Documentation
¶
Overview ¶
package clientauth separates ordinary authenticated requests from explicit login. Authenticate reuses an explicit access token or a saved control session and may refresh it; only Login and StartLogin initiate human approval.
device login checkpoints live in server-scoped client state. private device challenges, nonces, assertions, and issued sessions use its secret protector. waiters share an operation lock; credential locks cover refresh, cancellation, and installation, never browser approval. revisions reject cancelled work, and installation commits the session, selected server, and completion together.
checkpoints precede one-time redemption and control exchange. after a lost response or process exit during those steps, the operation requires a new login instead of replaying a potentially consumed credential. an assertion or issued session already checkpointed can resume without another redemption.
Index ¶
- Variables
- func CancelLogin(ctx context.Context, config Config, id string) (clientstate.AuthOperation, error)
- func InspectLogin(ctx context.Context, config Config, id string) (clientstate.AuthOperation, error)
- func Logout(ctx context.Context, config Config) error
- func RequireSignInOutsideDemo(ctx context.Context, state *clientstate.Database, ...) error
- func StartLogin(ctx context.Context, config Config) (clientstate.AuthOperation, error)
- func WaitLogin(ctx context.Context, config Config, id string, timeout time.Duration) (result clientstate.AuthOperation, retErr error)
- type Client
- type Config
- type Prompt
- type StatusResult
Constants ¶
This section is empty.
Variables ¶
var ErrAuthenticationTimeout = errors.New("clientauth: authentication timed out")
Functions ¶
func CancelLogin ¶
func CancelLogin(ctx context.Context, config Config, id string) (clientstate.AuthOperation, error)
func InspectLogin ¶
func InspectLogin(ctx context.Context, config Config, id string) (clientstate.AuthOperation, error)
func StartLogin ¶
func StartLogin(ctx context.Context, config Config) (clientstate.AuthOperation, error)
StartLogin returns immediately after creating a durable device challenge.
func WaitLogin ¶
func WaitLogin(ctx context.Context, config Config, id string, timeout time.Duration) (result clientstate.AuthOperation, retErr error)
WaitLogin joins one operation. its file lock is separate from credential refresh/install, and cancellation uses revision checks rather than this lock.
Types ¶
type Client ¶
type Client struct {
ServerEndpoint string
Discovery controlv1.ControlDiscovery
Control *clientcontrol.Client
Authority *clientauthority.Client
}
type Prompt ¶
type Prompt struct{ URL, Code string }
Prompt contains the control-owned approval URL and code shown by the CLI.
type StatusResult ¶
type StatusResult struct {
SchemaVersion int `json:"schema_version"`
Server string `json:"server"`
Status string `json:"status"`
Source string `json:"source"`
AccessExpiresAt *time.Time `json:"access_expires_at,omitempty"`
RefreshExpiresAt *time.Time `json:"refresh_expires_at,omitempty"`
Checked bool `json:"checked"`
}
Source Files