Documentation
¶
Overview ¶
Package auth implements the four headless OAuth grants Geiger supports. Each is exactly one POST to a module-declared token endpoint — the only auth POST Geiger makes by design — returning a bearer (and sometimes an instance URL).
Index ¶
- func BasicAuthExtra(clientID, clientSecret string) map[string]string
- func ClientCredentials(ctx context.Context, c *recon.Client, tokenURL, clientID, clientSecret string, ...) (module.Token, error)
- func Exchange(ctx context.Context, c *recon.Client, tokenURL string, form url.Values, ...) (module.Token, error)
- func JWTBearer(ctx context.Context, c *recon.Client, tokenURL, assertion string, ...) (module.Token, error)
- func Password(ctx context.Context, c *recon.Client, ...) (module.Token, error)
- func RefreshToken(ctx context.Context, c *recon.Client, ...) (module.Token, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BasicAuthExtra ¶
BasicAuthExtra returns a header map adding HTTP Basic auth, for token endpoints that require client auth in the header rather than the body (e.g. MongoDB Atlas SA, some OAuth servers).
func ClientCredentials ¶
func ClientCredentials(ctx context.Context, c *recon.Client, tokenURL, clientID, clientSecret string, extra url.Values) (module.Token, error)
ClientCredentials performs the client_credentials grant (Entra, Auth0, Okta-OAuth, Atlas SA, …). Pass scope/audience/resource as needed via extra.
func Exchange ¶
func Exchange(ctx context.Context, c *recon.Client, tokenURL string, form url.Values, hdrs map[string]string) (module.Token, error)
Exchange performs an arbitrary single token-endpoint POST (form body + extra headers, e.g. Basic client auth) and returns the resulting bearer. It backs the non-standard grants (Zoom account_credentials, …).
func JWTBearer ¶
func JWTBearer(ctx context.Context, c *recon.Client, tokenURL, assertion string, extra url.Values) (module.Token, error)
JWTBearer performs the urn:ietf:params:oauth:grant-type:jwt-bearer grant (GCP service accounts, Salesforce JWT, Snowflake key-pair). assertion is the pre-signed RS256 JWT.
func Password ¶
func Password(ctx context.Context, c *recon.Client, tokenURL, clientID, clientSecret, username, password string, extra url.Values) (module.Token, error)
Password performs the password grant (legacy ROPC, e.g. some Salesforce/Okta integrations). Included for completeness of the headless grant set.
Types ¶
This section is empty.
Source Files