Documentation
¶
Overview ¶
Package githubauth implements the GitHub App user-authorization web flow: building the authorize URL, exchanging the returned code for a user access token, and checking which app installations that user can see.
GitHub documents that the installation_id on a setup-URL redirect can be spoofed and must be confirmed against the installing user's own token. This package is the shared piece of that check so the dashboard server (which starts the flow) and ctl-api (which finishes it) agree on the protocol.
Index ¶
Constants ¶
const ( DefaultAuthorizeURL = "https://github.com/login/oauth/authorize" DefaultTokenURL = "https://github.com/login/oauth/access_token" DefaultAPIBaseURL = "https://api.github.com/" )
Variables ¶
var ErrInstallationNotOwned = errors.New("github installation is not accessible to the authorizing user")
ErrInstallationNotOwned is returned when the authorizing user cannot see the requested installation.
var ErrNotConfigured = errors.New("github oauth client is not configured")
ErrNotConfigured is returned when the client has no client ID or secret.
Functions ¶
func AuthorizeURL ¶
AuthorizeURL builds the web-flow authorize URL for a GitHub App. No scopes are requested: a GitHub App user token is limited by the app's own permissions, and listing the user's installations needs none.
Types ¶
type Client ¶
type Client struct {
ClientID string
ClientSecret string
// HTTPClient, TokenURL and APIBaseURL default to production GitHub when
// unset. Tests point them at an httptest server.
HTTPClient *http.Client
TokenURL string
APIBaseURL string
}
Client exchanges codes and queries installations on behalf of a user.
func (*Client) ExchangeCode ¶
ExchangeCode trades a web-flow code for a user access token.
func (*Client) UserInstallationIDs ¶
UserInstallationIDs lists the app installations the token's user can see.
Source Files