Documentation
¶
Overview ¶
Package oauthlogin provides an opt-in, host-side OAuth loopback login runtime.
Index ¶
Constants ¶
const ( // ExactRedirectURL is the fixed callback URI used by clients that have a // pre-registered redirect. It is deliberately IPv4-literal and must not be // changed to localhost or a wildcard address. ExactRedirectURL = "http://127.0.0.1:18473/oauth/callback" )
Variables ¶
var ( // ErrAuthorizationFailed reports a redacted failure of the authorization interaction. ErrAuthorizationFailed = errors.New("OAuth authorization failed") // ErrCallbackAttempts reports exhaustion of the callback request budget. ErrCallbackAttempts = errors.New("OAuth callback request limit exceeded") )
var ErrBrowserLaunch = errors.New("could not open browser")
ErrBrowserLaunch indicates that the fixed host browser launcher could not start.
Functions ¶
This section is empty.
Types ¶
type AuthorizationErrorResponse ¶ added in v0.0.22
AuthorizationErrorResponse carries the provider's OAuth error response from the callback. Both fields are surfaced: an authorization that fails at the provider is otherwise undiagnosable without reproducing the request by hand, and the operator owns the authorization server being quoted. They are sanitized, not withheld -- RFC 6749 section 4.1.2.1 restricts these values to a printable subset, so anything outside it is dropped rather than echoed, and each field is clamped. That defeats log injection and unbounded output without hiding the one thing the operator needs.
func (*AuthorizationErrorResponse) Error ¶ added in v0.0.22
func (e *AuthorizationErrorResponse) Error() string
func (*AuthorizationErrorResponse) Is ¶ added in v0.0.22
func (*AuthorizationErrorResponse) Is(target error) bool
Is reports the sentinel this error stands in for.
func (*AuthorizationErrorResponse) Sanitized ¶ added in v0.0.22
func (e *AuthorizationErrorResponse) Sanitized() *AuthorizationErrorResponse
Sanitized returns a bounded copy safe for crossing diagnostic boundaries.
type AuthorizeFunc ¶
type AuthorizeFunc func(ctx context.Context, redirectURL string, present func(context.Context, string) (Result, error)) error
AuthorizeFunc performs the controller-owned OAuth operation. It may call present once.
type BrowserLauncher ¶
BrowserLauncher opens an authorization URL according to host policy.
type CallbackBindError ¶ added in v0.0.22
type CallbackBindError struct{ Reason CallbackBindReason }
CallbackBindError reports a callback listener bind failure without retaining the operating-system error, address, or other nested network data.
func (*CallbackBindError) Error ¶ added in v0.0.22
func (e *CallbackBindError) Error() string
func (*CallbackBindError) Is ¶ added in v0.0.22
func (*CallbackBindError) Is(target error) bool
Is keeps callback bind failures in the authorization-failure category.
type CallbackBindReason ¶ added in v0.0.22
type CallbackBindReason uint8
CallbackBindReason is the closed, safe reason a callback listener could not bind.
const ( CallbackBindUnavailable CallbackBindReason = iota // CallbackBindAddressInUse reports that another process owns the callback address. CallbackBindAddressInUse )
type CallbackRejectedError ¶ added in v0.0.22
type CallbackRejectedError struct{ Reason string }
CallbackRejectedError names the rule that rejected an authenticated callback. It satisfies errors.Is(err, ErrAuthorizationFailed) so existing callers that test for that sentinel keep working.
func (*CallbackRejectedError) Error ¶ added in v0.0.22
func (e *CallbackRejectedError) Error() string
func (*CallbackRejectedError) Is ¶ added in v0.0.22
func (*CallbackRejectedError) Is(target error) bool
Is reports the sentinel this error stands in for.
func (*CallbackRejectedError) Sanitized ¶ added in v0.0.22
func (e *CallbackRejectedError) Sanitized() *CallbackRejectedError
Sanitized returns a copy containing only a callback validator's closed reason.
type Options ¶
type Options struct {
NoBrowser bool
URLWriter io.Writer
Launcher BrowserLauncher
// RedirectURL enables an explicitly configured callback. The only accepted
// value is ExactRedirectURL; empty preserves the random-path, ephemeral-port
// behavior used by existing callers.
RedirectURL string
}
Options configures a Runtime.
Source Files