auth

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 12, 2026 License: MIT Imports: 38 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DeleteManagedChannelMessageProvenance added in v0.3.0 

func DeleteManagedChannelMessageProvenance(ctx context.Context, profile *config.Profile, secretID string, target ManagedChannelMessageTarget) error

DeleteManagedChannelMessageProvenance verifies, deletes, and proves absence of a consumed provenance record. It never deletes an unverified record.

func DeleteManagedDelegated added in v0.3.0 

func DeleteManagedDelegated(ctx context.Context, profile *config.Profile) error

func DeleteToken 

func DeleteToken(profileName string) error

DeleteToken removes a token

func DiscardManagedDelegatedMigration added in v0.3.0 

func DiscardManagedDelegatedMigration(ctx context.Context, profile *config.Profile) error

DiscardManagedDelegatedMigration removes only the newly-created BWS record. It is used when non-secret migration metadata cannot be persisted; the verified legacy source remains untouched and can be retried safely.

func DiscardManagedDelegatedRecord added in v0.3.0 

func DiscardManagedDelegatedRecord(ctx context.Context, profile *config.Profile) error

DiscardManagedDelegatedRecord removes a newly-created BWS record without touching any legacy cache. It is only a transaction rollback helper.

func GetTokenSilent added in v0.2.0 

func GetTokenSilent(ctx context.Context, profile *config.Profile, authRecordJSON string, scopes []string, ipv4Only bool) (azcore.AccessToken, error)

GetTokenSilent attempts a silent token acquisition for a delegated profile. Returns an access token if the MSAL cache has a valid refresh token, or an error if interactive login is required.

func GraphScopes 

func GraphScopes(scopes []string) []string

GraphScopes converts a list of short scope names to full URIs

func LoginAppOnly 

func LoginAppOnly(ctx context.Context, profile *config.Profile, clientSecret string, ipv4Only bool) (azcore.AccessToken, error)

LoginAppOnly performs client credentials flow authentication (app-only). The client secret is stored encrypted for unattended token refresh.

func LoginCertificate 

func LoginCertificate(ctx context.Context, profile *config.Profile, pemPath string, ipv4Only bool) (azcore.AccessToken, error)

LoginCertificate performs certificate-based authentication (app-only). The PEM file must contain both the certificate and private key.

func LoginDelegated 

func LoginDelegated(ctx context.Context, profile *config.Profile, ipv4Only bool) (azcore.AccessToken, error)

LoginDelegated performs device-code flow authentication

func ManagedChannelMessageProvenanceKey added in v0.3.0 

func ManagedChannelMessageProvenanceKey(target ManagedChannelMessageTarget) string

ManagedChannelMessageProvenanceKey returns the non-secret local lookup key for a BWS provenance record reference.

func ManagedDelegatedAvailable added in v0.3.0 

func ManagedDelegatedAvailable() bool

ManagedDelegatedAvailable reports whether this binary contains the pinned Linux/cgo Bitwarden SDK provider.

func MigrateLegacyAppOnlyTokens added in v0.3.0 

func MigrateLegacyAppOnlyTokens(profiles map[string]*config.Profile, selectedProfile string) (int, error)

MigrateLegacyAppOnlyTokens atomically rebinds every entry in the legacy encrypted-file store to its configured profile name. The selected profile must be one of those entries. Legacy stores use one global format version, so migrating only one entry would make every other entry unreadable.

func NewDelegatedCredentialSilent added in v0.2.0 

func NewDelegatedCredentialSilent(profile *config.Profile, authRecordJSON string, ipv4Only bool) (azcore.TokenCredential, error)

NewDelegatedCredentialSilent creates a DeviceCodeCredential backed by the persistent MSAL cache with a stored AuthenticationRecord. The UserPrompt returns an error so that if MSAL can't silently refresh (refresh token expired), it fails fast rather than printing a device code in an unattended context.

The authRecordJSON must be the JSON from a previous LoginDelegatedWithCache call.

func NewManagedDelegatedCredential added in v0.3.0 

func NewManagedDelegatedCredential(profile *config.Profile, ipv4Only bool) (azcore.TokenCredential, error)

func RecordManagedChannelMessageProvenance added in v0.3.0 

func RecordManagedChannelMessageProvenance(ctx context.Context, profile *config.Profile, target ManagedChannelMessageTarget) (string, error)

RecordManagedChannelMessageProvenance creates and verifies the BWS record that proves a managed delegated profile sent one root channel message.

func RefreshAppOnly 

func RefreshAppOnly(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)

RefreshAppOnly uses a stored client secret to get a fresh app-only token. Returns the new token and updates the cache in place. Caller must persist the cache.

func RefreshCertificate added in v0.2.0 

func RefreshCertificate(ctx context.Context, profile *config.Profile, cache *TokenCache, ipv4Only bool) (azcore.AccessToken, error)

RefreshCertificate uses a stored certificate path to get a fresh app-only token. Returns the new token. Caller must persist the cache.

func ResumeManagedDelegatedMigration added in v0.3.0 

func ResumeManagedDelegatedMigration(_ context.Context, profile *config.Profile) error

func ShouldUseIPv4 

func ShouldUseIPv4(cfg *config.Config) bool

ShouldUseIPv4 returns true if IPv4-only transport should be used. Checks CB365_IPV4_ONLY env var and config setting.

func StoreToken 

func StoreToken(profileName string, cache *TokenCache) error

StoreToken securely stores a token

func VerifyManagedChannelMessageProvenance added in v0.3.0 

func VerifyManagedChannelMessageProvenance(ctx context.Context, profile *config.Profile, secretID string, target ManagedChannelMessageTarget) error

VerifyManagedChannelMessageProvenance fails closed unless the immutable BWS record matches the exact profile, tenant, client, account, host, and target.

Types

type DelegatedLoginResult added in v0.2.0 

type DelegatedLoginResult struct {
	Token      azcore.AccessToken
	AuthRecord azidentity.AuthenticationRecord
}

DelegatedLoginResult holds the credential, token, and authentication record from an interactive delegated login. The AuthRecord must be persisted so that subsequent silent logins can look up the account in the MSAL cache.

func LoginDelegatedWithCache added in v0.2.0 

func LoginDelegatedWithCache(ctx context.Context, profile *config.Profile, ipv4Only bool, promptFn func(context.Context, azidentity.DeviceCodeMessage) error) (*DelegatedLoginResult, error)

LoginDelegatedWithCache performs a device-code login with the MSAL persistent cache. Returns the token AND the AuthenticationRecord, which MUST be stored for silent refresh.

type ManagedChannelMessageTarget added in v0.3.0 

type ManagedChannelMessageTarget struct {
	TeamID    string `json:"teamId"`
	ChannelID string `json:"channelId"`
	MessageID string `json:"messageId"`
}

ManagedChannelMessageTarget identifies one root Teams channel message. It intentionally contains identifiers only, never message content.

type ManagedDeviceCodePrompt added in v0.3.0 

type ManagedDeviceCodePrompt func(context.Context, azidentity.DeviceCodeMessage) error

ManagedDeviceCodePrompt renders the non-secret operator message returned by Entra during an explicitly requested interactive login.

type ManagedError added in v0.3.0 

type ManagedError struct {
	Class     ManagedErrorClass
	Operation string
	// contains filtered or unexported fields
}

ManagedError intentionally does not implement Unwrap. The cause is retained for in-process classification only so provider responses cannot leak through generic error formatting.

func (*ManagedError) Error added in v0.3.0 

func (e *ManagedError) Error() string

type ManagedErrorClass added in v0.3.0 

type ManagedErrorClass string

ManagedErrorClass is a stable, secret-free error category for managed delegated authentication. Callers may render the class and operation, but never an SDK or identity-provider response body. 

const (
	ManagedCacheUnavailable  ManagedErrorClass = "managed_cache_unavailable"
	ManagedCacheInvalid      ManagedErrorClass = "managed_cache_invalid"
	ReauthenticationRequired ManagedErrorClass = "reauthentication_required"
	ManagedCacheConflict     ManagedErrorClass = "managed_cache_conflict"
)

func ManagedErrorClassOf added in v0.3.0 

func ManagedErrorClassOf(err error) (ManagedErrorClass, bool)

ManagedErrorClassOf returns a stable class without exposing the underlying provider failure.

type ManagedLoginOptions added in v0.3.0 

type ManagedLoginOptions struct {
	OrganisationID string
	ProjectID      string
}

ManagedLoginOptions contains non-secret Bitwarden references. The machine access token is accepted only from the BWS_ACCESS_TOKEN runtime injection boundary and therefore cannot be supplied through this API or a CLI flag.

type ManagedLoginResult added in v0.3.0 

type ManagedLoginResult struct {
	Token    azcore.AccessToken
	Username string
	Metadata config.ManagedDelegatedMetadata
}

ManagedLoginResult contains the token only for immediate in-process use. Callers must persist Metadata, never Token.

func LoginManagedDelegated added in v0.3.0 

func LoginManagedDelegated(
	ctx context.Context,
	profile *config.Profile,
	options ManagedLoginOptions,
	ipv4Only bool,
	prompt ManagedDeviceCodePrompt,
) (*ManagedLoginResult, error)

func MigrateManagedDelegated added in v0.3.0 

func MigrateManagedDelegated(
	ctx context.Context,
	profile *config.Profile,
	options ManagedLoginOptions,
	ipv4Only bool,
	prompt ManagedDeviceCodePrompt,
) (*ManagedLoginResult, error)

type TokenCache 

type TokenCache struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token,omitempty"`
	ClientSecret string `json:"client_secret,omitempty"`
	CertPath     string `json:"cert_path,omitempty"`
	AuthRecord   string `json:"auth_record,omitempty"` // JSON-serialized azidentity.AuthenticationRecord for MSAL cache lookup
	ExpiresAt    string `json:"expires_at"`
	TokenType    string `json:"token_type"`
	Scope        string `json:"scope"`
}

TokenCache represents cached authentication data SECURITY: Never log or print this struct — it contains secrets

func LoadToken 

func LoadToken(profileName string) (*TokenCache, error)

LoadToken retrieves a token

type TokenInfo 

type TokenInfo struct {
	Subject   string   `json:"subject,omitempty"`
	UPN       string   `json:"upn,omitempty"`
	Name      string   `json:"name,omitempty"`
	TenantID  string   `json:"tenant_id,omitempty"`
	AppName   string   `json:"app_name,omitempty"`
	Scopes    []string `json:"scopes,omitempty"`
	ExpiresAt string   `json:"expires_at,omitempty"`
	IssuedAt  string   `json:"issued_at,omitempty"`
	ValidFor  string   `json:"valid_for,omitempty"`
	IsExpired bool     `json:"is_expired"`
}

TokenInfo represents decoded JWT claims for display SECURITY: This is for display only — never contains the raw token

func DecodeTokenInfo 

func DecodeTokenInfo(accessToken string) (*TokenInfo, error)

DecodeTokenInfo extracts display-safe info from a JWT access token SECURITY: Only extracts claims — does NOT validate the token signature

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.