Documentation
¶
Index ¶
- func DeleteToken(profileName string) error
- func GetTokenSilent(ctx context.Context, profile *config.Profile, authRecordJSON string, ...) (azcore.AccessToken, error)
- func GraphScopes(scopes []string) []string
- func LoginAppOnly(ctx context.Context, profile *config.Profile, clientSecret string, ...) (azcore.AccessToken, error)
- func LoginCertificate(ctx context.Context, profile *config.Profile, pemPath string, ipv4Only bool) (azcore.AccessToken, error)
- func LoginDelegated(ctx context.Context, profile *config.Profile, ipv4Only bool) (azcore.AccessToken, error)
- func NewDelegatedCredentialSilent(profile *config.Profile, authRecordJSON string, ipv4Only bool) (azcore.TokenCredential, error)
- func RefreshAppOnly(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)
- func RefreshCertificate(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)
- func ShouldUseIPv4(cfg *config.Config) bool
- func StoreToken(profileName string, cache *TokenCache) error
- type DelegatedLoginResult
- type TokenCache
- type TokenInfo
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GetTokenSilent ¶ added in v0.2.0
func GetTokenSilent(ctx context.Context, profile *config.Profile, authRecordJSON string, scopes []string, ipv4Only bool) (azcore.AccessToken, error)
GetTokenSilent attempts a silent token acquisition for a delegated profile. Returns an access token if the MSAL cache has a valid refresh token, or an error if interactive login is required.
func GraphScopes ¶
GraphScopes converts a list of short scope names to full URIs
func LoginAppOnly ¶
func LoginAppOnly(ctx context.Context, profile *config.Profile, clientSecret string, ipv4Only bool) (azcore.AccessToken, error)
LoginAppOnly performs client credentials flow authentication (app-only). The client secret is stored encrypted for unattended token refresh.
func LoginCertificate ¶
func LoginCertificate(ctx context.Context, profile *config.Profile, pemPath string, ipv4Only bool) (azcore.AccessToken, error)
LoginCertificate performs certificate-based authentication (app-only). The PEM file must contain both the certificate and private key.
func LoginDelegated ¶
func LoginDelegated(ctx context.Context, profile *config.Profile, ipv4Only bool) (azcore.AccessToken, error)
LoginDelegated performs device-code flow authentication
func NewDelegatedCredentialSilent ¶ added in v0.2.0
func NewDelegatedCredentialSilent(profile *config.Profile, authRecordJSON string, ipv4Only bool) (azcore.TokenCredential, error)
NewDelegatedCredentialSilent creates a DeviceCodeCredential backed by the persistent MSAL cache with a stored AuthenticationRecord. The UserPrompt returns an error so that if MSAL can't silently refresh (refresh token expired), it fails fast rather than printing a device code in an unattended context.
The authRecordJSON must be the JSON from a previous LoginDelegatedWithCache call.
func RefreshAppOnly ¶
func RefreshAppOnly(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)
RefreshAppOnly uses a stored client secret to get a fresh app-only token. Returns the new token and updates the cache in place. Caller must persist the cache.
func RefreshCertificate ¶ added in v0.2.0
func RefreshCertificate(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)
RefreshCertificate uses a stored certificate path to get a fresh app-only token. Returns the new token. Caller must persist the cache.
func ShouldUseIPv4 ¶
ShouldUseIPv4 returns true if IPv4-only transport should be used. Checks CB365_IPV4_ONLY env var and config setting.
func StoreToken ¶
func StoreToken(profileName string, cache *TokenCache) error
StoreToken securely stores a token
Types ¶
type DelegatedLoginResult ¶ added in v0.2.0
type DelegatedLoginResult struct {
Token azcore.AccessToken
AuthRecord azidentity.AuthenticationRecord
}
DelegatedLoginResult holds the credential, token, and authentication record from an interactive delegated login. The AuthRecord must be persisted so that subsequent silent logins can look up the account in the MSAL cache.
func LoginDelegatedWithCache ¶ added in v0.2.0
func LoginDelegatedWithCache(ctx context.Context, profile *config.Profile, ipv4Only bool, promptFn func(context.Context, azidentity.DeviceCodeMessage) error) (*DelegatedLoginResult, error)
LoginDelegatedWithCache performs a device-code login with the MSAL persistent cache. Returns the token AND the AuthenticationRecord, which MUST be stored for silent refresh.
type TokenCache ¶
type TokenCache struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
ClientSecret string `json:"client_secret,omitempty"`
CertPath string `json:"cert_path,omitempty"`
AuthRecord string `json:"auth_record,omitempty"` // JSON-serialized azidentity.AuthenticationRecord for MSAL cache lookup
ExpiresAt string `json:"expires_at"`
TokenType string `json:"token_type"`
Scope string `json:"scope"`
}
TokenCache represents cached authentication data SECURITY: Never log or print this struct — it contains secrets
func LoadToken ¶
func LoadToken(profileName string) (*TokenCache, error)
LoadToken retrieves a token
type TokenInfo ¶
type TokenInfo struct {
Subject string `json:"subject,omitempty"`
UPN string `json:"upn,omitempty"`
Name string `json:"name,omitempty"`
TenantID string `json:"tenant_id,omitempty"`
AppName string `json:"app_name,omitempty"`
Scopes []string `json:"scopes,omitempty"`
ExpiresAt string `json:"expires_at,omitempty"`
IssuedAt string `json:"issued_at,omitempty"`
ValidFor string `json:"valid_for,omitempty"`
IsExpired bool `json:"is_expired"`
}
TokenInfo represents decoded JWT claims for display SECURITY: This is for display only — never contains the raw token
func DecodeTokenInfo ¶
DecodeTokenInfo extracts display-safe info from a JWT access token SECURITY: Only extracts claims — does NOT validate the token signature
Source Files