auth

func CheckOrgMembership ¶

func CheckOrgMembership(ctx context.Context, accessToken, org string) (bool, error)

CheckOrgMembership returns true if the authenticated user belongs to the given organization.

func ExchangeCodeForToken ¶

func ExchangeCodeForToken(ctx context.Context, clientID, clientSecret, code string) (string, error)

ExchangeCodeForToken exchanges a GitHub OAuth code for an access token.

func FromContextKey ¶

func FromContextKey(ctx context.Context, claims *Claims) context.Context

func GenerateOAuthState ¶

func GenerateOAuthState(secret []byte, sessionID string) (string, error)

GenerateOAuthState creates a random nonce and signs it with the given secret, returning a state string suitable for use in the OAuth `state` parameter. The format is: base64url(nonce) + "." + base64url(HMAC-SHA256(nonce, secret))

func GetUsername ¶

func GetUsername(ctx context.Context, accessToken string) (string, error)

GetUsername retrieves the authenticated GitHub user's login name.

func GithubAuthURL ¶

func GithubAuthURL(clientID, state, redirectURI string, isOrg bool) string

func IssueSessionToken ¶

func IssueSessionToken(secret []byte, username string) (string, error)

IssueSessionToken creates a signed JWT session token for the given user. The token is valid for 24 hours.

func ValidateOAuthState ¶

func ValidateOAuthState(secret []byte, state string) (string, error)

ValidateOAuthState verifies that the given state string was produced by GenerateOAuthState with the same secret. Returns an error if validation fails.