Documentation
¶
Overview ¶
Package interactiveauth implements the two human-interactive native OAuth flows of NATIVE-CLIENT-PLATFORM-STANDARD.md section 4, composed on the transport-pure oidcclient package:
- Flow A: loopback redirect with PKCE (RFC 8252) for desktops that can open a system browser.
- Flow B: device authorization grant (RFC 8628) for headless/CLI use.
Native clients are public clients: no client secret is used anywhere in this package. Universal Login happens in the system browser, never in an embedded credential-collecting WebView. The package carries no provider-specific branches beyond RFC-standard endpoints.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrDeviceStart = errors.New("interactiveauth: device authorization start failed") ErrDeviceExpired = errors.New("interactiveauth: device code expired") )
Device grant errors.
var ( ErrBrowserOpen = errors.New("interactiveauth: opening the system browser failed") ErrCallback = errors.New("interactiveauth: authorization callback failed") ErrFlowTimeout = errors.New("interactiveauth: authorization timed out") ErrAccessDenied = errors.New("interactiveauth: authorization was denied") ErrInvalidConfig = errors.New("interactiveauth: invalid configuration") )
Errors returned by the interactive flows.
Functions ¶
func DeviceGrant ¶
func DeviceGrant(ctx context.Context, cfg DeviceGrantConfig) (*oidcclient.CodeExchangeResult, error)
DeviceGrant runs the full RFC 8628 flow: it requests a device code, prompts the user with the verification URI, and polls the token endpoint — honoring `authorization_pending` and `slow_down` — until approval, denial, expiry, or timeout.
func LoopbackPKCE ¶
func LoopbackPKCE(ctx context.Context, cfg LoopbackConfig) (*oidcclient.CodeExchangeResult, error)
LoopbackPKCE runs the full RFC 8252 flow: it binds an ephemeral listener on 127.0.0.1 (literal address per RFC 8252 section 7.3), opens the system browser on the provider's authorization URL with a fresh S256 PKCE challenge and state, waits for exactly one matching callback, and exchanges the code for tokens.
Types ¶
type DeviceGrantConfig ¶
type DeviceGrantConfig struct {
// Provider supplies the token endpoint, client id, and scopes.
Provider *oidcclient.Provider
// DeviceAuthorizationURL defaults to `<issuer>/oauth/device/code`
// (the Auth0 and generic convention).
DeviceAuthorizationURL string
// Audience is passed to the device authorization request when set.
Audience string
// Prompt displays the user code and verification URI. Required.
Prompt func(userCode, verificationURI, verificationURIComplete string)
// Timeout bounds the whole interaction. Defaults to the server-provided
// expires_in (capped at 15 minutes) when zero.
Timeout time.Duration
// PollInterval overrides the server-provided polling interval when
// positive. RFC 8628 slow_down responses still extend it.
PollInterval time.Duration
// HTTPClient defaults to a 30 s per-request timeout client.
HTTPClient *http.Client
}
DeviceGrantConfig configures the RFC 8628 device authorization flow.
type LoopbackConfig ¶
type LoopbackConfig struct {
// Provider supplies authorization/token endpoints, client id, and scopes.
Provider *oidcclient.Provider
// OpenBrowser opens the authorization URL in the system browser. Required:
// the flow never embeds a login surface.
OpenBrowser func(authURL string) error
// Timeout bounds the whole interaction. Defaults to 5 minutes.
Timeout time.Duration
// SuccessHTML is served to the browser after a successful callback.
// A minimal English default is used when empty.
SuccessHTML string
// Exchanger defaults to [oidcclient.NewHTTPCodeExchanger].
Exchanger oidcclient.CodeExchanger
}
LoopbackConfig configures the RFC 8252 loopback PKCE flow.
Source Files