Documentation
¶
Overview ¶
Package oauthlogin provides an opt-in, host-side OAuth loopback login runtime.
Index ¶
Constants ¶
const ( // ExactRedirectURL is the fixed callback URI used by remote mecatui login. // It is deliberately IPv4-literal and must not be changed to localhost or // a wildcard address. ExactRedirectURL = "http://127.0.0.1:18473/oauth/callback" // ToolHiveCompatibleRedirectURL is the fixed callback URI used by native // LLM login so an existing ToolHive-compatible client registration works. ToolHiveCompatibleRedirectURL = "http://localhost:8666/callback" )
Variables ¶
var ( // ErrAuthorizationFailed reports a redacted failure of the authorization interaction. ErrAuthorizationFailed = errors.New("OAuth authorization failed") // ErrCallbackAttempts reports exhaustion of the callback request budget. ErrCallbackAttempts = errors.New("OAuth callback request limit exceeded") )
var ErrBrowserLaunch = errors.New("could not open browser")
ErrBrowserLaunch indicates that the fixed host browser launcher could not start.
Functions ¶
This section is empty.
Types ¶
type AuthorizationErrorResponse ¶ added in v0.0.22
AuthorizationErrorResponse carries the provider's OAuth error response from the callback. Both fields are surfaced: an authorization that fails at the provider is otherwise undiagnosable without reproducing the request by hand, and the operator owns the authorization server being quoted. They are sanitized, not withheld -- RFC 6749 section 4.1.2.1 restricts these values to a printable subset, so anything outside it is dropped rather than echoed, and each field is clamped. That defeats log injection and unbounded output without hiding the one thing the operator needs.
func (*AuthorizationErrorResponse) Error ¶ added in v0.0.22
func (e *AuthorizationErrorResponse) Error() string
func (*AuthorizationErrorResponse) Is ¶ added in v0.0.22
func (*AuthorizationErrorResponse) Is(target error) bool
Is reports the sentinel this error stands in for.
func (*AuthorizationErrorResponse) Sanitized ¶ added in v0.0.22
func (e *AuthorizationErrorResponse) Sanitized() *AuthorizationErrorResponse
Sanitized returns a bounded copy safe for crossing diagnostic boundaries.
type AuthorizeFunc ¶
type AuthorizeFunc func(ctx context.Context, redirectURL string, present func(context.Context, string) (Result, error)) error
AuthorizeFunc performs the controller-owned OAuth operation. It may call present once.
type BrowserLauncher ¶
BrowserLauncher opens an authorization URL according to host policy.
type CallbackBindError ¶ added in v0.0.22
type CallbackBindError struct{ Reason CallbackBindReason }
CallbackBindError reports a callback listener bind failure without retaining the operating-system error, address, or other nested network data.
func (*CallbackBindError) Error ¶ added in v0.0.22
func (e *CallbackBindError) Error() string
func (*CallbackBindError) Is ¶ added in v0.0.22
func (*CallbackBindError) Is(target error) bool
Is keeps callback bind failures in the authorization-failure category.
type CallbackBindReason ¶ added in v0.0.22
type CallbackBindReason uint8
CallbackBindReason is the closed, safe reason a callback listener could not bind.
const ( CallbackBindUnavailable CallbackBindReason = iota // CallbackBindAddressInUse reports that another process owns the callback address. CallbackBindAddressInUse )
type CallbackRejectedError ¶ added in v0.0.22
type CallbackRejectedError struct{ Reason string }
CallbackRejectedError names the rule that rejected an authenticated callback. It satisfies errors.Is(err, ErrAuthorizationFailed) so existing callers that test for that sentinel keep working.
func (*CallbackRejectedError) Error ¶ added in v0.0.22
func (e *CallbackRejectedError) Error() string
func (*CallbackRejectedError) Is ¶ added in v0.0.22
func (*CallbackRejectedError) Is(target error) bool
Is reports the sentinel this error stands in for.
func (*CallbackRejectedError) Sanitized ¶ added in v0.0.22
func (e *CallbackRejectedError) Sanitized() *CallbackRejectedError
Sanitized returns a copy containing only a callback validator's closed reason.
type Options ¶
type Options struct {
NoBrowser bool
URLWriter io.Writer
Launcher BrowserLauncher
// RedirectURL enables an explicitly configured callback. Only the package's
// fixed redirect constants are accepted; empty preserves the random-path,
// ephemeral-port behavior used by existing callers.
RedirectURL string
}
Options configures a Runtime.
type Runtime ¶
type Runtime struct {
// contains filtered or unexported fields
}
Runtime serializes complete loopback authorization interactions.
func (*Runtime) Authorize ¶
func (r *Runtime) Authorize(ctx context.Context, expectedIssuer string, authorize AuthorizeFunc) error
Authorize runs one loopback authorization interaction. Calls on the same Runtime are serialized.
func (*Runtime) AuthorizeWithCallbackPath ¶ added in v0.0.37
func (r *Runtime) AuthorizeWithCallbackPath(ctx context.Context, expectedIssuer, callbackPath string, authorize AuthorizeFunc) error
AuthorizeWithCallbackPath runs one loopback authorization interaction using a registration-bound random callback path and a fresh ephemeral IPv4 port.
Source Files