go-common

module

v0.6.1 Latest Latest Go to latest Published: Sep 12, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kombifyio/go-common

Links

Open Source Insights

README ¶

kombify Go Common

Public, provider-neutral Go utilities used by the kombify TechStack self-hosted runtime and its native clients.

This mirror contains the provider-neutral public library surface used by the TechStack local/self-host runtime. It owns reusable authentication, denial, identity, HTTP, native-client, and runtime-envelope utilities. It does not own provider credentials, provider drivers, hosted commerce, product state, or orchestration policy.

Packages

authflow, authlocal, and authsession — browser and local session flows
cloudlogin — fail-closed optional hosted-login gate
denial — stable client-facing denial envelopes
identity and role — provider-neutral identity helpers
httputil — HTTP envelopes
nativeclient/* and toolauth — device/profile flows used by native clients
oidcclient — provider-neutral OIDC discovery, PKCE, and verification
runtimeexecutor — provider-neutral execution envelope validation

Self-hosted callers keep hosted integrations disabled by configuration. This repository contains no SaaS edge authentication, FGA client, company observability adapter, service-to-service authentication, container image, provider implementation, product state, or provider credentials.

Development

go test ./...
go build ./...

The module path is github.com/kombifyio/go-common. Consumers must pin a published version.

License

Apache-2.0. See LICENSE.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
authflow Package authflow implements the browser-facing OIDC auth-code flow for kombify backend services.	Package authflow implements the browser-facing OIDC auth-code flow for kombify backend services.
authlocal Package authlocal implements username+password authentication for kombify backends backed by a single break-glass admin record.	Package authlocal implements username+password authentication for kombify backends backed by a single break-glass admin record.
authsession Package authsession implements stateless HS256-signed session tokens that kombify backend services issue to their own browser frontends after a successful login (OIDC code-flow via [authflow], or break-glass via [authlocal]).	Package authsession implements stateless HS256-signed session tokens that kombify backend services issue to their own browser frontends after a successful login (OIDC code-flow via [authflow], or break-glass via [authlocal]).
cloudlogin Package cloudlogin implements the fail-closed enrollment-token gate for kombify Cloud login on a self-hosted instance.	Package cloudlogin implements the fail-closed enrollment-token gate for kombify Cloud login on a self-hosted instance.
denial Package denial is the single client-error-envelope/v1 type for cost-bearing and entitlement denials.	Package denial is the single client-error-envelope/v1 type for cost-bearing and entitlement denials.
httputil
identity Package identity provides shared types for edge-injected user identity.	Package identity provides shared types for edge-injected user identity.
internal
referenceid Package referenceid contains the closed grammars shared by otherwise independent provider-free wire packages.	Package referenceid contains the closed grammars shared by otherwise independent provider-free wire packages.
nativeclient
interactiveauth Package interactiveauth implements the two human-interactive native OAuth flows of NATIVE-CLIENT-PLATFORM-STANDARD.md section 4, composed on the transport-pure oidcclient package:	Package interactiveauth implements the two human-interactive native OAuth flows of NATIVE-CLIENT-PLATFORM-STANDARD.md section 4, composed on the transport-pure oidcclient package:
profile Package profile implements the client side of the Kombify ClientConnectionProfile v1 contract: strict fail-closed parsing, validation, and discovery fetching of `GET /.well-known/kombify-client`.	Package profile implements the client side of the Kombify ClientConnectionProfile v1 contract: strict fail-closed parsing, validation, and discovery fetching of `GET /.well-known/kombify-client`.
oidcclient Package oidcclient provides a provider-neutral OIDC client used across all kombify Go services (Simulate, StackKits-Server, TechStack).	Package oidcclient provides a provider-neutral OIDC client used across all kombify Go services (Simulate, StackKits-Server, TechStack).
role Role claim extraction from OIDC tokens.	Role claim extraction from OIDC tokens.
runtimeexecutor Package runtimeexecutor defines the provider-neutral v1beta1 contract for executing already-authorized governed runtime targets.	Package runtimeexecutor defines the provider-neutral v1beta1 contract for executing already-authorized governed runtime targets.
toolauth Package toolauth provides client-side authentication for kombify desktop tools.	Package toolauth provides client-side authentication for kombify desktop tools.