auth

package

v0.10.0 Latest Latest Go to latest Published: May 6, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kong/kongctl

Links

Documentation ¶

Index ¶

Constants
Variables
func DeleteAccessToken(cfg config.Hook) (bool, error)
func GetAuthenticatedClient(baseURL string, tokenSource *TokenSource, timeout time.Duration, ...) (*kk.SDK, kk.HTTPClient, error)
func SaveAccessToken(cfg config.Hook, token *AccessToken) error
func ValidateKonnectURL(rawURL string) error
type AccessToken
- func LoadAccessToken(cfg config.Hook, refreshURL string, timeout time.Duration, ...) (*AccessToken, error)
- func PollForToken(ctx context.Context, httpClient *http.Client, url string, clientID string, ...) (*AccessToken, error)
- func RefreshAccessToken(refreshURL string, refreshToken string, timeout time.Duration, ...) (*AccessToken, error)
- func (t *AccessToken) IsExpired() bool
type AccessTokenResponse
type DAGError
- func (d *DAGError) Error() string
type DeviceCodeResponse
- func RequestDeviceCode(httpClient *http.Client, url string, clientID string, logger *slog.Logger) (DeviceCodeResponse, error)
type RefreshingHTTPClient
- func NewRefreshingHTTPClient(base kk.HTTPClient, tokenSource *TokenSource) *RefreshingHTTPClient
- func (c *RefreshingHTTPClient) Do(req *http.Request) (*http.Response, error)
type TokenSource
- func NewTokenSource(cfg config.Hook, opts TokenSourceOptions) *TokenSource
- func (s *TokenSource) Refresh(ctx context.Context, previousToken string) (string, error)
- func (s *TokenSource) Refreshable() bool
- func (s *TokenSource) Security(ctx context.Context) (kkComps.Security, error)
- func (s *TokenSource) Token(ctx context.Context) (string, error)
type TokenSourceOptions

Constants ¶

View Source

const DefaultAccessTokenExpirySkew = time.Minute

Variables ¶

View Source

var (
	DAGGrantType                  = "urn:ietf:params:oauth:grant-type:device_code"
	AuthorizationPendingErrorCode = "authorization_pending"
)

View Source

var ErrTokenRefreshUnsupported = errors.New("token refresh is not supported")

Functions ¶

func DeleteAccessToken ¶ added in v0.3.3

func DeleteAccessToken(cfg config.Hook) (bool, error)

func GetAuthenticatedClient ¶

func GetAuthenticatedClient(
	baseURL string,
	tokenSource *TokenSource,
	timeout time.Duration,
	transportOptions httpclient.TransportOptions,
	logger *slog.Logger,
) (*kk.SDK, kk.HTTPClient, error)

func SaveAccessToken ¶

func SaveAccessToken(cfg config.Hook, token *AccessToken) error

func ValidateKonnectURL ¶ added in v0.10.0

func ValidateKonnectURL(rawURL string) error

ValidateKonnectURL parses rawURL and ensures it uses HTTPS and targets a trusted Kong-owned domains.

Types ¶

type AccessToken ¶

type AccessToken struct {
	Token      *AccessTokenResponse `json:"token"`
	ReceivedAt time.Time            `json:"received_at"`
}

func LoadAccessToken ¶

func LoadAccessToken(
	cfg config.Hook,
	refreshURL string,
	timeout time.Duration,
	transportOptions httpclient.TransportOptions,
	logger *slog.Logger,
) (*AccessToken, error)

For a given profile, load a saved token from disk in the same path as the config path. * If there is no file, return error. * If it's not expired, return it. * If it's expired, refresh it, then store it, then return it

func PollForToken ¶

func PollForToken(ctx context.Context, httpClient *http.Client,
	url string, clientID string, deviceCode string, logger *slog.Logger,
) (*AccessToken, error)

func RefreshAccessToken ¶

func RefreshAccessToken(
	refreshURL string,
	refreshToken string,
	timeout time.Duration,
	transportOptions httpclient.TransportOptions,
	logger *slog.Logger,
) (*AccessToken, error)

func (*AccessToken) IsExpired ¶

func (t *AccessToken) IsExpired() bool

type AccessTokenResponse ¶

type AccessTokenResponse struct {
	AuthToken    string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	TokenType    string `json:"token_type"`
	ExpiresAfter int    `json:"expires_in"`
	Scope        string `json:"scope"`
}

type DAGError ¶

type DAGError struct {
	ErrorDescription string `json:"error_description,omitempty"`
	ErrorURI         string `json:"error_uri,omitempty"`
	ErrorCode        string `json:"error"`
}

func (*DAGError) Error ¶

func (d *DAGError) Error() string

type DeviceCodeResponse ¶

type DeviceCodeResponse struct {
	DeviceCode              string `json:"device_code"`
	UserCode                string `json:"user_code"`
	VerificationURI         string `json:"verification_uri"`
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
	ExpiresIn               int    `json:"expires_in"`
	Interval                int    `json:"interval,omitempty"`
}

func RequestDeviceCode ¶

func RequestDeviceCode(httpClient *http.Client,
	url string, clientID string, logger *slog.Logger,
) (DeviceCodeResponse, error)

type RefreshingHTTPClient ¶ added in v0.10.0

type RefreshingHTTPClient struct {
	// contains filtered or unexported fields
}

RefreshingHTTPClient retries one replayable request after a recoverable 401.

func NewRefreshingHTTPClient ¶ added in v0.10.0

func NewRefreshingHTTPClient(base kk.HTTPClient, tokenSource *TokenSource) *RefreshingHTTPClient

func (*RefreshingHTTPClient) Do ¶ added in v0.10.0

func (c *RefreshingHTTPClient) Do(req *http.Request) (*http.Response, error)

type TokenSource ¶ added in v0.10.0

type TokenSource struct {
	// contains filtered or unexported fields
}

TokenSource provides the current Konnect bearer token for each request. It is safe for concurrent use by future parallel executor workers.

func NewTokenSource ¶ added in v0.10.0

func NewTokenSource(cfg config.Hook, opts TokenSourceOptions) *TokenSource

func (*TokenSource) Refresh ¶ added in v0.10.0

func (s *TokenSource) Refresh(ctx context.Context, previousToken string) (string, error)

func (*TokenSource) Refreshable ¶ added in v0.10.0

func (s *TokenSource) Refreshable() bool

func (*TokenSource) Security ¶ added in v0.10.0

func (s *TokenSource) Security(ctx context.Context) (kkComps.Security, error)

func (*TokenSource) Token ¶ added in v0.10.0

func (s *TokenSource) Token(ctx context.Context) (string, error)

type TokenSourceOptions ¶ added in v0.10.0

type TokenSourceOptions struct {
	PAT              string
	RefreshURL       string
	Timeout          time.Duration
	TransportOptions httpclient.TransportOptions
	Logger           *slog.Logger
	ExpirySkew       time.Duration
	Refresh          refreshAccessTokenFunc
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL