auth

package
v0.1.18 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 30, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ProviderGitHub 表示 GitHub 平台。
	ProviderGitHub = "github"

	// SubjectTypeUser identifies a user-owned execution subject.
	SubjectTypeUser = "user"

	// ScopeTypeEvent identifies an event-scoped execution request.
	ScopeTypeEvent = "event"

	// AccountOwnerTypeUser 表示账户属于具体用户。
	AccountOwnerTypeUser = "user"

	// AccountOwnerTypeSystem 表示账户属于系统或组织级执行身份。
	AccountOwnerTypeSystem = "system"

	// AccountTypeUserOAuth 表示通过 OAuth 授权得到的用户账户。
	AccountTypeUserOAuth = "user_oauth"

	// AccountTypeAppInstallation 表示第三方平台应用安装身份。
	AccountTypeAppInstallation = "app_installation"

	// GrantTypeOAuth2 表示 OAuth2 访问令牌。
	GrantTypeOAuth2 = "oauth2"

	// AccountStatusActive 表示账户当前可用。
	AccountStatusActive = "active"

	// AccountStatusDisabled 表示账户已禁用。
	AccountStatusDisabled = "disabled"
)
View Source 
const (
	WorkerTokenIssuer   = "leros"
	WorkerTokenAudience = "worker"
	WorkerTokenKind     = "worker"
	WorkerTokenScopeAPI = "worker:server-api"
)

Variables

View Source 
var (
	ErrWorkerTokenSecretRequired = errors.New("worker token secret is required")
	ErrInvalidWorkerToken        = errors.New("invalid worker token")
)

Functions

func FromContext 

func FromContext(ctx context.Context) (*types.Caller, *types.Trace)

FromContext 从上下文中提取 Caller 和 Trace 信息。

func FromGinContext 

func FromGinContext(ctx *gin.Context) (*types.Caller, *types.Trace)

FromGinContext 从 gin.Context 中提取 Caller 和 Trace 信息。

func GenerateBootstrapToken added in v0.1.12 

func GenerateBootstrapToken() (string, error)

GenerateBootstrapToken creates an opaque token used once by server-managed workers at startup.

func GenerateWorkerToken added in v0.1.12 

func GenerateWorkerToken(orgID, workerID uint, secret string, ttl time.Duration) (string, int64, error)

GenerateWorkerToken creates a short-lived token for a worker/AI teammate.

func HashBootstrapToken added in v0.1.12 

func HashBootstrapToken(token string) string

HashBootstrapToken returns the stored verifier for a bootstrap token.

func WithContext 

func WithContext(ctx context.Context, caller *types.Caller, trace *types.Trace) context.Context

WithContext 携带 Caller 和 Trace 信息的上下文对象。

func WithGinContext 

func WithGinContext(ctx *gin.Context, caller *types.Caller, trace *types.Trace)

WithGinContext 携带 Caller 和 Trace 信息到 gin.Context 中。

Types

type AccountCredential 

type AccountCredential struct {
	AccountID    string            `json:"account_id"`
	GrantType    string            `json:"grant_type"`
	AccessToken  string            `json:"access_token,omitempty"`
	RefreshToken string            `json:"refresh_token,omitempty"`
	ExpiresAt    *time.Time        `json:"expires_at,omitempty"`
	Metadata     map[string]string `json:"metadata,omitempty"`
}

AccountCredential 表示账户当前可用的授权材料。

type AccountResolver 

type AccountResolver struct {
	// contains filtered or unexported fields
}

AccountResolver 负责按 user + provider 解析运行时可用账户。

func NewAccountResolver 

func NewAccountResolver(store Store) *AccountResolver

NewAccountResolver 创建一个新的账户解析器。

func (*AccountResolver) Resolve 

func (r *AccountResolver) Resolve(ctx context.Context, req *ResolveAccountRequest) (*ResolvedAccount, error)

Resolve 解析运行时应使用的账户与凭证。

func (*AccountResolver) ResolveAuthorization 

func (r *AccountResolver) ResolveAuthorization(ctx context.Context, req *ResolveAuthorizationRequest) (*ResolvedAuthorization, bool, error)

ResolveAuthorization resolves a stored account profile as a generic runtime authorization.

type AuthSelector 

type AuthSelector struct {
	Provider          string            `json:"provider,omitempty"`
	ExplicitProfileID string            `json:"explicit_profile_id,omitempty"`
	SubjectType       string            `json:"subject_type,omitempty"`
	SubjectID         string            `json:"subject_id,omitempty"`
	ScopeType         string            `json:"scope_type,omitempty"`
	ScopeID           string            `json:"scope_id,omitempty"`
	ExternalRefs      map[string]string `json:"external_refs,omitempty"`
}

AuthSelector carries the minimal execution identity hints needed for runtime auth resolution.

type AuthorizationCallbackRequest 

type AuthorizationCallbackRequest struct {
	Provider string
	State    string
	Code     string
}

AuthorizationCallbackRequest 表示 OAuth 回调请求。

type AuthorizationProvider 

type AuthorizationProvider interface {
	ProviderCode() string
	BuildAuthorizationURL(req *StartAuthorizationRequest, state *OAuthState) (string, error)
	CompleteAuthorization(req *CompleteAuthorizationRequest) (*AuthorizationResult, error)
}

AuthorizationProvider 定义 provider 授权接入所需接口。

type AuthorizationResult 

type AuthorizationResult struct {
	Account    *AuthorizedAccount
	Credential *AccountCredential
}

AuthorizationResult 表示 provider 完成授权后的结果。

type AuthorizedAccount 

type AuthorizedAccount struct {
	ID                string            `json:"id"`
	UserID            string            `json:"user_id"`
	Provider          string            `json:"provider"`
	OwnerType         string            `json:"owner_type"`
	AccountType       string            `json:"account_type"`
	ExternalAccountID string            `json:"external_account_id"`
	DisplayName       string            `json:"display_name"`
	Scopes            []string          `json:"scopes"`
	Status            string            `json:"status"`
	Metadata          map[string]string `json:"metadata,omitempty"`
	CreatedAt         time.Time         `json:"created_at"`
	UpdatedAt         time.Time         `json:"updated_at"`
}

AuthorizedAccount 表示使用者授权后可被系统复用的第三方账户。

type CompleteAuthorizationRequest 

type CompleteAuthorizationRequest struct {
	State *OAuthState
	Code  string
}

CompleteAuthorizationRequest 表示 provider 完成授权所需的上下文。

type InMemoryStore 

type InMemoryStore struct {
	// contains filtered or unexported fields
}

InMemoryStore 是 Store 的内存实现。

func NewInMemoryStore 

func NewInMemoryStore() *InMemoryStore

NewInMemoryStore 创建一个新的内存授权存储。

func (*InMemoryStore) ConsumeOAuthState 

func (s *InMemoryStore) ConsumeOAuthState(_ context.Context, provider, state string) (*OAuthState, error)

ConsumeOAuthState 读取并删除一次 OAuth state。

func (*InMemoryStore) GetAuthorizedAccount 

func (s *InMemoryStore) GetAuthorizedAccount(_ context.Context, accountID string) (*AuthorizedAccount, error)

GetAuthorizedAccount 返回指定账户。

func (*InMemoryStore) GetCredential 

func (s *InMemoryStore) GetCredential(_ context.Context, accountID string) (*AccountCredential, error)

GetCredential 返回指定账户的凭证。

func (*InMemoryStore) GetDefaultAccount 

func (s *InMemoryStore) GetDefaultAccount(_ context.Context, userID, provider string) (*AuthorizedAccount, error)

GetDefaultAccount 返回某用户在某 provider 下的默认账户。

func (*InMemoryStore) ListUserAccounts 

func (s *InMemoryStore) ListUserAccounts(_ context.Context, userID, provider string) ([]*AuthorizedAccount, error)

ListUserAccounts 返回某用户在某 provider 下的所有账户。

func (*InMemoryStore) SaveOAuthState 

func (s *InMemoryStore) SaveOAuthState(_ context.Context, state *OAuthState) error

SaveOAuthState 保存一次 OAuth state。

func (*InMemoryStore) SetDefaultAccount 

func (s *InMemoryStore) SetDefaultAccount(_ context.Context, binding *UserProviderBinding) error

SetDefaultAccount 设置某用户在某 provider 下的默认账户。

func (*InMemoryStore) UpsertAuthorizedAccount 

func (s *InMemoryStore) UpsertAuthorizedAccount(_ context.Context, account *AuthorizedAccount, credential *AccountCredential) error

UpsertAuthorizedAccount 保存或更新授权账户和凭证。

type OAuthState 

type OAuthState struct {
	State       string    `json:"state"`
	UserID      string    `json:"user_id"`
	Provider    string    `json:"provider"`
	RedirectURI string    `json:"redirect_uri,omitempty"`
	CreatedAt   time.Time `json:"created_at"`
}

OAuthState 表示一次未完成的 OAuth 授权会话。

type ProviderAuthResolver 

type ProviderAuthResolver interface {
	ResolveAuthorization(ctx context.Context, req *ResolveAuthorizationRequest) (*ResolvedAuthorization, bool, error)
}

ProviderAuthResolver resolves one provider-specific authorization path.

type ResolveAccountRequest 

type ResolveAccountRequest struct {
	Selector *AuthSelector

	// Legacy compatibility fields. New call sites should prefer Selector.
	UserID    string
	Provider  string
	AccountID string
}

ResolveAccountRequest 表示一次运行时账户解析请求。

type ResolveAuthorizationRequest 

type ResolveAuthorizationRequest struct {
	Selector *AuthSelector

	// Legacy compatibility fields. New call sites should prefer Selector.
	UserID    string
	Provider  string
	AccountID string
}

ResolveAuthorizationRequest describes a provider-agnostic runtime authorization lookup.

type ResolvedAccount 

type ResolvedAccount struct {
	Account    *AuthorizedAccount
	Credential *AccountCredential
	ResolvedBy string
}

ResolvedAccount 表示解析完成的账户与凭证结果。

type ResolvedAuthorization 

type ResolvedAuthorization struct {
	Provider   string
	ProfileID  string
	ResolvedBy string
	Account    *AuthorizedAccount
	Credential *AccountCredential
	Labels     map[string]string
	Resources  map[string]interface{}
}

ResolvedAuthorization is the provider-agnostic output of runtime authorization resolution.

type StartAuthorizationRequest 

type StartAuthorizationRequest struct {
	UserID      string
	Provider    string
	RedirectURI string
}

StartAuthorizationRequest 表示发起授权请求。

type Store 

type Store interface {
	SaveOAuthState(ctx context.Context, state *OAuthState) error
	ConsumeOAuthState(ctx context.Context, provider, state string) (*OAuthState, error)

	UpsertAuthorizedAccount(ctx context.Context, account *AuthorizedAccount, credential *AccountCredential) error
	GetAuthorizedAccount(ctx context.Context, accountID string) (*AuthorizedAccount, error)
	ListUserAccounts(ctx context.Context, userID, provider string) ([]*AuthorizedAccount, error)

	GetCredential(ctx context.Context, accountID string) (*AccountCredential, error)

	SetDefaultAccount(ctx context.Context, binding *UserProviderBinding) error
	GetDefaultAccount(ctx context.Context, userID, provider string) (*AuthorizedAccount, error)
}

Store 定义授权账户的存储接口。

type ThirdPartyAuthService 

type ThirdPartyAuthService struct {
	// contains filtered or unexported fields
}

ThirdPartyAuthService 提供统一的第三方平台授权账户接入与运行时解析能力。

func NewThirdPartyAuthService 

func NewThirdPartyAuthService(store Store, resolver *AccountResolver) *ThirdPartyAuthService

NewThirdPartyAuthService 创建一个新的第三方平台授权服务。

func (*ThirdPartyAuthService) HandleAuthorizationCallback 

func (s *ThirdPartyAuthService) HandleAuthorizationCallback(ctx context.Context, req *AuthorizationCallbackRequest) (*AuthorizationResult, error)

HandleAuthorizationCallback 处理 provider 回调并保存授权账户。

func (*ThirdPartyAuthService) RegisterAuthResolver 

func (s *ThirdPartyAuthService) RegisterAuthResolver(provider string, resolver ProviderAuthResolver)

RegisterAuthResolver registers a provider-specific runtime authorization resolver.

func (*ThirdPartyAuthService) RegisterProvider 

func (s *ThirdPartyAuthService) RegisterProvider(provider AuthorizationProvider)

RegisterProvider 注册一个授权 provider。

func (*ThirdPartyAuthService) ResolveAccount 

func (s *ThirdPartyAuthService) ResolveAccount(ctx context.Context, req *ResolveAccountRequest) (*ResolvedAccount, error)

ResolveAccount 解析运行时可用账户。

func (*ThirdPartyAuthService) ResolveAuthorization 

func (s *ThirdPartyAuthService) ResolveAuthorization(ctx context.Context, req *ResolveAuthorizationRequest) (*ResolvedAuthorization, error)

ResolveAuthorization resolves runtime authorization through provider-specific resolvers first.

func (*ThirdPartyAuthService) StartAuthorization 

func (s *ThirdPartyAuthService) StartAuthorization(ctx context.Context, req *StartAuthorizationRequest) (string, error)

StartAuthorization 发起某个 provider 的用户授权。

type UserProviderBinding 

type UserProviderBinding struct {
	UserID    string `json:"user_id"`
	Provider  string `json:"provider"`
	AccountID string `json:"account_id"`
	IsDefault bool   `json:"is_default"`
	Priority  int    `json:"priority"`
}

UserProviderBinding 表示某用户在某 provider 下的默认账户绑定。

type WorkerClaims added in v0.1.12 

type WorkerClaims struct {
	OrgID    uint   `json:"org_id"`
	WorkerID uint   `json:"worker_id"`
	Kind     string `json:"kind"`
	Scope    string `json:"scope"`
	jwt.StandardClaims
}

WorkerClaims carries the AI teammate identity used by a worker process.

func ParseWorkerToken added in v0.1.12 

func ParseWorkerToken(tokenStr, secret string) (*WorkerClaims, error)

ParseWorkerToken verifies a worker token and returns the AI teammate identity.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.