Documentation
¶
Overview ¶
Package supabaseauth implements client-side Supabase Auth for Loom CLI/TUI clients: a PKCE OAuth login flow, on-disk session persistence, automatic token refresh, and gRPC per-RPC bearer credentials.
Index ¶
Constants ¶
const DefaultManagementAPI = "https://api.supabase.com"
DefaultManagementAPI is the base URL of the Supabase Management API.
Variables ¶
This section is empty.
Functions ¶
func ManagementLogin ¶
func ManagementLogin(ctx context.Context, cfg ManagementConfig) (string, error)
ManagementLogin runs the Management API OAuth authorization-code+PKCE flow and returns an access token. The redirect URI's host:port is bound locally to capture the code, so it must be a loopback URI registered with the OAuth app.
Types ¶
type LoginConfig ¶
type LoginConfig struct {
URL string // https://<ref>.supabase.co
ProjectRef string // project reference (stored on the session)
AnonKey string // public anon key (sent as apikey)
Provider string // OAuth provider: github, google, ...
OpenBrowser func(string) error // defaults to browser.OpenURL
Logf func(string, ...any) // optional progress logger
HTTPClient *http.Client // defaults to http.DefaultClient
}
LoginConfig configures the PKCE OAuth login flow.
type ManagementConfig ¶
type ManagementConfig struct {
ClientID string
ClientSecret string
RedirectURI string // must exactly match the registered redirect URI
APIBase string // defaults to DefaultManagementAPI
OpenBrowser func(string) error
HTTPClient *http.Client
Logf func(string, ...any)
}
ManagementConfig configures the Supabase Management OAuth flow. The developer must pre-register an OAuth application in the Supabase dashboard to obtain a client id/secret and register the redirect URI.
type Project ¶
type Project struct {
ID string `json:"id"` // the project ref
Name string `json:"name"`
Region string `json:"region"`
}
Project is a Supabase project from the Management API.
type Session ¶
type Session struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
ExpiresAt int64 `json:"expires_at"` // unix seconds
ProjectRef string `json:"project_ref"`
URL string `json:"url"` // https://<ref>.supabase.co
AnonKey string `json:"anon_key"` // public anon key (needed for refresh)
Email string `json:"email,omitempty"`
}
Session is a stored Supabase Auth session.
func Login ¶
func Login(ctx context.Context, cfg LoginConfig) (*Session, error)
Login runs the Supabase Auth PKCE authorization-code flow: it starts a loopback callback server, opens the browser to the provider, captures the returned code, and exchanges it for tokens. The returned Session is not persisted; the caller decides where to store it.
type Store ¶
type Store struct {
// FilePath is the fallback session file. Created 0600 in a 0700 dir.
FilePath string
// UseKeyring enables the OS keyring as the primary backend.
UseKeyring bool
}
Store persists a Session in the OS keyring, falling back to a 0600 file when the keyring is unavailable (e.g. headless/CI hosts).
func NewStore ¶
NewStore returns a Store that prefers the OS keyring and falls back to <dataDir>/auth/session.json.
type TokenSource ¶
type TokenSource struct {
// contains filtered or unexported fields
}
TokenSource returns the current access token, refreshing it from the stored refresh token when it is near expiry. It is safe for concurrent use.
func NewTokenSource ¶
func NewTokenSource(store *Store) *TokenSource
NewTokenSource builds a TokenSource backed by the given session store.
func (*TokenSource) Token ¶
func (ts *TokenSource) Token() (string, error)
Token returns a valid access token, refreshing if needed. It returns an error when no session is stored (the user must run `loom login`).
Source Files