Documentation
¶
Overview ¶
Package auth owns authentication for the CLI: the OAuth-style device flow against positronick.com, the on-disk credential cache, and the api.CredentialsProvider every command authenticates through.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Save ¶
func Save(dir string, creds *Credentials) error
Save writes the credential cache atomically (temp file + rename) with owner-only permissions, creating the config dir (0700) if needed.
Types ¶
type Credentials ¶
type Credentials struct {
Version int `json:"version"`
BaseURL string `json:"baseUrl"`
AccessToken string `json:"accessToken"`
TokenType string `json:"tokenType"`
ExpiresAt string `json:"expiresAt"`
User StoredUser `json:"user"`
CreatedAt string `json:"createdAt"`
}
Credentials is the on-disk shape of <config dir>/credentials.json. BaseURL keys the cache: a token is only ever presented to the host that issued it. ExpiresAt is informational — the session lifetime slides server-side, so the server stays the authority and a 401 (not the clock) triggers re-login.
func Load ¶
func Load(dir, baseURL string) (*Credentials, error)
Load reads the credential cache. It returns (nil, nil) when no credentials exist or when the cached baseUrl differs from baseURL — a token must never be sent to a host other than the one that issued it. A file readable by group/other is repaired to 0600 with a one-line warning: it holds a live session token. A malformed file is an error (fix: positronick logout).
type DeviceAuth ¶
type DeviceAuth struct {
DeviceCode string
UserCode string
VerificationURI string
VerificationURIComplete string
ExpiresIn time.Duration
Interval time.Duration
}
DeviceAuth is a started device authorization: the code the user types, the URLs to type it at, and the polling parameters.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is the CLI's api.CredentialsProvider. Precedence per request: POSITRONICK_API_KEY from the environment (sent as x-api-key, never persisted) wins; otherwise the cached bearer for the resolved base URL; otherwise anonymous. Both sources are read at call time, so a key exported or a login completed mid-process is picked up.
func NewProvider ¶
NewProvider returns a Provider reading the credential cache in dir, keyed to baseURL.
type StoredUser ¶
type StoredUser struct {
ID string `json:"id"`
Name string `json:"name"`
Email string `json:"email"`
IsAdmin bool `json:"isAdmin"`
}
StoredUser is the cached identity from /api/me. IsAdmin is server-computed and cached so a later PR can reveal admin commands without a network call.
type Token ¶
Token is a granted access token. It is a server session token with a sliding ~7-day lifetime and no refresh token: when it later expires (401), the fix is to log in again.
func Poll ¶
func Poll(ctx context.Context, baseURL, deviceCode string, interval, expiresIn time.Duration, onWait func()) (*Token, error)
Poll polls POST {base}/api/auth/device/token every interval until the user approves (returning the token), denies (exit 2), or the code expires (exit 4) — with a hard local deadline at expiresIn even if the server keeps answering pending. A slow_down response grows the interval by 5s. onWait, if non-nil, is called before each wait so callers can show progress.
type TokenCredentials ¶
type TokenCredentials struct {
Token string
}
TokenCredentials is an api.CredentialsProvider pinned to one bearer token. It is used where the session token must be presented even when an env API key exists — e.g. minting API keys, which the server restricts to sessions.
func (TokenCredentials) Get ¶
func (t TokenCredentials) Get() (api.Credentials, error)
Get implements api.CredentialsProvider.
Source Files