Documentation
¶
Index ¶
- Constants
- func SignJWT(config *conf.JWTConfiguration, claims jwt.Claims) (string, error)
- type AMRClaim
- type AccessTokenClaims
- type AccessTokenResponse
- type GenerateAccessTokenParams
- type GenerateIDTokenParams
- type HookManager
- type IDTokenClaims
- type RefreshTokenGrantParams
- type Service
- func (s *Service) GenerateAccessToken(r *http.Request, tx *storage.Connection, params GenerateAccessTokenParams) (string, int64, error)
- func (s *Service) GenerateIDToken(params GenerateIDTokenParams) (string, error)
- func (s *Service) IssueRefreshToken(r *http.Request, responseHeaders http.Header, conn *storage.Connection, ...) (*AccessTokenResponse, error)
- func (s *Service) RefreshTokenGrant(ctx context.Context, db *storage.Connection, r *http.Request, ...) (*AccessTokenResponse, error)
- func (s *Service) SetTimeFunc(timeFunc func() time.Time)
Constants ¶
const MinimumViableTokenSchema = `` /* 1131-byte string literal not displayed */
#nosec
Variables ¶
This section is empty.
Functions ¶
Types ¶
type AMRClaim ¶
AMRClaim supports unmarshalling AMR as either strings or AMREntry objects.
func (*AMRClaim) UnmarshalJSON ¶
UnmarshalJSON accepts either an array of strings or AMREntry objects.
type AccessTokenClaims ¶
type AccessTokenClaims struct {
jwt.RegisteredClaims
Email string `json:"email"`
Phone string `json:"phone"`
AppMetaData map[string]interface{} `json:"app_metadata"`
UserMetaData map[string]interface{} `json:"user_metadata"`
Role string `json:"role"`
AuthenticatorAssuranceLevel string `json:"aal,omitempty"`
AuthenticationMethodReference AMRClaim `json:"amr,omitempty"`
SessionId string `json:"session_id,omitempty"`
IsAnonymous bool `json:"is_anonymous"`
ClientID string `json:"client_id,omitempty"`
Scope string `json:"scope,omitempty"`
}
AccessTokenClaims is a struct thats used for JWT claims
type AccessTokenResponse ¶
type AccessTokenResponse struct {
Token string `json:"access_token"`
TokenType string `json:"token_type"` // Bearer
ExpiresIn int `json:"expires_in"`
ExpiresAt int64 `json:"expires_at"`
RefreshToken string `json:"refresh_token"`
User *models.User `json:"user"`
ProviderAccessToken string `json:"provider_token,omitempty"`
ProviderRefreshToken string `json:"provider_refresh_token,omitempty"`
WeakPassword interface{} `json:"weak_password,omitempty"`
IDToken string `json:"id_token,omitempty"` // OIDC ID Token
}
AccessTokenResponse represents an OAuth2 success response
func (*AccessTokenResponse) AsRedirectURL ¶
func (r *AccessTokenResponse) AsRedirectURL(redirectURL string, extraParams url.Values) string
AsRedirectURL encodes the AccessTokenResponse as a redirect URL that includes the access token response data in a URL fragment.
type GenerateAccessTokenParams ¶
type GenerateAccessTokenParams struct {
User *models.User
SessionID *uuid.UUID
AuthenticationMethod models.AuthenticationMethod
ClientID *uuid.UUID // OAuth2 server client ID if applicable
}
GenerateAccessTokenParams contains parameters for generating access tokens
type GenerateIDTokenParams ¶
type GenerateIDTokenParams struct {
User *models.User
ClientID uuid.UUID // OAuth2 client ID (required for ID tokens)
Nonce string // OIDC nonce from authorization request (optional)
AuthTime *time.Time // Time when authentication occurred (optional, uses user.LastSignInAt if not provided)
Scopes []string // OAuth scopes granted (used to filter claims)
}
GenerateIDTokenParams contains parameters for generating OIDC ID tokens
type HookManager ¶
type HookManager interface {
InvokeHook(tx *storage.Connection, r *http.Request, input any, output any) error
}
HookManager interface for access token hooks
type IDTokenClaims ¶
type IDTokenClaims struct {
jwt.RegisteredClaims
Nonce string `json:"nonce,omitempty"`
AuthTime int64 `json:"auth_time"`
Email string `json:"email,omitempty"`
EmailVerified bool `json:"email_verified"` // not omitempty because it's required by OIDC spec
PhoneNumber string `json:"phone_number,omitempty"`
PhoneNumberVerified bool `json:"phone_number_verified"` // not omitempty because it's required by OIDC spec
Name string `json:"name,omitempty"`
Picture string `json:"picture,omitempty"`
UpdatedAt int64 `json:"updated_at,omitempty"`
PreferredUsername string `json:"preferred_username,omitempty"`
ClientID string `json:"client_id,omitempty"`
}
IDTokenClaims represents OpenID Connect ID Token claims
type RefreshTokenGrantParams ¶
type RefreshTokenGrantParams struct {
RefreshToken string
ClientID *uuid.UUID // OAuth2 server client ID if applicable
}
RefreshTokenGrantParams contains parameters for refresh token grant
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service handles token operations
func NewService ¶
func NewService(config *conf.GlobalConfiguration, hookManager HookManager) *Service
NewService creates a new token service
func (*Service) GenerateAccessToken ¶
func (s *Service) GenerateAccessToken(r *http.Request, tx *storage.Connection, params GenerateAccessTokenParams) (string, int64, error)
GenerateAccessToken generates an access token using shared logic
func (*Service) GenerateIDToken ¶
func (s *Service) GenerateIDToken(params GenerateIDTokenParams) (string, error)
GenerateIDToken generates an OpenID Connect ID Token IDToken is generated only when the signing key is an asymmetric one. HS256 is not supported for ID token signing. Claims are filtered based on the granted scopes per OIDC spec: - openid: sub (always included when openid scope is present) - email: email, email_verified - profile: name, picture, updated_at, preferred_username - phone: phone_number, phone_number_verified
func (*Service) IssueRefreshToken ¶
func (s *Service) IssueRefreshToken(r *http.Request, responseHeaders http.Header, conn *storage.Connection, user *models.User, authenticationMethod models.AuthenticationMethod, grantParams models.GrantParams) (*AccessTokenResponse, error)
IssueRefreshToken creates a new refresh token and access token
func (*Service) RefreshTokenGrant ¶
func (s *Service) RefreshTokenGrant(ctx context.Context, db *storage.Connection, r *http.Request, responseHeaders http.Header, params RefreshTokenGrantParams) (*AccessTokenResponse, error)
RefreshTokenGrant implements the refresh_token grant type flow
func (*Service) SetTimeFunc ¶
SetTimeFunc allows overriding the time function (only for testing!!)
Source Files