Documentation
¶
Index ¶
- func DefaultCredentialsDir() (string, error)
- func DeleteCredentials(provider string) error
- func DeleteRecord(key string) error
- func GenerateState() (string, error)
- func LoadRecord(key string, v any) (found bool, err error)
- func MigrateToEncrypted(provider string) error
- func SaveCredentials(provider string, token *Token) error
- func SaveRecord(key string, v any) error
- func SetCredentialsDir(dir string)
- type CallbackResult
- type CallbackServer
- type Flow
- type PKCEParams
- type ProviderConfig
- type Token
- func ClientCredentialsTokenCtx(ctx context.Context, client *http.Client, ...) (*Token, error)
- func ExchangeCode(tokenURL, clientID, code, redirectURI, codeVerifier string) (*Token, error)
- func ExchangeCodeCtx(ctx context.Context, client *http.Client, ...) (*Token, error)
- func LoadCredentials(provider string) (*Token, error)
- func RefreshToken(tokenURL, clientID, refreshToken string) (*Token, error)
- func RefreshTokenCtx(ctx context.Context, client *http.Client, ...) (*Token, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultCredentialsDir ¶
DefaultCredentialsDir returns the directory used by the encrypted/plaintext credential helpers. If SetCredentialsDir has been called with a non-empty value, that wins; otherwise returns ~/.forge/credentials.
func DeleteCredentials ¶
DeleteCredentials removes stored OAuth credentials from both the encrypted store and the plaintext file.
func DeleteRecord ¶ added in v0.18.1
DeleteRecord removes a record from both stores. Idempotent.
func GenerateState ¶
GenerateState creates a random state parameter for OAuth flows.
func LoadRecord ¶ added in v0.18.1
LoadRecord loads a record saved by SaveRecord into v. Returns found=false (nil error) when no record exists for key.
func MigrateToEncrypted ¶
MigrateToEncrypted moves a provider's plaintext credentials into the encrypted store. It is a no-op if no plaintext file exists or the encrypted provider is unavailable.
func SaveCredentials ¶
SaveCredentials stores OAuth token data. When FORGE_PASSPHRASE is available the token is saved to the encrypted secrets file and any plaintext file is removed. Otherwise it falls back to writing a plaintext JSON file.
func SaveRecord ¶ added in v0.18.1
SaveRecord persists v (marshaled to JSON) under key.
func SetCredentialsDir ¶
func SetCredentialsDir(dir string)
SetCredentialsDir overrides the default OAuth credentials directory. Intended for early-startup wiring; calling it after concurrent Save/Load is in flight is a data race.
Pass "" to clear the override and revert to the home-based default. Review B11.
Types ¶
type CallbackResult ¶
CallbackResult holds the result from the OAuth callback.
type CallbackServer ¶
type CallbackServer struct {
// contains filtered or unexported fields
}
CallbackServer is a local HTTP server that receives the OAuth authorization code.
func NewCallbackServer ¶
func NewCallbackServer(port int) *CallbackServer
NewCallbackServer creates a callback server on the given port.
func (*CallbackServer) Start ¶
func (s *CallbackServer) Start() error
Start starts the callback server and returns immediately.
func (*CallbackServer) WaitForCode ¶
func (s *CallbackServer) WaitForCode(ctx context.Context) (CallbackResult, error)
WaitForCode blocks until an authorization code is received or the context expires.
type Flow ¶
type Flow struct {
Config ProviderConfig
Timeout time.Duration // default: 2 minutes
}
Flow orchestrates the OAuth authorization code flow with PKCE.
func NewFlow ¶
func NewFlow(config ProviderConfig) *Flow
NewFlow creates a new OAuth flow with the given provider config.
type PKCEParams ¶
PKCEParams holds the PKCE code verifier and challenge for OAuth flows.
func GeneratePKCE ¶
func GeneratePKCE() (*PKCEParams, error)
GeneratePKCE creates a new PKCE code verifier (32 random bytes, base64url-encoded) and its corresponding S256 challenge.
type ProviderConfig ¶
type ProviderConfig struct {
AuthURL string
TokenURL string
ClientID string
Scopes string
RedirectURI string
BaseURL string // API base URL to use with the obtained token
ExtraParams map[string]string // additional query params for the auth URL
}
ProviderConfig holds the OAuth configuration for a provider.
func OpenAIConfig ¶
func OpenAIConfig() ProviderConfig
OpenAIConfig returns the OAuth configuration for OpenAI. Uses the same public client ID and endpoints as the official Codex CLI. ChatGPT OAuth tokens are scoped to the ChatGPT backend API, not the standard OpenAI API (api.openai.com). The base URL is set accordingly.
type Token ¶
type Token struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
TokenType string `json:"token_type"`
ExpiresIn int `json:"expires_in,omitempty"`
ExpiresAt time.Time `json:"expires_at"`
Scope string `json:"scope,omitempty"`
BaseURL string `json:"base_url,omitempty"` // API base URL for this token
}
Token holds the OAuth token data.
func ClientCredentialsTokenCtx ¶ added in v0.18.1
func ClientCredentialsTokenCtx(ctx context.Context, client *http.Client, tokenURL, clientID, clientSecret string, scopes []string) (*Token, error)
ClientCredentialsTokenCtx mints a token via the OAuth 2.0 client_credentials grant (RFC 6749 §4.4) — the 2-legged, agent-principal path (#324). No user, no authorization code: the client authenticates with its own id + secret (client_secret_post). The response typically carries no refresh_token; the caller re-mints from the id + secret on expiry.
Caller MUST pass a context with a finite deadline; pass the egress-controlled client in production (see ExchangeCodeCtx).
func ExchangeCode ¶
ExchangeCode exchanges an authorization code for tokens.
Deprecated for new callers — use ExchangeCodeCtx so the request is bounded by a context and rides a caller-provided *http.Client. Kept for backward compatibility with code written against v0.10.
func ExchangeCodeCtx ¶
func ExchangeCodeCtx(ctx context.Context, client *http.Client, tokenURL, clientID, code, redirectURI, codeVerifier string) (*Token, error)
ExchangeCodeCtx is the context- and client-aware variant of ExchangeCode. Caller MUST pass a context with a finite deadline (or a cancellable parent) so a hung IdP cannot wedge the goroutine indefinitely (review B2).
If client is nil, a sensible defaulting client is constructed with a 30s end-to-end timeout — but callers in production should pass the egress-controlled client built by security.Resolve so token endpoints ride the same allowlist as every other outbound call.
func LoadCredentials ¶
LoadCredentials loads OAuth token data. It tries the encrypted store first, then falls back to the plaintext file so that pre-migration credentials continue to work.
func RefreshToken ¶
RefreshToken exchanges a refresh token for new access and refresh tokens.
Deprecated for new callers — use RefreshTokenCtx. See review B2.
func RefreshTokenCtx ¶
func RefreshTokenCtx(ctx context.Context, client *http.Client, tokenURL, clientID, refreshToken string) (*Token, error)
RefreshTokenCtx is the context- and client-aware variant of RefreshToken. Caller MUST pass a context with a finite deadline. See ExchangeCodeCtx docstring for the client-injection contract.
Source Files