cliauth

package
v1.36.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 17, 2026 License: MIT Imports: 18 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ClearBootstrapMetadata 

func ClearBootstrapMetadata() error

ClearBootstrapMetadata removes stored backend bootstrap metadata.

func ClearSession 

func ClearSession() error

ClearSession removes stored CLI session credentials.

func OpenBrowser 

func OpenBrowser(target string) error

OpenBrowser opens the system browser.

func SaveBootstrapMetadata 

func SaveBootstrapMetadata(meta BackendBootstrap, backendURL string) error

SaveBootstrapMetadata stores non-secret backend init metadata in ~/.orun/config.yaml. It also sets backend.url when backendURL is non-empty, so auth/cloud/run commands can find the default backend without extra flags.

func SaveConfig 

func SaveConfig(cfg *Config) error

SaveConfig writes ~/.orun/config.yaml.

func SaveSession 

func SaveSession(creds *Credentials) error

SaveSession stores session credentials and updates the default backend URL. 

func UpsertRepoLink(link RepoLink) error

UpsertRepoLink stores or updates a repo link in ~/.orun/config.yaml.

Types

type APIError 

type APIError struct {
	Code    string `json:"code"`
	Message string `json:"error"`
}

APIError is the backend auth error envelope.

func (*APIError) Error 

func (e *APIError) Error() string

type Account 

type Account struct {
	AccountID   string `json:"accountId"`
	GitHubLogin string `json:"githubLogin"`
	CreatedAt   string `json:"createdAt"`
}

Account is returned by GET /v1/accounts/me.

type BackendBootstrap 

type BackendBootstrap struct {
	// ManagedBy is always "orun-backend-init" to prevent accidental destroy of unrelated resources.
	ManagedBy        string `yaml:"managedBy,omitempty"`
	AccountID        string `yaml:"accountId,omitempty"`
	WorkerName       string `yaml:"workerName,omitempty"`
	D1DatabaseName   string `yaml:"d1DatabaseName,omitempty"`
	D1DatabaseUUID   string `yaml:"d1DatabaseUUID,omitempty"`
	R2BucketName     string `yaml:"r2BucketName,omitempty"`
	CatalogQueueName string `yaml:"catalogQueueName,omitempty"`
	CatalogQueueID   string `yaml:"catalogQueueID,omitempty"`
	CatalogDLQName   string `yaml:"catalogDLQName,omitempty"`
	CatalogDLQID     string `yaml:"catalogDLQID,omitempty"`
	CatalogCron      string `yaml:"catalogCron,omitempty"`
	BackendCommit    string `yaml:"backendCommit,omitempty"`
	InitAt           string `yaml:"initAt,omitempty"`
}

BackendBootstrap holds non-secret metadata written by `orun backend init`. Secrets (API tokens, session secrets, GitHub client secrets) are never stored here.

func LoadBootstrapMetadata 

func LoadBootstrapMetadata() (*BackendBootstrap, error)

LoadBootstrapMetadata returns the stored backend bootstrap metadata, or nil if none.

type BackendClient 

type BackendClient struct {
	// contains filtered or unexported fields
}

BackendClient talks to the Orun backend auth/account routes.

func NewBackendClient 

func NewBackendClient(baseURL, version string) *BackendClient

NewBackendClient returns an auth/account client for the backend.

func (*BackendClient) BrowserLoginURL 

func (c *BackendClient) BrowserLoginURL(returnTo string) string

BrowserLoginURL returns the CLI browser-login URL.

func (*BackendClient) GetAccount 

func (c *BackendClient) GetAccount(ctx context.Context, accessToken string) (*Account, error)

GetAccount returns the current backend account.

func (*BackendClient) LinkRepoFromSession 

func (c *BackendClient) LinkRepoFromSession(ctx context.Context, accessToken, repoFullName string) (*LinkRepoFromSessionResponse, error)

LinkRepoFromSession calls POST /v1/accounts/repos/link with a CLI session token. Returns an error if the response does not contain namespaceKind: "local" — this guards against older backend versions that may return canonical repo namespaces.

func (*BackendClient) ListLinkedRepos 

func (c *BackendClient) ListLinkedRepos(ctx context.Context, accessToken string) ([]LinkedRepo, error)

ListLinkedRepos returns repos linked to the current account.

func (*BackendClient) Logout 

func (c *BackendClient) Logout(ctx context.Context, refreshToken string) error

Logout revokes the refresh token.

func (*BackendClient) PollDeviceFlow 

func (c *BackendClient) PollDeviceFlow(ctx context.Context, deviceCode string) (*SessionResponse, *DevicePollPendingResponse, error)

PollDeviceFlow polls the backend device-flow endpoint.

func (*BackendClient) Refresh 

func (c *BackendClient) Refresh(ctx context.Context, refreshToken string) (*SessionResponse, error)

Refresh exchanges a refresh token for a new access token.

func (*BackendClient) StartDeviceFlow 

func (c *BackendClient) StartDeviceFlow(ctx context.Context) (*DeviceStartResponse, error)

StartDeviceFlow starts the backend-mediated GitHub device flow.

type BackendConfig 

type BackendConfig struct {
	URL string `yaml:"url,omitempty"`
}

BackendConfig holds the default backend URL.

type BrowserOpener 

type BrowserOpener func(string) error

BrowserOpener opens the system browser.

type Config 

type Config struct {
	Backend          BackendConfig     `yaml:"backend,omitempty"`
	BackendBootstrap *BackendBootstrap `yaml:"backendBootstrap,omitempty"`
	Repos            []RepoLink        `yaml:"repos,omitempty"`
}

Config is the non-secret CLI config stored in ~/.orun/config.yaml.

func LoadConfig 

func LoadConfig() (*Config, error)

LoadConfig reads ~/.orun/config.yaml.

type CredentialStore 

type CredentialStore interface {
	Load() (*Credentials, error)
	Save(*Credentials) error
	Clear() error
}

CredentialStore persists CLI session credentials.

func DefaultCredentialStore 

func DefaultCredentialStore() CredentialStore

DefaultCredentialStore returns the standard keychain-or-file credential store.

type Credentials 

type Credentials struct {
	AccessToken         string   `json:"accessToken,omitempty"`
	AccessTokenExpiry   string   `json:"accessTokenExpiry,omitempty"`
	RefreshToken        string   `json:"refreshToken,omitempty"`
	RefreshTokenExpiry  string   `json:"refreshTokenExpiry,omitempty"`
	GitHubLogin         string   `json:"githubLogin,omitempty"`
	AllowedNamespaceIDs []string `json:"allowedNamespaceIds,omitempty"`
	BackendURL          string   `json:"backendUrl,omitempty"`
}

Credentials are the locally stored Orun CLI session secrets.

func BrowserLogin 

func BrowserLogin(ctx context.Context, backendURL, version string, out io.Writer, openBrowser BrowserOpener) (*Credentials, error)

BrowserLogin performs the CLI loopback OAuth flow and stores the resulting session.

func DeviceLogin 

func DeviceLogin(ctx context.Context, backendURL, version string, out io.Writer) (*Credentials, error)

DeviceLogin performs the backend-mediated device flow and stores the session.

func LoadSession 

func LoadSession() (*Credentials, error)

LoadSession reads stored CLI session credentials.

func RefreshSession 

func RefreshSession(ctx context.Context, backendURL, version string, creds *Credentials) (*Credentials, error)

RefreshSession refreshes the local CLI session if needed.

func (*Credentials) AccessExpiryTime 

func (c *Credentials) AccessExpiryTime() time.Time

AccessExpiryTime parses the stored access-token expiry.

func (*Credentials) RefreshExpiryTime 

func (c *Credentials) RefreshExpiryTime() time.Time

RefreshExpiryTime parses the stored refresh-token expiry.

type DevicePollPendingResponse 

type DevicePollPendingResponse struct {
	Status   string `json:"status"`
	Interval int    `json:"interval"`
}

DevicePollPendingResponse is returned while device auth is pending.

type DeviceStartResponse 

type DeviceStartResponse struct {
	DeviceCode              string `json:"deviceCode"`
	UserCode                string `json:"userCode"`
	VerificationURI         string `json:"verificationUri"`
	VerificationURIComplete string `json:"verificationUriComplete"`
	ExpiresIn               int    `json:"expiresIn"`
	Interval                int    `json:"interval"`
}

DeviceStartResponse is returned by POST /v1/auth/cli/device/start.

type LinkRepoFromSessionResponse 

type LinkRepoFromSessionResponse struct {
	NamespaceKind string `json:"namespaceKind"`
	NamespaceID   string `json:"namespaceId"`
	NamespaceSlug string `json:"namespaceSlug"`
	RepoID        string `json:"repoId"`
	RepoFullName  string `json:"repoFullName"`
	LinkedAt      string `json:"linkedAt"`
}

LinkRepoFromSessionResponse is returned by POST /v1/accounts/repos/link. The backend always returns namespaceKind: "local" for CLI session links.

type LinkedRepo 

type LinkedRepo struct {
	NamespaceID   string `json:"namespaceId"`
	NamespaceSlug string `json:"namespaceSlug"`
	LinkedAt      string `json:"linkedAt"`
}

LinkedRepo is returned by GET /v1/accounts/repos. 

type RepoLink struct {
	BackendURL    string `yaml:"backendUrl,omitempty"`
	GitRemote     string `yaml:"gitRemote,omitempty"`
	RepoFullName  string `yaml:"repoFullName,omitempty"`
	NamespaceID   string `yaml:"namespaceId,omitempty"`
	NamespaceKind string `yaml:"namespaceKind,omitempty"`
	RepoID        string `yaml:"repoId,omitempty"`
	LinkedAt      string `yaml:"linkedAt,omitempty"`
}

RepoLink records the current repo-to-namespace mapping used for local session-authenticated remote-state runs. 

func FindRepoLink(backendURL, gitRemote, repoFullName string) (*RepoLink, error)

FindRepoLink returns a stored repo link for the backend/remote/repo tuple.

func FindRepoLinkByNamespaceID 

func FindRepoLinkByNamespaceID(backendURL, namespaceID string) (*RepoLink, error)

FindRepoLinkByNamespaceID returns a stored repo link matching backendURL and namespaceID. Used when we only know the namespace ID, not the slug or remote.

type SessionResponse 

type SessionResponse struct {
	AccessToken         string   `json:"accessToken"`
	ExpiresAt           string   `json:"expiresAt"`
	RefreshToken        string   `json:"refreshToken,omitempty"`
	RefreshExpiresAt    string   `json:"refreshExpiresAt,omitempty"`
	GitHubLogin         string   `json:"githubLogin"`
	AllowedNamespaceIDs []string `json:"allowedNamespaceIds"`
}

SessionResponse is returned by the CLI auth routes.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.