Documentation
¶
Index ¶
- Constants
- func DeleteCredentials() error
- func HasCredentials() bool
- func LoadElevationToken() (token string, sessionID uint, expiresAt time.Time, err error)
- func RemoveElevationToken() error
- func SaveElevationToken(token string, sessionID uint, expiresAt time.Time) error
- type Credentials
- type ElevationToken
Constants ¶
const ExpiryBuffer = time.Minute
ExpiryBuffer is subtracted from expiry time to refresh tokens early.
const RenewBuffer = 5 * time.Minute
RenewBuffer is how long before access-token expiry we proactively renew it from the refresh token. Sized for the short-lived (1h) CLI access token.
Variables ¶
This section is empty.
Functions ¶
func DeleteCredentials ¶
func DeleteCredentials() error
DeleteCredentials removes the credentials file.
func HasCredentials ¶
func HasCredentials() bool
HasCredentials returns whether credentials exist on disk.
func LoadElevationToken ¶ added in v0.6.6
LoadElevationToken reads the stored elevation token from disk. Returns ("", 0, zero, nil) when no token file exists.
func RemoveElevationToken ¶ added in v0.6.6
func RemoveElevationToken() error
RemoveElevationToken deletes the stored elevation token file.
Types ¶
type Credentials ¶
type Credentials struct {
AccessToken string `json:"access_token"`
// RefreshToken is a long-lived, rotating credential used to mint new access
// tokens. Stored in plaintext on disk (0600); the server keeps only its hash.
RefreshToken string `json:"refresh_token,omitempty"`
// AccessTokenExpiresAt is the authoritative expiry for the short-lived access
// token. ExpiresAt is kept for backward-compat with old credential files.
AccessTokenExpiresAt time.Time `json:"access_token_expires_at,omitempty"`
ExpiresAt time.Time `json:"expires_at"`
Email string `json:"email,omitempty"`
OrganizationName string `json:"organization_name,omitempty"`
}
Credentials holds OAuth tokens for API authentication.
func LoadCredentials ¶
func LoadCredentials() (*Credentials, error)
LoadCredentials reads credentials from disk.
func (*Credentials) HasRefreshToken ¶ added in v0.4.0
func (c *Credentials) HasRefreshToken() bool
HasRefreshToken reports whether a refresh token is stored.
func (*Credentials) IsExpired ¶
func (c *Credentials) IsExpired() bool
IsExpired returns whether the access token is expired or about to expire. Used by the status/login UI flows; the token hot path uses ShouldRenew + the client's renewing Token() instead.
func (*Credentials) Save ¶
func (c *Credentials) Save() error
Save writes credentials to disk with secure permissions.
The write is atomic: data is written to a temp file in the same directory with 0600 perms, then renamed over the target (atomic on POSIX). This avoids the truncate-then-write race where a concurrent taufinity process could read a partial file or where two rotating writers could corrupt the stored refresh token. The temp file is removed if anything before the rename fails.
func (*Credentials) ShouldRenew ¶ added in v0.4.0
func (c *Credentials) ShouldRenew() bool
ShouldRenew reports whether the access token is expired or within RenewBuffer of expiry, in which case it should be renewed from the refresh token.
func (*Credentials) UpdateTokens ¶ added in v0.4.0
func (c *Credentials) UpdateTokens(accessToken, refreshToken string, accessExpiresAt time.Time, email, orgName string) error
UpdateTokens stores a rotated access+refresh pair and saves to disk. An empty refreshToken leaves the existing one intact (the server may omit it). Empty email/orgName likewise preserve current values.
Source Files