internal/

Package backendtest is the conformance suite every session.Backend implementation of the module runs in its tests: put, get, pop, compare and swap, revoke, per-value TTLs, revocation markers, atomic Pop and CompareAndSwap, and revocation racing a Put.

Package dependency turns the errors of third-party packages into errors of this module and keeps the module's own HTTP calls from following redirects.

Package failure classifies a failed action for the Outcome a provider reports, and answers and reports a provider's requests.

Package fakeprovider holds in-process fakes of the identity providers the library talks to (an OIDC issuer with the Keycloak admin API, and GitHub) for unit and end-to-end tests.

Package fetchmetadata reads the Fetch Metadata request headers (Sec-Fetch-*) browsers send.

Package forwardauth is the server of the forward-auth binary (cmd/forwardauth): the gin engine with the forward-auth checks Traefik calls, the provider routes, JWKS, identity, health and readiness endpoints, wide events and HTTP metrics on every request, and the graceful run of the public and the metrics listener.

Package hook runs the application hooks the providers call.

Package httpjson decodes strict JSON request bodies and writes JSON responses.

Package impersonation writes a refreshed real identity back into an identity that may be impersonating another one.

Package oauthlogin keeps the state of one redirect login (state, nonce, PKCE verifier, return path) in the server-side session, so the callback verifies it exactly once on any replica sharing the session backend.

Package random generates unguessable tokens for session IDs, login state and nonces.

Package redirect validates where the library may send a browser or a credential and where it serves routes: same-origin return paths, login locations carrying a return path, configured external URLs and redirect targets, the endpoints of identity providers and route path prefixes.

Package sessiontest sets up session states for the tests of packages that build on package session.

Package tokenendpoint turns the errors of an OAuth token request (golang.org/x/oauth2) into errors of this module that carry none of the endpoint's free text.