {
	Body authtypes.OidcDeviceAuthResponse
}

type ListOidcRoleMappingsInput

type ListOidcRoleMappingsInput struct{}

type ListOidcRoleMappingsOutput

type ListOidcRoleMappingsOutput struct {
	Body base.ApiResponse[[]roletypes.OidcRoleMapping]
}

type OidcHandler

type OidcHandler struct {
	// contains filtered or unexported fields
}

OidcHandler handles OIDC authentication endpoints, plus OIDC group → role mapping management (since mappings only make sense in the OIDC context).

func (*OidcHandler) CreateOidcRoleMapping

func (h *OidcHandler) CreateOidcRoleMapping(ctx context.Context, input *CreateOidcRoleMappingInput) (*CreateOidcRoleMappingOutput, error)

func (*OidcHandler) DeleteOidcRoleMapping

func (h *OidcHandler) DeleteOidcRoleMapping(ctx context.Context, input *DeleteOidcRoleMappingInput) (*DeleteOidcRoleMappingOutput, error)

func (*OidcHandler) ExchangeDeviceToken

func (h *OidcHandler) ExchangeDeviceToken(ctx context.Context, input *ExchangeDeviceTokenInput) (*ExchangeDeviceTokenOutput, error)

ExchangeDeviceToken exchanges a device code for authentication tokens.

func (*OidcHandler) GetOidcAuthUrl

func (h *OidcHandler) GetOidcAuthUrl(ctx context.Context, input *GetOidcAuthUrlInput) (*GetOidcAuthUrlOutput, error)

GetOidcAuthUrl generates an OIDC authorization URL and sets the state cookie.

func (*OidcHandler) GetOidcConfig

func (h *OidcHandler) GetOidcConfig(ctx context.Context, input *GetOidcConfigInput) (*GetOidcConfigOutput, error)

GetOidcConfig returns the OIDC client configuration.

func (*OidcHandler) GetOidcStatus

GetOidcStatus returns the OIDC configuration status.

func (*OidcHandler) HandleOidcCallback

func (h *OidcHandler) HandleOidcCallback(ctx context.Context, input *HandleOidcCallbackInput) (*HandleOidcCallbackOutput, error)

HandleOidcCallback processes the OIDC callback and completes authentication.

func (*OidcHandler) InitiateDeviceAuth

InitiateDeviceAuth initiates the OIDC device authorization flow.

func (*OidcHandler) ListOidcRoleMappings

func (*OidcHandler) UpdateOidcRoleMapping

func (h *OidcHandler) UpdateOidcRoleMapping(ctx context.Context, input *UpdateOidcRoleMappingInput) (*UpdateOidcRoleMappingOutput, error)

type OidcHeaders

type OidcHeaders struct {
	Origin          string `header:"Origin"`
	XForwardedHost  string `header:"X-Forwarded-Host"`
	XForwardedProto string `header:"X-Forwarded-Proto"`
	Host            string `header:"Host"`
	UserAgent       string `header:"User-Agent"`
}

type OidcService

type OidcService struct {
	// contains filtered or unexported fields
}

func NewOidcService

func NewOidcService(authService *auth.AuthService, settingsService *settings.SettingsService, cfg *config.Config, httpClient *http.Client) *OidcService

func (*OidcService) ExchangeDeviceToken

func (s *OidcService) ExchangeDeviceToken(ctx context.Context, deviceCode string) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)

ExchangeDeviceToken exchanges a device code for tokens.

func (*OidcService) GenerateAuthURL

func (s *OidcService) GenerateAuthURL(ctx context.Context, redirectTo string, origin string, mobileRedirectURI string) (string, string, error)

func (*OidcService) GetMobileRedirectAllowlist

func (s *OidcService) GetMobileRedirectAllowlist(ctx context.Context) []string

GetMobileRedirectAllowlist returns the configured list of acceptable mobile OAuth redirect URIs.

func (*OidcService) GetOidcRedirectURL

func (s *OidcService) GetOidcRedirectURL(origin string) string

func (*OidcService) HandleCallback

func (s *OidcService) HandleCallback(ctx context.Context, code, state, storedState, origin, mobileRedirectURI string) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)

func (*OidcService) InitiateDeviceAuth

func (s *OidcService) InitiateDeviceAuth(ctx context.Context) (*authtypes.OidcDeviceAuthResponse, error)

InitiateDeviceAuth initiates the OIDC device authorization flow.

func (*OidcService) ValidateMobileRedirectURI

func (s *OidcService) ValidateMobileRedirectURI(ctx context.Context, uri string) error

ValidateMobileRedirectURI returns nil if uri exactly matches one of the configured mobile redirect URIs. Full-string match is required — partial matches on scheme or host could be abused for open-redirect attacks.

type OidcState

type OidcState struct {
	State        string    `json:"state"`
	Nonce        string    `json:"nonce"`
	CodeVerifier string    `json:"code_verifier"`
	RedirectTo   string    `json:"redirect_to"`
	CreatedAt    time.Time `json:"created_at"`
}

type UpdateOidcRoleMappingInput

type UpdateOidcRoleMappingInput struct {
	ID   string `path:"id" doc:"Mapping ID"`
	Body roletypes.UpdateOidcRoleMapping
}

type UpdateOidcRoleMappingOutput

type UpdateOidcRoleMappingOutput struct {
	Body base.ApiResponse[roletypes.OidcRoleMapping]
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL