oauth

Oct 26, 2026

Changes in this version

+ var ErrSigningKeyRequired = errors.New("oauth: a signing key (Config.PrivateKey) is required")

type Client

+ func (c *Client) DPoPBoundAccessTokens() bool

+ func (c *Client) GetRotatedHashes() [][]byte

type Config

+ AllowEphemeralKey bool

+ DPoP DPoPConfig

+ JWTAccessTokens bool

+ KeyID string

+ VerificationKeys []systemauth.VerificationKeyConfig

+ type DPoPConfig struct

+ ClockSkew time.Duration

+ Nonces *dpopproof.Nonces

+ ProofMaxAge time.Duration

+ ReplayCache dpopproof.ReplayCache

type OpenIDConfiguration

+ DPoPSigningAlgValuesSupported []string

type Option

+ func WithAcceptedClientIDs(clientIDs ...string) Option

+ func WithAnyClient() Option

+ func WithResourceBaseURL(baseURL string) Option

type Provider

+ func (p *Provider) KeyID() string

+ func (p *Provider) TokenEndpointURL() string

Oct 11, 2026

Changes in this version

+ type ConsentFunc func(ctx context.Context, userID string, client fosite.Client, scopes []string) (bool, error)

type Option

+ func WithConsent(consent ConsentFunc) Option

+ func WithLoginURL(loginURL string) Option

+ func WithTrustedUserIDHeader(header string, gate systemauth.RequestGate) Option

+ func WithUserAuthenticator(authenticate func(r *http.Request) string) Option

type Storage

+ func (s *Storage) ClientAssertionJWTValid(ctx context.Context, jti string) error

+ func (s *Storage) RotateRefreshToken(ctx context.Context, requestID string, refreshTokenSignature string) error

+ func (s *Storage) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) error

Sep 6, 2026

Changes in this version

+ func AccessRequestFromContext(ctx context.Context) fosite.AccessRequester

+ func HasScope(ctx context.Context, scope string) bool

+ func LoggerFromContext(ctx context.Context) *slog.Logger

+ func ScopesFromContext(ctx context.Context) []string

+ func UserIDFromContext(ctx context.Context) string

+ func WithAccessRequest(ctx context.Context, ar fosite.AccessRequester) context.Context

+ type API struct

+ func NewAPI(provider *Provider, opts ...Option) (*API, error)

+ func (a *API) Huma() huma.API

+ func (a *API) Logger() *slog.Logger

+ func (a *API) Middleware(next http.Handler) http.Handler

+ func (a *API) Provider() *Provider

+ func (a *API) Router() chi.Router

+ func (a *API) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ type AuthorizeInput struct

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ Nonce string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ type AuthorizeOutput struct

+ Location string

+ type Client struct

+ func (c *Client) GetAudience() fosite.Arguments

+ func (c *Client) GetGrantTypes() fosite.Arguments

+ func (c *Client) GetHashedSecret() []byte

+ func (c *Client) GetID() string

+ func (c *Client) GetRedirectURIs() []string

+ func (c *Client) GetResponseTypes() fosite.Arguments

+ func (c *Client) GetScopes() fosite.Arguments

+ func (c *Client) IsPublic() bool

+ func (c *Client) ValidateSecret(ctx context.Context, secret string) error

+ type Config struct

+ AccessTokenLifespan time.Duration

+ AuthCodeLifespan time.Duration

+ HashSecret []byte

+ Issuer string

+ PrivateKey *rsa.PrivateKey

+ RefreshTokenLifespan time.Duration

+ func DefaultConfig(issuer string, hashSecret []byte) *Config

+ type IntrospectInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type IntrospectOutput struct

+ Body IntrospectResponse

+ type IntrospectResponse struct

+ Active bool

+ Aud string

+ ClientID string

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ type JWK struct

+ Alg string

+ E string

+ Kid string

+ Kty string

+ N string

+ Use string

+ type JWKS struct

+ Keys []JWK

+ type JWKSOutput struct

+ Body JWKS

+ type OAuthError struct

+ Error string

+ ErrorDescription string

+ ErrorURI string

+ type OpenIDConfigOutput struct

+ Body OpenIDConfiguration

+ type OpenIDConfiguration struct

+ AuthorizationEndpoint string

+ CodeChallengeMethodsSupported []string

+ GrantTypesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JWKSURI string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ type Option func(*API)

+ func WithLogger(logger *slog.Logger) Option

+ type Provider struct

+ func NewProvider(db *ent.Client, cfg *Config) (*Provider, error)

+ func (p *Provider) OAuth2Provider() fosite.OAuth2Provider

+ func (p *Provider) Session(subject string) *openid.DefaultSession

+ func (p *Provider) Storage() *Storage

+ type RevokeInput struct

+ Authorization string

+ Token string

+ TokenTypeHint string

+ type RevokeOutput struct

+ type Storage struct

+ func NewStorage(db *ent.Client) *Storage

+ func (s *Storage) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *Storage) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) error

+ func (s *Storage) CreatePKCERequestSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *Storage) CreateRefreshTokenSession(ctx context.Context, signature string, request fosite.Requester) error

+ func (s *Storage) DeleteAccessTokenSession(ctx context.Context, signature string) error

+ func (s *Storage) DeletePKCERequestSession(ctx context.Context, signature string) error

+ func (s *Storage) DeleteRefreshTokenSession(ctx context.Context, signature string) error

+ func (s *Storage) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *Storage) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (fosite.Requester, error)

+ func (s *Storage) GetClient(ctx context.Context, clientID string) (fosite.Client, error)

+ func (s *Storage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *Storage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error)

+ func (s *Storage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error

+ func (s *Storage) RevokeAccessToken(ctx context.Context, requestID string) error

+ func (s *Storage) RevokeRefreshToken(ctx context.Context, requestID string) error

+ type TokenInput struct

+ Authorization string

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ GrantType string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ type TokenOutput struct

+ Body TokenResponse

+ type TokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string