Documentation
¶
Index ¶
- Variables
- func Approve(tx *sql.Tx, userCode string, userId int) error
- func ApproveAuthorization(tx *sql.Tx, userId int, req models.AuthorizeApproveRequest, issuer string) (string, error)
- func CreateDeviceAuth(clientId, baseURL string) (*models.DeviceAuthorizeResponse, error)
- func Deny(tx *sql.Tx, userCode string) error
- func DenyAuthorization(ex lit.Executor, clientId, redirectUri, state string) (string, error)
- func IssueTokenSet(tx *sql.Tx, userId int, email, clientId string) (*models.TokenSetResponse, error)
- func IssuerBaseURL() string
- func IssuerBaseURLFromHTTPRequest(r *http.Request) string
- func IssuerBaseURLFromRequest(c *gin.Context) string
- func NewPATToken() string
- func PollDeviceToken(deviceCode string) (*models.TokenSetResponse, error)
- func RedeemAuthorizationCode(clientId, code, verifier, redirectUri, resource, issuer string) (*models.TokenSetResponse, error)
- func RegisterClient(tx *sql.Tx, name string, redirectURIs []string) (*models.OauthClient, error)
- func RevokeByToken(presented string) error
- func RotateRefresh(presented string) (*models.TokenSetResponse, error)
- func ValidateResource(resource, issuer string) error
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidGrantRequest = errors.New("invalid_request") ErrInvalidRedirect = errors.New("invalid_redirect_uri") ErrInvalidChallenge = errors.New("invalid_code_challenge") ErrInvalidTarget = errors.New("invalid_target") ErrInvalidClientMetadata = errors.New("invalid_client_metadata") )
var ( ErrAuthorizationPending = errors.New("authorization_pending") ErrSlowDown = errors.New("slow_down") ErrAccessDenied = errors.New("access_denied") ErrExpiredToken = errors.New("expired_token") ErrDeviceNotFound = errors.New("device_not_found") ErrDeviceExpired = errors.New("device_code_expired") ErrUnknownClient = errors.New("invalid_client") )
var ErrInvalidGrant = errors.New("invalid_grant")
Functions ¶
func ApproveAuthorization ¶ added in v1.8.15
func CreateDeviceAuth ¶
func CreateDeviceAuth(clientId, baseURL string) (*models.DeviceAuthorizeResponse, error)
func DenyAuthorization ¶ added in v1.8.15
func IssueTokenSet ¶
func IssuerBaseURL ¶
func IssuerBaseURL() string
IssuerBaseURL is the OAuth issuer and verification-URL base. It is always the server we are running on. Prefer IssuerBaseURLFromRequest in request handlers so the issuer resolves even when APP_BASE_URL is unset.
func IssuerBaseURLFromHTTPRequest ¶ added in v1.8.15
func IssuerBaseURLFromRequest ¶
IssuerBaseURLFromRequest returns the configured issuer base URL, or derives it from the incoming request when APP_BASE_URL is unset — the common case on self-hosted deployments that never set it. It honors X-Forwarded-Proto / X-Forwarded-Host from a fronting reverse proxy, falling back to the request's own scheme and Host. The returned value has no trailing slash.
func NewPATToken ¶
func NewPATToken() string
func PollDeviceToken ¶
func PollDeviceToken(deviceCode string) (*models.TokenSetResponse, error)
PollDeviceToken owns its own transactions: the OAuth token endpoint returns 400 for normal flow control (pending/slow_down), so it cannot rely on the request-scoped Transactional middleware (which only commits on 2xx).
func RedeemAuthorizationCode ¶ added in v1.8.15
func RedeemAuthorizationCode(clientId, code, verifier, redirectUri, resource, issuer string) (*models.TokenSetResponse, error)
func RegisterClient ¶ added in v1.8.15
func RevokeByToken ¶
RevokeByToken revokes the entire family the presented refresh token belongs to. It is idempotent and never reveals whether the token existed, so it is safe to expose on an unauthenticated logout endpoint. Like RotateRefresh it self-manages its transaction because the endpoint may return a non-2xx that the Transactional middleware would otherwise roll back.
func RotateRefresh ¶
func RotateRefresh(presented string) (*models.TokenSetResponse, error)
RotateRefresh owns its own transactions. Reuse detection must revoke the token family even though the endpoint returns 400, so the family revoke runs in its own committed transaction rather than the request-scoped one (which the Transactional middleware would roll back on a non-2xx response).
Rotation is atomic: the presented token is flipped to used inside the same transaction that mints its replacement, via a conditional UPDATE whose rows-affected result is the concurrency guard. If the token was already consumed, we distinguish a benign concurrent retry (within reuseGrace, the winner's rotated token set is replayed from the rotation cache so the loser recovers) from a genuine replay of a long-since-rotated token (family revoked).
func ValidateResource ¶ added in v1.8.15
Types ¶
This section is empty.
Source Files