Documentation
¶
Overview ¶
Package auth handles OIDC authentication for the CLI.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LockTokenCache ¶
LockTokenCache takes an exclusive OS-level file lock on a sidecar lock file for the given OIDC config. Returns an unlock function that the caller MUST invoke (e.g. via defer) — typically wrapping load → expiry-check → refresh → save so that concurrent `railgrid get-token` invocations don't race on the refresh-token rotation. On platforms where advisory locking isn't supported the returned unlock is a no-op.
func RemoveTokenCache ¶
RemoveTokenCache deletes the cached tokens for the given OIDC config. It reports whether a cache file existed.
func SaveTokenCache ¶
func SaveTokenCache(cache *TokenCache) error
SaveTokenCache writes the token cache to disk atomically (tmp file + rename). Atomicity matters because a partial write that survives can leave the cache holding a refresh token that the IdP has already rotated, permanently bricking the cache until the next interactive login.
Types ¶
type LocalhostCallbackAuthenticator ¶
type LocalhostCallbackAuthenticator struct {
// contains filtered or unexported fields
}
LocalhostCallbackAuthenticator starts a local HTTP server on a random port and waits for the hub to redirect back with the login response.
func NewLocalhostCallbackAuthenticator ¶
func NewLocalhostCallbackAuthenticator() *LocalhostCallbackAuthenticator
NewLocalhostCallbackAuthenticator creates a new authenticator.
func (*LocalhostCallbackAuthenticator) Endpoint ¶
func (a *LocalhostCallbackAuthenticator) Endpoint() string
Endpoint returns the full callback URL.
func (*LocalhostCallbackAuthenticator) Port ¶
func (a *LocalhostCallbackAuthenticator) Port() int
Port returns the port the server is listening on.
func (*LocalhostCallbackAuthenticator) Start ¶
func (a *LocalhostCallbackAuthenticator) Start() error
Start begins listening on a random available port.
func (*LocalhostCallbackAuthenticator) WaitForResponse ¶
func (a *LocalhostCallbackAuthenticator) WaitForResponse(ctx context.Context) (tenancyv1alpha1.LoginResponse, error)
WaitForResponse blocks until the callback is received or the context is cancelled.
type TokenCache ¶
type TokenCache struct {
IDToken string `json:"idToken"`
RefreshToken string `json:"refreshToken"`
ExpiresAt int64 `json:"expiresAt"` // Unix timestamp
IssuerURL string `json:"issuerUrl"`
ClientID string `json:"clientId"`
}
TokenCache stores OIDC tokens for the exec credential plugin. ClientSecret is intentionally absent: railgrid uses PKCE (public client) so token refresh requires only the refresh token, issuer URL, and client ID.
func LoadTokenCache ¶
func LoadTokenCache(issuerURL, clientID string) (*TokenCache, error)
LoadTokenCache reads the cached token for the given OIDC config.
func (*TokenCache) IsExpired ¶
func (t *TokenCache) IsExpired() bool
IsExpired returns true if the cached token has expired (with 30s buffer).
Source Files