Documentation
¶
Index ¶
- Constants
- func IsLoggedIn() bool
- func IsTokenExpired(token string) bool
- func ListenForAuthCode(expectedState string, timeout time.Duration) (string, error)
- func RefreshToken() (string, error)
- func RequireLogin() func(cmd *cobra.Command, args []string) error
- type AuthResult
- type ClientCredentialsAuth
- type OIDCConfig
- type PKCEAuth
- type PKCETokenResponse
- type TokenResponse
Constants ¶
const ( // CallbackPath is the path for the OAuth callback CallbackPath = "/auth-callback" // CallbackPort is the fixed port for the OAuth callback server CallbackPort = 55152 // AuthTimeout is the timeout for waiting for authentication callback AuthTimeout = 5 * time.Minute )
Variables ¶
This section is empty.
Functions ¶
func IsLoggedIn ¶ added in v1.1.0
func IsLoggedIn() bool
IsLoggedIn reports whether the current user has a valid, non-expired token. It returns true when security is disabled on the control plane.
func IsTokenExpired ¶
IsTokenExpired checks if the JWT token is expired or will expire soon (within 1 minute)
func ListenForAuthCode ¶
ListenForAuthCode starts a local HTTP server on the fixed callback port and waits for the auth callback
func RefreshToken ¶
RefreshToken refreshes the access token using the appropriate auth method Returns the new token and an error if refresh fails
Types ¶
type AuthResult ¶
AuthResult holds the result of the authentication callback
type ClientCredentialsAuth ¶
type ClientCredentialsAuth struct {
TokenEndpoint string
ClientID string
ClientSecret string
// Scope is an optional OAuth2 scope to request in the token request.
Scope string
}
ClientCredentialsAuth handles client credentials authentication
func (*ClientCredentialsAuth) GetToken ¶
func (c *ClientCredentialsAuth) GetToken() (*TokenResponse, error)
GetToken exchanges client credentials for an access token
type OIDCConfig ¶
type OIDCConfig struct {
AuthorizationEndpoint string `json:"authorization_endpoint"`
TokenEndpoint string `json:"token_endpoint"`
ClientID string `json:"client_id"`
Scopes []string `json:"scopes"`
SecurityEnabled bool `json:"security_enabled"`
Issuer string `json:"issuer,omitempty"`
JwksURI string `json:"jwks_uri,omitempty"`
}
OIDCConfig represents the client configuration response for CLI
func FetchOIDCConfig ¶
func FetchOIDCConfig(apiURL string) (*OIDCConfig, error)
FetchOIDCConfig fetches CLI client configuration using a two-step discovery process:
- Calls /.well-known/oauth-protected-resource on the OpenChoreo API to discover the authorization server URL and OpenChoreo-specific client configurations.
- Calls the authorization server's /.well-known/openid-configuration to discover the authorization and token endpoints (standard OIDC discovery per RFC 8414).
type PKCEAuth ¶
type PKCEAuth struct {
AuthorizationEndpoint string
TokenEndpoint string
ClientID string
RedirectURI string
CodeVerifier string
CodeChallenge string
State string
Scopes []string
}
PKCEAuth handles PKCE authorization code flow
func NewPKCEAuth ¶
func NewPKCEAuth(oidcConfig *OIDCConfig, redirectURI string) (*PKCEAuth, error)
NewPKCEAuth creates a new PKCE auth handler using the OIDC config
func (*PKCEAuth) ExchangeAuthCode ¶
func (p *PKCEAuth) ExchangeAuthCode(authCode string) (*PKCETokenResponse, error)
ExchangeAuthCode exchanges the authorization code for tokens
func (*PKCEAuth) GeneratePKCE ¶
GeneratePKCE generates a new PKCE code verifier, challenge, and state
func (*PKCEAuth) GetAuthorizationURL ¶
GetAuthorizationURL builds the authorization URL with PKCE parameters
type PKCETokenResponse ¶
type PKCETokenResponse struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
TokenType string `json:"token_type"`
ExpiresIn int `json:"expires_in"`
Scope string `json:"scope,omitempty"`
}
PKCETokenResponse represents the OAuth2 token response for PKCE flow
func RefreshAccessToken ¶
func RefreshAccessToken(tokenEndpoint, clientID, refreshToken string) (*PKCETokenResponse, error)
RefreshAccessToken refreshes the access token using a refresh token
Source Files