Documentation
¶
Index ¶
- func DefaultCredentialsPath(profileName string) (string, error)
- func DiscoverEndpoints(ctx context.Context, httpClient *http.Client, issuer string) (authURL, tokenURL string, err error)
- func NewState() (string, error)
- func SaveToken(path string, token *Token) error
- type LoginOptions
- type PKCE
- type Token
- func EnsureFreshToken(ctx context.Context, path string, httpClient *http.Client) (*Token, error)
- func LoadToken(path string) (*Token, error)
- func Login(ctx context.Context, opts LoginOptions) (*Token, error)
- func RefreshToken(ctx context.Context, httpClient *http.Client, token *Token) (*Token, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultCredentialsPath ¶
DefaultCredentialsPath returns the default location for cached CLI credentials for the given profile name. Each non-default profile gets its own file - they're logins against different identity providers/clients, so caching them together would let switching profiles silently pick up the wrong token. The default profile keeps the original, un-suffixed path for backward compatibility with credentials cached before profiles existed.
func DiscoverEndpoints ¶
func DiscoverEndpoints(ctx context.Context, httpClient *http.Client, issuer string) (authURL, tokenURL string, err error)
DiscoverEndpoints fetches the OIDC discovery document at issuer + "/.well-known/openid-configuration" and returns its authorization and token endpoints. This lets callers configure just an issuer/base URL, as most standards-compliant identity providers support discovery, instead of every individual endpoint.
Types ¶
type LoginOptions ¶
type LoginOptions struct {
AuthURL string
TokenURL string
ClientID string
Scopes string
ExtraParams map[string]string // IDP-specific extras, e.g. "resource" or "audience"
HTTPClient *http.Client
OpenBrowser bool
Timeout time.Duration
// CallbackPort pins the local redirect listener to a specific loopback
// port, for identity providers (like ThunderID today) whose redirectUris
// allow-list requires an exact match rather than a wildcard/any port. 0
// means let the OS assign a free ephemeral port (the RFC 8252-preferred
// default, used whenever the IDP supports it).
CallbackPort int
}
LoginOptions configures a browser-based OAuth2 Authorization Code + PKCE login.
type PKCE ¶
PKCE holds an OAuth2 PKCE (RFC 7636) verifier/challenge pair using the S256 challenge method.
type Token ¶
type Token struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
TokenType string `json:"token_type"`
ExpiresAt time.Time `json:"expires_at"`
TokenURL string `json:"token_url"`
ClientID string `json:"client_id"`
// ExtraParams remembers IDP-specific query params required at login (e.g.
// ThunderID's resource=... audience binding) so a later refresh reuses
// them automatically instead of silently dropping them.
ExtraParams map[string]string `json:"extra_params,omitempty"`
}
Token represents a cached OAuth2 token set, along with the token endpoint and client ID needed to refresh it later without the caller re-specifying flags.
func EnsureFreshToken ¶
EnsureFreshToken loads the cached token from path and, if it has expired, refreshes it and persists the refreshed token back to the same path.
func Login ¶
func Login(ctx context.Context, opts LoginOptions) (*Token, error)
Login runs a browser-based OAuth2 Authorization Code + PKCE flow and returns the resulting token. Per RFC 8252 (OAuth for native apps), it starts a short-lived local HTTP server on a loopback, OS-assigned port to receive the redirect, opens the system browser to the authorization URL, waits for the callback, then exchanges the code for a token.
func RefreshToken ¶
RefreshToken exchanges a refresh token for a new access token, using the token endpoint and client ID recorded on the token itself.
Source Files