auth

type ClientCertificateClient ¶ added in v1.0.0

type ClientCertificateClient struct {
	// contains filtered or unexported fields
}

ClientCertificateClient implements TokenProvider using a client certificate.

func NewClientCertificateClient(cfg *config.Config) (*ClientCertificateClient, error)

func (c *ClientCertificateClient) AcquireToken(ctx context.Context, _ []string) (string, error)

func (c *ClientCertificateClient) AcquireTokenWithExtraScopes(_ context.Context, _, _ []string) (string, error)

func (c *ClientCertificateClient) IsAppOnly() bool

func (c *ClientCertificateClient) SignOut() error

func (c *ClientCertificateClient) Status(ctx context.Context) (map[string]interface{}, error)

type ClientSecretClient ¶ added in v1.0.0

type ClientSecretClient struct {
	// contains filtered or unexported fields
}

ClientSecretClient implements TokenProvider using client secret credentials.

func NewClientSecretClient(cfg *config.Config) (*ClientSecretClient, error)

func (c *ClientSecretClient) AcquireToken(ctx context.Context, _ []string) (string, error)

func (c *ClientSecretClient) AcquireTokenWithExtraScopes(_ context.Context, _, _ []string) (string, error)

func (c *ClientSecretClient) IsAppOnly() bool

func (c *ClientSecretClient) SignOut() error

func (c *ClientSecretClient) Status(ctx context.Context) (map[string]interface{}, error)

type DelegatedClient ¶ added in v1.0.0

type DelegatedClient struct {
	// contains filtered or unexported fields
}

DelegatedClient implements TokenProvider using MSAL public client (interactive + device code). This is the default auth method for user-delegated authentication.

func NewDelegatedClient(cfg *config.Config) (*DelegatedClient, error)

func (c *DelegatedClient) AcquireToken(ctx context.Context, scopes []string) (string, error)

func (c *DelegatedClient) AcquireTokenDeviceCode(ctx context.Context, scopes []string) (string, error)

func (c *DelegatedClient) AcquireTokenInteractive(ctx context.Context, scopes []string) (string, error)

func (c *DelegatedClient) AcquireTokenSilent(ctx context.Context, scopes []string) (string, error)

func (c *DelegatedClient) AcquireTokenWithExtraScopes(ctx context.Context, existingScopes, extraScopes []string) (string, error)

func (c *DelegatedClient) GetAccounts(ctx context.Context) ([]public.Account, error)

func (c *DelegatedClient) IsAppOnly() bool

func (c *DelegatedClient) SignOut() error

func (c *DelegatedClient) Status(ctx context.Context) (map[string]interface{}, error)

type ManagedIdentityClient ¶ added in v1.0.0

type ManagedIdentityClient struct {
	// contains filtered or unexported fields
}

ManagedIdentityClient implements TokenProvider using Azure managed identity. This works on Azure VMs, App Service, Azure Functions, AKS, and other Azure compute resources with a managed identity assigned.

func NewManagedIdentityClient(cfg *config.Config) (*ManagedIdentityClient, error)

func (c *ManagedIdentityClient) AcquireToken(ctx context.Context, _ []string) (string, error)

func (c *ManagedIdentityClient) AcquireTokenWithExtraScopes(_ context.Context, _, _ []string) (string, error)

func (c *ManagedIdentityClient) IsAppOnly() bool

func (c *ManagedIdentityClient) SignOut() error

func (c *ManagedIdentityClient) Status(ctx context.Context) (map[string]interface{}, error)

type SessionData ¶

type SessionData struct {
	Account  public.Account `json:"account"`
	TenantID string         `json:"tenantId"`
	ClientID string         `json:"clientId"`
	Scopes   []string       `json:"scopes"`
}

SessionData stores the current auth session state.

type TokenProvider ¶ added in v1.0.0

type TokenProvider interface {
	// AcquireToken gets an access token for the given scopes.
	// For app-only auth, individual scopes are ignored and .default is used.
	AcquireToken(ctx context.Context, scopes []string) (string, error)

	// AcquireTokenWithExtraScopes re-acquires a token with additional scopes
	// for incremental consent. Returns ErrIncrementalConsentNotSupported for
	// app-only auth methods where permissions are pre-granted by admin.
	AcquireTokenWithExtraScopes(ctx context.Context, existingScopes, extraScopes []string) (string, error)

	// SignOut clears any cached credentials/sessions.
	SignOut() error

	// Status returns information about the current auth state.
	Status(ctx context.Context) (map[string]interface{}, error)

	// IsAppOnly returns true for app-only auth methods (no user context).
	IsAppOnly() bool
}

TokenProvider is the interface for all auth methods. The Graph HTTP client uses this interface to acquire tokens without knowing the underlying method.

func NewTokenProvider(cfg *config.Config) (TokenProvider, error)

type WorkloadIdentityClient ¶ added in v1.0.0

type WorkloadIdentityClient struct {
	// contains filtered or unexported fields
}

WorkloadIdentityClient implements TokenProvider using federated token assertion. This supports workload identity federation from Azure Kubernetes Service, AWS EKS, GCP GKE, and other environments that provide a JWT token file.

The token file is re-read on each acquisition to pick up rotated tokens.

func NewWorkloadIdentityClient(cfg *config.Config) (*WorkloadIdentityClient, error)

func (c *WorkloadIdentityClient) AcquireToken(ctx context.Context, _ []string) (string, error)

func (c *WorkloadIdentityClient) AcquireTokenWithExtraScopes(_ context.Context, _, _ []string) (string, error)

func (c *WorkloadIdentityClient) IsAppOnly() bool

func (c *WorkloadIdentityClient) SignOut() error

func (c *WorkloadIdentityClient) Status(ctx context.Context) (map[string]interface{}, error)