Documentation
¶
Overview ¶
Package auth implements the browser-based OAuth PKCE authentication flow for gcx. This file is based heavily on assistant-cli-internal/internal/tunnel/auth/flow.go.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrRefreshTokenExpired = errors.New("refresh token expired: re-authentication required")
ErrRefreshTokenExpired is returned when the refresh token has expired and the user must re-authenticate.
Functions ¶
func StripControlChars ¶
StripControlChars sanitises errors to stop potentially malicious errors from being interpolated.
func ValidateEndpointURL ¶
ValidateEndpointURL checks that the given endpoint URL is a trusted Grafana domain or a local address. Returns an error if the URL is untrusted.
Types ¶
type Flow ¶
type Flow struct {
// contains filtered or unexported fields
}
Flow manages the browser-based authentication process.
type Options ¶
type Options struct {
// Port specifies a fixed port for the callback server.
// If 0, an available port will be found automatically.
Port int
// BindAddress specifies the address to bind the callback server to.
// Defaults to "127.0.0.1".
BindAddress string
// Scopes specifies the token scopes to request.
// If empty, DefaultScopes are used.
Scopes []string
// Writer is the output writer for user-facing messages.
// Defaults to os.Stderr.
Writer io.Writer
}
Options configures the authentication flow.
type RefreshTransport ¶
type RefreshTransport struct {
Base http.RoundTripper
ProxyEndpoint string
Token string
RefreshToken string
ExpiresAt time.Time
RefreshExpiresAt time.Time
OnRefresh TokenRefresher
// contains filtered or unexported fields
}
RefreshTransport wraps an http.RoundTripper and transparently refreshes the gat_ access token when it is close to expiry.
type Result ¶
type Result struct {
// Token is the gat_ access token for API authentication.
Token string
// Email is the user's email address.
Email string
// DeviceName is the device name (if provided).
DeviceName string
// APIEndpoint is the proxy base URL for forwarding requests.
APIEndpoint string
// ExpiresAt is the token expiration time in RFC3339 format.
ExpiresAt string
// RefreshToken is the gar_ refresh token for obtaining new access tokens.
RefreshToken string
// RefreshExpiresAt is the refresh token expiration time in RFC3339 format.
RefreshExpiresAt string
}
Result contains the result of a successful authentication flow.
type TokenRefresher ¶
TokenRefresher is called after a successful refresh to persist the new tokens.