oidcclient

package

v0.0.38 Latest Latest Go to latest Published: Sep 15, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/stacklok/mecatl

Links

Open Source Insights

Documentation ¶

Overview ¶

Package oidcclient contains target-independent host-side OIDC public-client mechanics.

Index ¶

Variables
func Revoke(ctx context.Context, cfg Config, token, hint string) error
func ValidateAccessToken(ctx context.Context, cfg Config, token string) error
type Config
type Keyring
- func NewKeyring(root string) (*Keyring, error)
- func (k *Keyring) Key(ctx context.Context, create bool) ([]byte, error)
type Token
- func AuthorizationCode(ctx context.Context, cfg Config) (Token, error)
- func Refresh(ctx context.Context, cfg Config, refreshToken string) (Token, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrDiscovery reports rejected or unavailable exact-issuer metadata.
	ErrDiscovery = errors.New("oidcclient: discovery rejected")
	// ErrAuthorization reports a rejected browser callback or invalid client configuration.
	ErrAuthorization = errors.New("oidcclient: authorization rejected")
	// ErrToken reports an exchange or access-token profile rejection.
	ErrToken = errors.New("oidcclient: token rejected")
	// ErrStorage reports unavailable or corrupt protected local key material.
	ErrStorage = errors.New("oidcclient: protected storage unavailable")
)

Functions ¶

func Revoke ¶

func Revoke(ctx context.Context, cfg Config, token, hint string) error

Revoke makes one RFC 7009 request. It never includes provider response text in its returned error.

func ValidateAccessToken ¶

func ValidateAccessToken(ctx context.Context, cfg Config, token string) error

ValidateAccessToken validates a refreshed access token against exact-issuer metadata. Callers that durably retain refresh-token rotation must invoke this only after committing the exchange result.

Types ¶

type Config ¶

type Config struct {
	Issuer, ClientID, Audience, RedirectURI string
	Scopes                                  []string
	HTTPClient                              *http.Client
	Present                                 func(context.Context, string) (oauthlogin.Result, error)
	ValidateAccessToken                     func(context.Context, string) error
}

Config describes one exact-issuer public-client authorization-code exchange.

type Keyring ¶

type Keyring struct {
	// contains filtered or unexported fields
}

Keyring supplies one credential-root-bound encryption key from the OS keyring.

func NewKeyring ¶

func NewKeyring(root string) (*Keyring, error)

NewKeyring binds OS-keyring access to one explicit owner-only credential root.

func (*Keyring) Key ¶

func (k *Keyring) Key(ctx context.Context, create bool) ([]byte, error)

Key retrieves the root-bound key. create permits first creation but never a fallback backend.

type Token ¶

type Token struct {
	AccessToken, RefreshToken, TokenType string
	Expiry                               time.Time
}

Token is the transient result of an authorization-code or refresh exchange.

func AuthorizationCode ¶

func AuthorizationCode(ctx context.Context, cfg Config) (Token, error)

AuthorizationCode performs exact-issuer discovery and one PKCE-S256 exchange.

func Refresh ¶

func Refresh(ctx context.Context, cfg Config, refreshToken string) (Token, error)

Refresh exchanges one retained refresh token through exact-issuer discovery. Provider-controlled detail is collapsed; invalid_grant alone remains a body-free structured RetrieveError so exact-version cleanup can recognize it.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL