Documentation
¶
Overview ¶
Package auth implements `hadron auth login` flows against the Hadron OAuth endpoints (spec 025: authorization-code + PKCE, public client via dynamic client registration).
Index ¶
- func DiscoverResource(ctx context.Context, serverURL string, httpClient *http.Client) (string, error)
- func Host(serverURL string) string
- func ImpersonationHostKey(serverURL string) string
- func ImpersonationTokenLive(token string) bool
- func OpenInBrowser(target string) error
- func ResolveImpersonationToken(st store.Store, serverURL string) string
- type BrowserStrategy
- type LoginOptions
- type Metadata
- type Strategy
- type Token
- type TokenSource
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DiscoverResource ¶
func DiscoverResource(ctx context.Context, serverURL string, httpClient *http.Client) (string, error)
DiscoverResource fetches the RFC 9728 protected-resource metadata and returns its canonical resource indicator. The server requires a `resource` parameter (RFC 8707) on /oauth/authorize and binds the authorization code to it at /oauth/token. A server without RFC 9728 (404) yields "", and the flow omits the parameter.
func ImpersonationHostKey ¶ added in v0.9.0
ImpersonationHostKey derives the store key an active impersonation token is filed under, from the same host key a normal credential uses. Store backends (keyring / file) treat the key as opaque, so a suffixed host keeps the impersonation token beside — not overwriting — the admin's own credential.
func ImpersonationTokenLive ¶ added in v0.9.0
ImpersonationTokenLive reports whether a stored token is a well-formed impersonation JWT whose `exp` is still in the future. A non-impersonation token, a malformed one, or an expired one all return false so the caller deletes it and falls through to the real credential.
func OpenInBrowser ¶
OpenInBrowser launches the platform's URL opener. The target is passed as argv (never via a shell), but a leading '-' would still be parsed as a flag by `open`, so it is rejected outright and, on darwin, an explicit `--` end-of-options separator is used as belt-and-suspenders. Callers that route through Discover have already scheme/host-validated the URL (#120); this guard keeps the opener safe for any other caller too.
func ResolveImpersonationToken ¶ added in v0.9.0
ResolveImpersonationToken returns a LIVE stored impersonation token for the server, or "" if none is filed. A stored-but-expired token is purged on a BEST-EFFORT basis as a side effect (across backends; purge errors are ignored) so `Token()` can fall through to the real credential without the caller re-checking. Treat the cleanup as opportunistic, not guaranteed — correctness rests on the liveness check, not on the delete succeeding.
Types ¶
type BrowserStrategy ¶
type BrowserStrategy struct{}
BrowserStrategy signs in via authorization-code + PKCE with a loopback redirect: discover endpoints, bind 127.0.0.1:<port>, register a one-shot public client for that exact redirect URI, send the user to the consent screen, exchange the code.
func (BrowserStrategy) Login ¶
func (BrowserStrategy) Login(ctx context.Context, opts LoginOptions) (*Token, error)
func (BrowserStrategy) Name ¶
func (BrowserStrategy) Name() string
type LoginOptions ¶
type LoginOptions struct {
ServerURL string
// LoginProvider selects the server-side identity provider used for the
// browser hop. Empty and "github" preserve the legacy authorize request;
// "google" asks a provider-aware server to use Google.
LoginProvider string
IO *output.IOStreams
HTTPClient *http.Client
OpenBrowser func(url string) error
}
LoginOptions parameterizes a login flow.
type Metadata ¶
type Metadata struct {
AuthorizationEndpoint string `json:"authorization_endpoint"`
TokenEndpoint string `json:"token_endpoint"`
RegistrationEndpoint string `json:"registration_endpoint"`
}
Metadata is the subset of RFC 8414 authorization-server metadata the CLI needs.
type Strategy ¶
type Strategy interface {
Name() string
Login(ctx context.Context, opts LoginOptions) (*Token, error)
}
Strategy is a way to obtain a token interactively. BrowserStrategy (loopback PKCE) is the only v1 implementation; an RFC 8628 device flow can slot in here once hadron-server supports it.
type Token ¶
type Token struct {
AccessToken string
}
Token is the credential a login flow produces. Hadron v1 issues long-lived opaque hdr_user_* access tokens; there is no refresh token (spec 025 defers RFC 6749 refresh).
type TokenSource ¶
type TokenSource string
TokenSource says where the active token came from.
const ( SourceEnv TokenSource = "HADRON_TOKEN" SourceStore TokenSource = "store" SourceImpersonation TokenSource = "impersonation" SourceNone TokenSource = "" )
func ResolveToken ¶
ResolveToken returns the active token for a server, preferring the HADRON_TOKEN environment variable over the token store. A genuine "no credential" (ErrNotFound or an empty token) yields SourceNone with a nil error; any OTHER store error — a corrupt/truncated auth.json, a permission or keychain-access failure — is propagated so it fails loud instead of masquerading as a logged-out state (#125).
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package store persists the Hadron access token, preferring the OS keychain and falling back to a 0600 file when no keychain is available (CI containers, headless boxes).
|
Package store persists the Hadron access token, preferring the OS keychain and falling back to a 0600 file when no keychain is available (CI containers, headless boxes). |