auth

type Credential ¶

type Credential struct {
	OAuth     map[string]string `json:"oauth,omitempty"`
	Type      CredentialType    `json:"type"`
	Key       string            `json:"key,omitempty"`
	Access    string            `json:"access,omitempty"`
	Refresh   string            `json:"refresh,omitempty"`
	AccountID string            `json:"account_id,omitempty"`
	Expires   int64             `json:"expires,omitempty"`
	ExpiresAt int64             `json:"expires_at,omitempty"`
}

Credential stores API-key or OAuth credentials.

Key may either be the literal API key or the name of an environment variable containing the key. OAuth token fields are kept in flat and map shapes for provider-specific OAuth flows.

func LoginAnthropic(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)

func LoginAnthropicWithCode(ctx context.Context, authCode string) (*Credential, error)

func LoginOpenAICodex(ctx context.Context, onAuth func(OAuthAuthInfo)) (credential *Credential, err error)

type CredentialType ¶

type CredentialType string

CredentialType identifies the stored credential kind.

const (
	// CredentialTypeAPIKey stores a provider API key.
	CredentialTypeAPIKey CredentialType = "api_key"
	// CredentialTypeOAuth stores OAuth token material.
	CredentialTypeOAuth CredentialType = "oauth"
)

type FileBackend ¶

type FileBackend struct {
	// contains filtered or unexported fields
}

FileBackend stores credentials in auth.json with process-local locking and atomic writes.

func NewFileBackend(path string) *FileBackend

func (backend *FileBackend) WithLock(ctx context.Context, callback func(current []byte) (LockResult, error)) error

type LockResult ¶

type LockResult struct {
	Next  []byte
	Write bool
}

LockResult tells a backend whether to persist a new auth.json payload.

type Locker ¶

type Locker interface {
	WithLock(ctx context.Context, callback func(current []byte) (LockResult, error)) error
}

Locker serializes access to credential bytes.

type OAuthAuthInfo ¶

type OAuthAuthInfo struct {
	URL          string `json:"url"`
	Instructions string `json:"instructions,omitempty"`
}

OAuthAuthInfo describes a browser OAuth step.

type Source ¶

type Source string

Source describes where a provider credential is configured.

const (
	// SourceStored comes from auth.json.
	SourceStored Source = "stored"
	// SourceRuntime comes from a process-only override.
	SourceRuntime Source = "runtime"
	// SourceEnvironment comes from an environment variable.
	SourceEnvironment Source = "environment"
	// SourceFallback comes from a caller-supplied resolver.
	SourceFallback Source = "fallback"
)

type Status ¶

type Status struct {
	Source     Source `json:"source,omitempty"`
	Label      string `json:"label,omitempty"`
	Configured bool   `json:"configured"`
}

Status reports whether auth exists without revealing secrets.

type Storage ¶

type Storage struct {
	// contains filtered or unexported fields
}

Storage provides librecode-style credential lookup with stored, runtime, env, and fallback sources.

Locking contract: lock protects credentials, runtimeOverrides, errors, loadError, and fallbackResolver. Do not call fallbackResolver or OAuth refreshers while holding lock; take an authSnapshot first and operate on the copied values.

func NewStorage(ctx context.Context, backend Locker) (*Storage, error)

func (storage *Storage) APIKey(provider string) (string, bool)

func (storage *Storage) APIKeyContext(ctx context.Context, provider string) (apiKey string, found bool, err error)

func (storage *Storage) AuthStatus(provider string) Status

func (storage *Storage) DrainErrors() []error

func (storage *Storage) Get(provider string) (Credential, bool)

func (storage *Storage) HasAuth(provider string) bool

func (storage *Storage) HasStored(provider string) bool

func (storage *Storage) List() []string

func (storage *Storage) Reload(ctx context.Context) error

func (storage *Storage) Remove(ctx context.Context, provider string) error

func (storage *Storage) RemoveRuntimeAPIKey(provider string)

func (storage *Storage) Set(ctx context.Context, provider string, credential *Credential) error

func (storage *Storage) SetFallbackResolver(resolver func(provider string) (string, bool))

func (storage *Storage) SetRuntimeAPIKey(provider, apiKey string)