Documentation
¶
Overview ¶
Package auth implements Google's documented OAuth flow for desktop applications: a loopback redirect on 127.0.0.1 with a random port and PKCE, then a refresh-token-backed token source for API calls.
Index ¶
- Constants
- Variables
- func HasScopes(granted, wanted []string) (missing []string)
- func LoadClientSecret(path string, scopes []string) (*oauth2.Config, error)
- func Login(ctx context.Context, cfg *oauth2.Config, opts LoginOptions) (*oauth2.Token, error)
- func OpenBrowser(u string) error
- func ParseClientSecret(data []byte, scopes []string) (*oauth2.Config, error)
- func Revoke(ctx context.Context, client *http.Client, token string) error
- func Scopes(readOnly bool) []string
- func TokenSource(ctx context.Context, cfg *oauth2.Config, refreshToken string, ...) oauth2.TokenSource
- type LoginOptions
- type TokenInfo
Constants ¶
const ( ScopeDocuments = "https://www.googleapis.com/auth/documents" ScopeDocumentsReadonly = "https://www.googleapis.com/auth/documents.readonly" ScopeDrive = "https://www.googleapis.com/auth/drive" ScopeDriveReadonly = "https://www.googleapis.com/auth/drive.readonly" )
OAuth scopes. documents is "sensitive", drive is "restricted"; both are fine for a per-user app that is never published.
const ( GoogleAuthURL = "https://accounts.google.com/o/oauth2/auth" GoogleTokenURL = "https://oauth2.googleapis.com/token" )
Google's OAuth endpoints, used when the client JSON omits them.
const DefaultHTTPTimeout = 60 * time.Second
DefaultHTTPTimeout bounds an OAuth call when no timeout is given.
Variables ¶
var ( RevokeURL = "https://oauth2.googleapis.com/revoke" TokenInfoURL = "https://oauth2.googleapis.com/tokeninfo" )
Endpoints used for revocation and token inspection. Vars so tests can point them at a local server.
var ErrNoBrowser = errors.New("--no-browser")
ErrNoBrowser is what an OpenBrowser hook returns when the caller asked for the URL instead of a browser. Exported so the caller does not have to encode that choice in an error string the printer then matches on.
var ErrNotDesktopClient = errors.New("auth: client secret JSON is not a Desktop app client (expected an \"installed\" section)")
ErrNotDesktopClient means the JSON is not a "Desktop app" OAuth client.
Functions ¶
func LoadClientSecret ¶
LoadClientSecret reads a Desktop-app client JSON downloaded from the Google Cloud console and returns an oauth2.Config for the scopes.
func Login ¶
Login runs the loopback authorization-code flow and returns a token that includes a refresh token.
func OpenBrowser ¶
OpenBrowser opens url with the platform's default handler.
func ParseClientSecret ¶
ParseClientSecret is LoadClientSecret on bytes.
Types ¶
type LoginOptions ¶
type LoginOptions struct {
// OpenBrowser is called with the authorization URL. nil uses the OS
// default browser; a function that returns an error is not fatal, the
// URL is always printed to Out as well.
OpenBrowser func(url string) error
// Out receives the URL and progress messages. nil discards them.
Out io.Writer
// Timeout bounds the wait for the browser. Default 5 minutes.
Timeout time.Duration
// Listener overrides the loopback listener (tests).
Listener net.Listener
// HTTPTimeout bounds the code exchange. Zero means
// DefaultHTTPTimeout; it is not the same as Timeout, which bounds
// the person's trip through the browser.
HTTPTimeout time.Duration
}
LoginOptions tune the interactive flow. Zero values are sensible.
Source Files