Documentation
¶
Index ¶
- func RegisterOidc(api huma.API, authService *auth.AuthService, ...)
- type CreateOidcRoleMappingInput
- type CreateOidcRoleMappingOutput
- type DeleteOidcRoleMappingInput
- type DeleteOidcRoleMappingOutput
- type ExchangeDeviceTokenInput
- type ExchangeDeviceTokenOutput
- type GetOidcAuthUrlInput
- type GetOidcAuthUrlOutput
- type GetOidcConfigInput
- type GetOidcConfigOutput
- type GetOidcStatusInput
- type GetOidcStatusOutput
- type HandleOidcCallbackInput
- type HandleOidcCallbackOutput
- type InitiateDeviceAuthInput
- type InitiateDeviceAuthOutput
- type ListOidcRoleMappingsInput
- type ListOidcRoleMappingsOutput
- type OidcHandler
- func (h *OidcHandler) CreateOidcRoleMapping(ctx context.Context, input *CreateOidcRoleMappingInput) (*CreateOidcRoleMappingOutput, error)
- func (h *OidcHandler) DeleteOidcRoleMapping(ctx context.Context, input *DeleteOidcRoleMappingInput) (*DeleteOidcRoleMappingOutput, error)
- func (h *OidcHandler) ExchangeDeviceToken(ctx context.Context, input *ExchangeDeviceTokenInput) (*ExchangeDeviceTokenOutput, error)
- func (h *OidcHandler) GetOidcAuthUrl(ctx context.Context, input *GetOidcAuthUrlInput) (*GetOidcAuthUrlOutput, error)
- func (h *OidcHandler) GetOidcConfig(ctx context.Context, input *GetOidcConfigInput) (*GetOidcConfigOutput, error)
- func (h *OidcHandler) GetOidcStatus(ctx context.Context, _ *GetOidcStatusInput) (*GetOidcStatusOutput, error)
- func (h *OidcHandler) HandleOidcCallback(ctx context.Context, input *HandleOidcCallbackInput) (*HandleOidcCallbackOutput, error)
- func (h *OidcHandler) InitiateDeviceAuth(ctx context.Context, _ *InitiateDeviceAuthInput) (*InitiateDeviceAuthOutput, error)
- func (h *OidcHandler) ListOidcRoleMappings(ctx context.Context, _ *ListOidcRoleMappingsInput) (*ListOidcRoleMappingsOutput, error)
- func (h *OidcHandler) UpdateOidcRoleMapping(ctx context.Context, input *UpdateOidcRoleMappingInput) (*UpdateOidcRoleMappingOutput, error)
- type OidcHeaders
- type OidcService
- func (s *OidcService) ExchangeDeviceToken(ctx context.Context, deviceCode string) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)
- func (s *OidcService) GenerateAuthURL(ctx context.Context, redirectTo string, origin string, ...) (string, string, error)
- func (s *OidcService) GetMobileRedirectAllowlist(ctx context.Context) []string
- func (s *OidcService) GetOidcRedirectURL(origin string) string
- func (s *OidcService) HandleCallback(ctx context.Context, ...) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)
- func (s *OidcService) InitiateDeviceAuth(ctx context.Context) (*authtypes.OidcDeviceAuthResponse, error)
- func (s *OidcService) ValidateMobileRedirectURI(ctx context.Context, uri string) error
- type OidcState
- type UpdateOidcRoleMappingInput
- type UpdateOidcRoleMappingOutput
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterOidc ¶
func RegisterOidc(api huma.API, authService *auth.AuthService, passkeyService *passkey.PasskeyService, oidcService *OidcService, roleService *role.RoleService, userService *user.UserService, cfg *config.Config)
RegisterOidc registers all OIDC authentication endpoints (plus the OIDC group → role mapping CRUD) using Huma.
Types ¶
type CreateOidcRoleMappingInput ¶
type CreateOidcRoleMappingInput struct {
Body roletypes.CreateOidcRoleMapping
}
type CreateOidcRoleMappingOutput ¶
type CreateOidcRoleMappingOutput struct {
Body base.ApiResponse[roletypes.OidcRoleMapping]
}
type DeleteOidcRoleMappingInput ¶
type DeleteOidcRoleMappingInput struct {
ID string `path:"id" doc:"Mapping ID"`
}
type ExchangeDeviceTokenInput ¶
type ExchangeDeviceTokenInput struct {
UserAgent string `header:"User-Agent"`
Body authtypes.OidcDeviceTokenRequest
}
type ExchangeDeviceTokenOutput ¶
type ExchangeDeviceTokenOutput struct {
SetCookie []string `header:"Set-Cookie" doc:"Session token cookie"`
Body authtypes.AuthenticationResponse
}
type GetOidcAuthUrlInput ¶
type GetOidcAuthUrlInput struct {
OidcHeaders
Body authtypes.OidcAuthUrlRequest
}
type GetOidcAuthUrlOutput ¶
type GetOidcAuthUrlOutput struct {
SetCookie string `header:"Set-Cookie" doc:"OIDC state cookie"`
Body authtypes.OidcAuthUrlResponse
}
type GetOidcConfigInput ¶
type GetOidcConfigInput struct {
OidcHeaders
}
type GetOidcConfigOutput ¶
type GetOidcConfigOutput struct {
Body authtypes.OidcConfigResponse
}
type GetOidcStatusInput ¶
type GetOidcStatusInput struct{}
type GetOidcStatusOutput ¶
type GetOidcStatusOutput struct {
Body authtypes.OidcStatusInfo
}
type HandleOidcCallbackInput ¶
type HandleOidcCallbackInput struct {
OidcHeaders
OidcStateCookie string `cookie:"oidc_state" doc:"OIDC state cookie from auth URL request"`
Body authtypes.OidcCallbackRequest
}
type HandleOidcCallbackOutput ¶
type HandleOidcCallbackOutput struct {
SetCookie []string `header:"Set-Cookie" doc:"Session and clear state cookies"`
Body authtypes.OidcCallbackResponse
}
type InitiateDeviceAuthInput ¶
type InitiateDeviceAuthInput struct{}
type InitiateDeviceAuthOutput ¶
type InitiateDeviceAuthOutput struct {
Body authtypes.OidcDeviceAuthResponse
}
type ListOidcRoleMappingsInput ¶
type ListOidcRoleMappingsInput struct{}
type ListOidcRoleMappingsOutput ¶
type ListOidcRoleMappingsOutput struct {
Body base.ApiResponse[[]roletypes.OidcRoleMapping]
}
type OidcHandler ¶
type OidcHandler struct {
// contains filtered or unexported fields
}
OidcHandler handles OIDC authentication endpoints, plus OIDC group → role mapping management (since mappings only make sense in the OIDC context).
func (*OidcHandler) CreateOidcRoleMapping ¶
func (h *OidcHandler) CreateOidcRoleMapping(ctx context.Context, input *CreateOidcRoleMappingInput) (*CreateOidcRoleMappingOutput, error)
func (*OidcHandler) DeleteOidcRoleMapping ¶
func (h *OidcHandler) DeleteOidcRoleMapping(ctx context.Context, input *DeleteOidcRoleMappingInput) (*DeleteOidcRoleMappingOutput, error)
func (*OidcHandler) ExchangeDeviceToken ¶
func (h *OidcHandler) ExchangeDeviceToken(ctx context.Context, input *ExchangeDeviceTokenInput) (*ExchangeDeviceTokenOutput, error)
ExchangeDeviceToken exchanges a device code for authentication tokens.
func (*OidcHandler) GetOidcAuthUrl ¶
func (h *OidcHandler) GetOidcAuthUrl(ctx context.Context, input *GetOidcAuthUrlInput) (*GetOidcAuthUrlOutput, error)
GetOidcAuthUrl generates an OIDC authorization URL and sets the state cookie.
func (*OidcHandler) GetOidcConfig ¶
func (h *OidcHandler) GetOidcConfig(ctx context.Context, input *GetOidcConfigInput) (*GetOidcConfigOutput, error)
GetOidcConfig returns the OIDC client configuration.
func (*OidcHandler) GetOidcStatus ¶
func (h *OidcHandler) GetOidcStatus(ctx context.Context, _ *GetOidcStatusInput) (*GetOidcStatusOutput, error)
GetOidcStatus returns the OIDC configuration status.
func (*OidcHandler) HandleOidcCallback ¶
func (h *OidcHandler) HandleOidcCallback(ctx context.Context, input *HandleOidcCallbackInput) (*HandleOidcCallbackOutput, error)
HandleOidcCallback processes the OIDC callback and completes authentication.
func (*OidcHandler) InitiateDeviceAuth ¶
func (h *OidcHandler) InitiateDeviceAuth(ctx context.Context, _ *InitiateDeviceAuthInput) (*InitiateDeviceAuthOutput, error)
InitiateDeviceAuth initiates the OIDC device authorization flow.
func (*OidcHandler) ListOidcRoleMappings ¶
func (h *OidcHandler) ListOidcRoleMappings(ctx context.Context, _ *ListOidcRoleMappingsInput) (*ListOidcRoleMappingsOutput, error)
func (*OidcHandler) UpdateOidcRoleMapping ¶
func (h *OidcHandler) UpdateOidcRoleMapping(ctx context.Context, input *UpdateOidcRoleMappingInput) (*UpdateOidcRoleMappingOutput, error)
type OidcHeaders ¶
type OidcService ¶
type OidcService struct {
// contains filtered or unexported fields
}
func NewOidcService ¶
func NewOidcService(authService *auth.AuthService, settingsService *settings.SettingsService, cfg *config.Config, httpClient *http.Client) *OidcService
func (*OidcService) ExchangeDeviceToken ¶
func (s *OidcService) ExchangeDeviceToken(ctx context.Context, deviceCode string) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)
ExchangeDeviceToken exchanges a device code for tokens.
func (*OidcService) GenerateAuthURL ¶
func (*OidcService) GetMobileRedirectAllowlist ¶
func (s *OidcService) GetMobileRedirectAllowlist(ctx context.Context) []string
GetMobileRedirectAllowlist returns the configured list of acceptable mobile OAuth redirect URIs.
func (*OidcService) GetOidcRedirectURL ¶
func (s *OidcService) GetOidcRedirectURL(origin string) string
func (*OidcService) HandleCallback ¶
func (s *OidcService) HandleCallback(ctx context.Context, code, state, storedState, origin, mobileRedirectURI string) (*authtypes.OidcUserInfo, *authtypes.OidcTokenResponse, error)
func (*OidcService) InitiateDeviceAuth ¶
func (s *OidcService) InitiateDeviceAuth(ctx context.Context) (*authtypes.OidcDeviceAuthResponse, error)
InitiateDeviceAuth initiates the OIDC device authorization flow.
func (*OidcService) ValidateMobileRedirectURI ¶
func (s *OidcService) ValidateMobileRedirectURI(ctx context.Context, uri string) error
ValidateMobileRedirectURI returns nil if uri exactly matches one of the configured mobile redirect URIs. Full-string match is required — partial matches on scheme or host could be abused for open-redirect attacks.
type UpdateOidcRoleMappingInput ¶
type UpdateOidcRoleMappingInput struct {
ID string `path:"id" doc:"Mapping ID"`
Body roletypes.UpdateOidcRoleMapping
}
type UpdateOidcRoleMappingOutput ¶
type UpdateOidcRoleMappingOutput struct {
Body base.ApiResponse[roletypes.OidcRoleMapping]
}