oauthserver

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: MIT Imports: 26 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	GrantTypeAuthorizationCode = "authorization_code"
	GrantTypeRefreshToken      = "refresh_token"
)

OAuth 2.1 Grant Types

Variables

This section is empty.

Functions

func DetermineClientType 

func DetermineClientType(explicitClientType, authMethod string) string

DetermineClientType determines the final client type using the priority: 1. Explicit client_type 2. Inferred from token_endpoint_auth_method 3. Default to confidential

func GetAllValidAuthMethods 

func GetAllValidAuthMethods() []string

GetAllValidAuthMethods returns all supported authentication methods

func GetValidAuthMethodsForClientType 

func GetValidAuthMethodsForClientType(clientType string) []string

GetValidAuthMethodsForClientType returns the valid authentication methods for a client type

func InferClientTypeFromAuthMethod 

func InferClientTypeFromAuthMethod(authMethod string) string

InferClientTypeFromAuthMethod infers client type from token_endpoint_auth_method

func IsValidAuthMethodForClientType 

func IsValidAuthMethodForClientType(clientType, authMethod string) bool

IsValidAuthMethodForClientType checks if the auth method is valid for the given client type

func ValidateClientAuthMethod 

func ValidateClientAuthMethod(client *models.OAuthServerClient, usedMethod string) error

ValidateClientAuthMethod validates the authentication method used matches the registered method

func ValidateClientAuthentication 

func ValidateClientAuthentication(client *models.OAuthServerClient, providedSecret string) error

ValidateClientAuthentication validates client authentication based on client type

func ValidateClientSecret 

func ValidateClientSecret(providedSecret, storedHash string) bool

ValidateClientSecret validates a client secret against its hash using constant-time comparison

func ValidateClientTypeConsistency 

func ValidateClientTypeConsistency(clientType, authMethod string) error

ValidateClientTypeConsistency validates consistency between client_type and token_endpoint_auth_method

Types

type AuthorizationDetailsResponse 

type AuthorizationDetailsResponse struct {
	AuthorizationID string                `json:"authorization_id"`
	RedirectURI     string                `json:"redirect_uri,omitempty"`
	Client          ClientDetailsResponse `json:"client,omitempty"`
	User            UserDetailsResponse   `json:"user,omitempty"`
	Scope           string                `json:"scope,omitempty"`
}

AuthorizationDetailsResponse represents the response for getting authorization details

type AuthorizeParams 

type AuthorizeParams struct {
	ClientID     string `json:"client_id"`
	RedirectURI  string `json:"redirect_uri"`
	ResponseType string `json:"response_type"`
	Scope        string `json:"scope"`
	State        string `json:"state"`

	// Resource Resource Indicator per RFC8707
	Resource            string `json:"resource"`
	CodeChallenge       string `json:"code_challenge"`
	CodeChallengeMethod string `json:"code_challenge_method"`
	Nonce               string `json:"nonce"` // OIDC nonce parameter
}

AuthorizeParams represents the parameters for an OAuth authorization request

type ClientCredentials 

type ClientCredentials struct {
	ClientID     string
	ClientSecret string
	AuthMethod   string
}

ClientCredentials represents the extracted client credentials and authentication method used

func ExtractClientCredentials 

func ExtractClientCredentials(r *http.Request) (*ClientCredentials, error)

ExtractClientCredentials extracts OAuth client credentials from the request Supports Basic auth header, form body parameters, and JSON body parameters

type ClientDetailsResponse 

type ClientDetailsResponse struct {
	ID      string `json:"id"`
	Name    string `json:"name,omitempty"`
	URI     string `json:"uri,omitempty"`
	LogoURI string `json:"logo_uri,omitempty"`
}

ClientDetailsResponse represents client details in authorization response

type ConsentRequest 

type ConsentRequest struct {
	Action OAuthServerConsentAction `json:"action"`
}

ConsentRequest represents a consent decision request

type ConsentResponse 

type ConsentResponse struct {
	RedirectURL string `json:"redirect_url,omitempty"`
}

ConsentResponse represents the response after processing consent

type OAuthServerClientListResponse 

type OAuthServerClientListResponse struct {
	Clients []OAuthServerClientResponse `json:"clients,omitempty"`
}

OAuthServerClientListResponse represents the response for listing OAuth clients

type OAuthServerClientRegisterParams 

type OAuthServerClientRegisterParams struct {
	// Required fields
	RedirectURIs []string `json:"redirect_uris"`

	// Client type can be explicitly provided or inferred from token_endpoint_auth_method
	ClientType              string `json:"client_type,omitempty"`                // models.OAuthServerClientTypePublic or models.OAuthServerClientTypeConfidential
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"` // "none", "client_secret_basic", or "client_secret_post"

	GrantTypes []string `json:"grant_types,omitempty"`
	ClientName string   `json:"client_name,omitempty"`
	ClientURI  string   `json:"client_uri,omitempty"`
	LogoURI    string   `json:"logo_uri,omitempty"`

	// Internal field
	RegistrationType string `json:"-"`
}

OAuthServerClientRegisterParams contains parameters for registering a new OAuth client

type OAuthServerClientResponse 

type OAuthServerClientResponse struct {
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret,omitempty"` // only returned on registration
	ClientType   string `json:"client_type"`

	RedirectURIs            []string `json:"redirect_uris,omitempty"`
	TokenEndpointAuthMethod string   `json:"token_endpoint_auth_method,omitempty"`
	GrantTypes              []string `json:"grant_types,omitempty"`
	ResponseTypes           []string `json:"response_types,omitempty"`
	ClientName              string   `json:"client_name,omitempty"`
	ClientURI               string   `json:"client_uri,omitempty"`
	LogoURI                 string   `json:"logo_uri,omitempty"`

	// Metadata fields
	RegistrationType string    `json:"registration_type,omitempty"`
	CreatedAt        time.Time `json:"created_at,omitempty"`
	UpdatedAt        time.Time `json:"updated_at,omitempty"`
}

OAuthServerClientResponse represents the response format for OAuth client operations

type OAuthServerClientUpdateParams 

type OAuthServerClientUpdateParams struct {
	RedirectURIs            *[]string `json:"redirect_uris,omitempty"`
	GrantTypes              *[]string `json:"grant_types,omitempty"`
	ClientName              *string   `json:"client_name,omitempty"`
	ClientURI               *string   `json:"client_uri,omitempty"`
	LogoURI                 *string   `json:"logo_uri,omitempty"`
	TokenEndpointAuthMethod *string   `json:"token_endpoint_auth_method,omitempty"`
}

OAuthServerClientUpdateParams contains parameters for updating an OAuth client

type OAuthServerConsentAction 

type OAuthServerConsentAction string
const (
	OAuthServerConsentActionApprove OAuthServerConsentAction = "approve"
	OAuthServerConsentActionDeny    OAuthServerConsentAction = "deny"
)

type OAuthTokenParams 

type OAuthTokenParams struct {
	GrantType    string `json:"grant_type" form:"grant_type"`
	Code         string `json:"code" form:"code"`
	RefreshToken string `json:"refresh_token" form:"refresh_token"`
	RedirectURI  string `json:"redirect_uri" form:"redirect_uri"`
	ClientID     string `json:"client_id" form:"client_id"`
	ClientSecret string `json:"client_secret" form:"client_secret"`
	CodeVerifier string `json:"code_verifier" form:"code_verifier"`
	Resource     string `json:"resource" form:"resource"`
}

OAuthTokenParams represents the parameters for the OAuth token endpoint

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server represents the OAuth 2.1 server functionality

func NewServer 

func NewServer(config *conf.GlobalConfiguration, db *storage.Connection, tokenService *tokens.Service) *Server

NewServer creates a new OAuth server instance

func (*Server) AdminOAuthServerClientRegister 

func (s *Server) AdminOAuthServerClientRegister(w http.ResponseWriter, r *http.Request) error

AdminOAuthServerClientRegister handles POST /admin/oauth/clients (manual registration by admins)

func (*Server) LoadOAuthServerClient 

func (s *Server) LoadOAuthServerClient(w http.ResponseWriter, r *http.Request) (context.Context, error)

LoadOAuthServerClient is middleware that loads an OAuth server client from the URL parameter

func (*Server) OAuthServerAuthorize 

func (s *Server) OAuthServerAuthorize(w http.ResponseWriter, r *http.Request) error

OAuthServerAuthorize handles GET /oauth/authorize

func (*Server) OAuthServerClientDelete 

func (s *Server) OAuthServerClientDelete(w http.ResponseWriter, r *http.Request) error

OAuthServerClientDelete handles DELETE /admin/oauth/clients/{client_id}

func (*Server) OAuthServerClientDynamicRegister 

func (s *Server) OAuthServerClientDynamicRegister(w http.ResponseWriter, r *http.Request) error

OAuthServerClientDynamicRegister handles POST /oauth/register (OAuth 2.1 Dynamic Client Registration)

func (*Server) OAuthServerClientGet 

func (s *Server) OAuthServerClientGet(w http.ResponseWriter, r *http.Request) error

OAuthServerClientGet handles GET /admin/oauth/clients/{client_id}

func (*Server) OAuthServerClientList 

func (s *Server) OAuthServerClientList(w http.ResponseWriter, r *http.Request) error

OAuthServerClientList handles GET /admin/oauth/clients

func (*Server) OAuthServerClientRegenerateSecret 

func (s *Server) OAuthServerClientRegenerateSecret(w http.ResponseWriter, r *http.Request) error

OAuthServerClientRegenerateSecret handles POST /admin/oauth/clients/{client_id}/regenerate_secret

func (*Server) OAuthServerClientUpdate 

func (s *Server) OAuthServerClientUpdate(w http.ResponseWriter, r *http.Request) error

OAuthServerClientUpdate handles PUT /admin/oauth/clients/{client_id}

func (*Server) OAuthServerConsent 

func (s *Server) OAuthServerConsent(w http.ResponseWriter, r *http.Request) error

OAuthServerConsent handles POST /oauth/authorizations/{authorization_id}/consent

func (*Server) OAuthServerGetAuthorization 

func (s *Server) OAuthServerGetAuthorization(w http.ResponseWriter, r *http.Request) error

OAuthServerGetAuthorization handles GET /oauth/authorizations/{authorization_id}

func (*Server) OAuthToken 

func (s *Server) OAuthToken(w http.ResponseWriter, r *http.Request) error

OAuthToken handles POST /oauth/token

func (*Server) OAuthUserInfo 

func (s *Server) OAuthUserInfo(w http.ResponseWriter, r *http.Request) error

OAuthUserInfo handles GET /oauth/userinfo (OIDC UserInfo endpoint) Per OIDC Core Section 5.3

Returns user information filtered by the scopes granted in the access token: - openid: sub (user ID) - always included as base claim - email: email, email_confirmed_at, new_email - profile: name, picture, preferred_username, updated_at, user_metadata - phone: phone, phone_confirmed_at, new_phone

func (*Server) UserListOAuthGrants 

func (s *Server) UserListOAuthGrants(w http.ResponseWriter, r *http.Request) error

UserListOAuthGrants handles GET /user/oauth/grants Lists all OAuth grants that the authenticated user has authorized (active consents)

func (*Server) UserRevokeOAuthGrant 

func (s *Server) UserRevokeOAuthGrant(w http.ResponseWriter, r *http.Request) error

UserRevokeOAuthGrant handles DELETE /user/oauth/grants?client_id=... Revokes the user's OAuth grant for a specific client

type UserDetailsResponse 

type UserDetailsResponse struct {
	ID    string `json:"id,omitempty"`
	Email string `json:"email,omitempty"`
}

UserDetailsResponse represents user details in authorization response

type UserOAuthGrantResponse 

type UserOAuthGrantResponse struct {
	Client    ClientDetailsResponse `json:"client"`
	Scopes    []string              `json:"scopes"`
	GrantedAt time.Time             `json:"granted_at"`
}

UserOAuthGrantResponse represents an OAuth grant that a user has authorized

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.