Documentation
¶
Index ¶
Constants ¶
const ExpiryBuffer = time.Minute
ExpiryBuffer is subtracted from expiry time to refresh tokens early.
const RenewBuffer = 5 * time.Minute
RenewBuffer is how long before access-token expiry we proactively renew it from the refresh token. Sized for the short-lived (1h) CLI access token.
Variables ¶
This section is empty.
Functions ¶
func DeleteCredentials ¶
func DeleteCredentials() error
DeleteCredentials removes the credentials file.
func HasCredentials ¶
func HasCredentials() bool
HasCredentials returns whether credentials exist on disk.
Types ¶
type Credentials ¶
type Credentials struct {
AccessToken string `json:"access_token"`
// RefreshToken is a long-lived, rotating credential used to mint new access
// tokens. Stored in plaintext on disk (0600); the server keeps only its hash.
RefreshToken string `json:"refresh_token,omitempty"`
// AccessTokenExpiresAt is the authoritative expiry for the short-lived access
// token. ExpiresAt is kept for backward-compat with old credential files.
AccessTokenExpiresAt time.Time `json:"access_token_expires_at,omitempty"`
ExpiresAt time.Time `json:"expires_at"`
Email string `json:"email,omitempty"`
OrganizationName string `json:"organization_name,omitempty"`
}
Credentials holds OAuth tokens for API authentication.
func LoadCredentials ¶
func LoadCredentials() (*Credentials, error)
LoadCredentials reads credentials from disk.
func (*Credentials) HasRefreshToken ¶ added in v0.4.0
func (c *Credentials) HasRefreshToken() bool
HasRefreshToken reports whether a refresh token is stored.
func (*Credentials) IsExpired ¶
func (c *Credentials) IsExpired() bool
IsExpired returns whether the access token is expired or about to expire. Used by the status/login UI flows; the token hot path uses ShouldRenew + the client's renewing Token() instead.
func (*Credentials) Save ¶
func (c *Credentials) Save() error
Save writes credentials to disk with secure permissions.
The write is atomic: data is written to a temp file in the same directory with 0600 perms, then renamed over the target (atomic on POSIX). This avoids the truncate-then-write race where a concurrent taufinity process could read a partial file or where two rotating writers could corrupt the stored refresh token. The temp file is removed if anything before the rename fails.
func (*Credentials) ShouldRenew ¶ added in v0.4.0
func (c *Credentials) ShouldRenew() bool
ShouldRenew reports whether the access token is expired or within RenewBuffer of expiry, in which case it should be renewed from the refresh token.
func (*Credentials) UpdateTokens ¶ added in v0.4.0
func (c *Credentials) UpdateTokens(accessToken, refreshToken string, accessExpiresAt time.Time, email, orgName string) error
UpdateTokens stores a rotated access+refresh pair and saves to disk. An empty refreshToken leaves the existing one intact (the server may omit it). Empty email/orgName likewise preserve current values.
Source Files