Documentation
¶
Overview ¶
Package auth implements `hadron auth login` flows against the Hadron OAuth endpoints (spec 025: authorization-code + PKCE, public client via dynamic client registration).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DiscoverResource ¶
func DiscoverResource(ctx context.Context, serverURL string, httpClient *http.Client) (string, error)
DiscoverResource fetches the RFC 9728 protected-resource metadata and returns its canonical resource indicator. The server requires a `resource` parameter (RFC 8707) on /oauth/authorize and binds the authorization code to it at /oauth/token. A server without RFC 9728 (404) yields "", and the flow omits the parameter.
func OpenInBrowser ¶
OpenInBrowser launches the platform's URL opener.
Types ¶
type BrowserStrategy ¶
type BrowserStrategy struct{}
BrowserStrategy signs in via authorization-code + PKCE with a loopback redirect: discover endpoints, bind 127.0.0.1:<port>, register a one-shot public client for that exact redirect URI, send the user to the consent screen, exchange the code.
func (BrowserStrategy) Login ¶
func (BrowserStrategy) Login(ctx context.Context, opts LoginOptions) (*Token, error)
func (BrowserStrategy) Name ¶
func (BrowserStrategy) Name() string
type LoginOptions ¶
type LoginOptions struct {
ServerURL string
IO *output.IOStreams
HTTPClient *http.Client
OpenBrowser func(url string) error
}
LoginOptions parameterizes a login flow.
type Metadata ¶
type Metadata struct {
AuthorizationEndpoint string `json:"authorization_endpoint"`
TokenEndpoint string `json:"token_endpoint"`
RegistrationEndpoint string `json:"registration_endpoint"`
}
Metadata is the subset of RFC 8414 authorization-server metadata the CLI needs.
type Strategy ¶
type Strategy interface {
Name() string
Login(ctx context.Context, opts LoginOptions) (*Token, error)
}
Strategy is a way to obtain a token interactively. BrowserStrategy (loopback PKCE) is the only v1 implementation; an RFC 8628 device flow can slot in here once hadron-server supports it.
type Token ¶
type Token struct {
AccessToken string
}
Token is the credential a login flow produces. Hadron v1 issues long-lived opaque hdr_user_* access tokens; there is no refresh token (spec 025 defers RFC 6749 refresh).
type TokenSource ¶
type TokenSource string
TokenSource says where the active token came from.
const ( SourceEnv TokenSource = "HADRON_TOKEN" SourceStore TokenSource = "store" SourceNone TokenSource = "" )
func ResolveToken ¶
func ResolveToken(st store.Store, serverURL string) (string, TokenSource)
ResolveToken returns the active token for a server, preferring the HADRON_TOKEN environment variable over the token store.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package store persists the Hadron access token, preferring the OS keychain and falling back to a 0600 file when no keychain is available (CI containers, headless boxes).
|
Package store persists the Hadron access token, preferring the OS keychain and falling back to a 0600 file when no keychain is available (CI containers, headless boxes). |