Documentation
¶
Overview ¶
Package devicecode implements the OAuth 2.0 device-authorization grant (RFC 8628) against Microsoft Entra ID. The helpers here are shared between the standalone `forge channel msteams-login` CLI subcommand and the MS Teams branch of the `forge init` TUI wizard, so both flows produce identical refresh tokens and reuse the same polling / error semantics.
The flow has two halves:
- RequestDeviceCode — POST /devicecode → user_code + verification_uri
- PollDeviceToken — POST /token repeatedly until the user completes the consent step in their browser
Both halves are network calls; both honour the caller's context for cancellation and timeout. OpenURL is a best-effort cross-platform browser launcher with the same shape as forge-core/llm/oauth.openBrowser.
Index ¶
Constants ¶
const DefaultLoginBase = "https://login.microsoftonline.com"
DefaultLoginBase is the OAuth 2.0 authority for Microsoft Entra ID's commercial cloud. Sovereign clouds override via the LoginBase argument.
const DefaultScope = "https://graph.microsoft.com/.default offline_access"
DefaultScope is the .default scope marker plus offline_access — the same scope set the runtime authManager (forge-plugins/channels/msteams/auth.go) requests, so refresh tokens captured by this package are interchangeable with ones captured externally.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type DeviceCodeResponse ¶
type DeviceCodeResponse struct {
UserCode string `json:"user_code"`
DeviceCode string `json:"device_code"`
VerificationURI string `json:"verification_uri"`
ExpiresIn int `json:"expires_in"`
Interval int `json:"interval"`
Message string `json:"message,omitempty"`
}
DeviceCodeResponse is the trimmed Microsoft response to POST /devicecode.
func RequestDeviceCode ¶
func RequestDeviceCode(ctx context.Context, client *http.Client, loginBase, tenant, clientID string) (*DeviceCodeResponse, error)
RequestDeviceCode initiates the device-authorization grant. Returns the user_code + verification_uri pair the operator must visit in a browser, plus the opaque device_code the caller passes to PollDeviceToken.
type TokenResponse ¶
type TokenResponse struct {
AccessToken string `json:"access_token,omitempty"`
TokenType string `json:"token_type,omitempty"`
ExpiresIn int `json:"expires_in,omitempty"`
RefreshToken string `json:"refresh_token,omitempty"`
Scope string `json:"scope,omitempty"`
Error string `json:"error,omitempty"`
ErrorDesc string `json:"error_description,omitempty"`
}
TokenResponse is the trimmed token endpoint payload.
func PollDeviceToken ¶
func PollDeviceToken(ctx context.Context, client *http.Client, loginBase, tenant, clientID, clientSecret string, dc *DeviceCodeResponse) (*TokenResponse, error)
PollDeviceToken polls the token endpoint until the user completes consent, the device code expires, or the context is cancelled. Honours the server-advertised interval and the slow_down rate-limit response per RFC 8628 §3.5.
clientSecret is optional: pass "" for public-client apps (native/mobile registration) and the secret value for confidential-client apps (web registration). Entra returns AADSTS7000218 if a confidential client omits its secret here, so when in doubt, supply it — public clients silently ignore the extra parameter.
Source Files