Documentation
¶
Overview ¶
Package postgres provides PostgreSQL storage for OAuth 2.1 data.
Index ¶
- type Store
- func (s *Store) CleanupExpiredCodes(ctx context.Context) error
- func (s *Store) CleanupExpiredStates(ctx context.Context, maxAge time.Duration) error
- func (s *Store) CleanupExpiredTokens(ctx context.Context) error
- func (s *Store) CleanupUnusedDCRClients(ctx context.Context, ttl time.Duration) error
- func (s *Store) Close() error
- func (s *Store) ConsumeAuthorizationCode(ctx context.Context, code string) (*oauth.AuthorizationCode, error)
- func (s *Store) ConsumeRefreshToken(ctx context.Context, token string) (*oauth.RefreshToken, error)
- func (s *Store) CreateClient(ctx context.Context, client *oauth.Client) error
- func (s *Store) DeleteAuthorizationCode(ctx context.Context, code string) error
- func (s *Store) DeleteClient(ctx context.Context, clientID string) error
- func (s *Store) DeleteRefreshToken(ctx context.Context, token string) error
- func (s *Store) DeleteRefreshTokensForClient(ctx context.Context, clientID string) error
- func (s *Store) DeleteState(ctx context.Context, key string) error
- func (s *Store) GetAuthorizationCode(ctx context.Context, code string) (*oauth.AuthorizationCode, error)
- func (s *Store) GetClient(ctx context.Context, clientID string) (*oauth.Client, error)
- func (s *Store) GetRefreshToken(ctx context.Context, token string) (*oauth.RefreshToken, error)
- func (s *Store) GetState(ctx context.Context, key string) (*oauth.AuthorizationState, error)
- func (s *Store) ListClients(ctx context.Context) (_ []*oauth.Client, retErr error)
- func (s *Store) SaveAuthorizationCode(ctx context.Context, code *oauth.AuthorizationCode) error
- func (s *Store) SaveRefreshToken(ctx context.Context, token *oauth.RefreshToken) error
- func (s *Store) SaveState(ctx context.Context, key string, state *oauth.AuthorizationState) error
- func (s *Store) StartCleanupRoutine(interval, dcrTTL time.Duration)
- func (s *Store) UpdateClient(ctx context.Context, client *oauth.Client) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store implements oauth.Storage using PostgreSQL.
func (*Store) CleanupExpiredCodes ¶
CleanupExpiredCodes removes expired authorization codes.
func (*Store) CleanupExpiredStates ¶ added in v1.96.0
CleanupExpiredStates removes states older than maxAge.
func (*Store) CleanupExpiredTokens ¶
CleanupExpiredTokens removes expired refresh tokens.
func (*Store) CleanupUnusedDCRClients ¶ added in v1.101.0
CleanupUnusedDCRClients hard-deletes dynamically-registered (DCR) clients created more than ttl ago that never completed a token exchange. Eligibility is last_used_at IS NULL (set on first issuance by SaveRefreshToken), which is race-free: a client that completed an authorization-code flow is retained for good, even during the brief tokenless window of refresh-token rotation or after its refresh token later expires. Pre-registered (config-file) clients have dcr = false and are never eligible, so this only reaps the unauthenticated /register endpoint's abandoned registrations.
func (*Store) ConsumeAuthorizationCode ¶ added in v1.96.0
func (s *Store) ConsumeAuthorizationCode(ctx context.Context, code string) (*oauth.AuthorizationCode, error)
ConsumeAuthorizationCode atomically deletes and returns an authorization code in a single statement, so retrieval and single-use invalidation cannot diverge. Returns oauth.ErrNotFound when the code does not exist, so the grant handler can distinguish replay from a storage outage.
func (*Store) ConsumeRefreshToken ¶ added in v1.96.0
ConsumeRefreshToken atomically deletes and returns a refresh token in a single statement, backing rotation: the old token is provably invalid before new tokens are issued. Returns oauth.ErrNotFound when the token does not exist, so the grant handler can distinguish an invalid token from a storage outage.
func (*Store) CreateClient ¶
CreateClient stores a new OAuth client.
func (*Store) DeleteAuthorizationCode ¶
DeleteAuthorizationCode deletes an authorization code by its raw value.
func (*Store) DeleteClient ¶
DeleteClient marks a client as inactive.
func (*Store) DeleteRefreshToken ¶
DeleteRefreshToken deletes a refresh token by its raw value.
func (*Store) DeleteRefreshTokensForClient ¶
DeleteRefreshTokensForClient deletes all refresh tokens for a client.
func (*Store) DeleteState ¶ added in v1.96.0
DeleteState removes an authorization state.
func (*Store) GetAuthorizationCode ¶
func (s *Store) GetAuthorizationCode(ctx context.Context, code string) (*oauth.AuthorizationCode, error)
GetAuthorizationCode retrieves an authorization code by its raw value; the comparison is against the stored SHA-256 digest.
func (*Store) GetRefreshToken ¶
GetRefreshToken retrieves a refresh token by its raw value; the comparison is against the stored SHA-256 digest.
func (*Store) ListClients ¶
ListClients returns all active clients.
func (*Store) SaveAuthorizationCode ¶
SaveAuthorizationCode stores an authorization code. Only the SHA-256 digest of the code value is persisted (oauth.HashToken), so a database read never yields a usable credential.
func (*Store) SaveRefreshToken ¶
SaveRefreshToken stores a refresh token. Only the SHA-256 digest of the token value is persisted (oauth.HashToken), so a database read never yields a usable credential.
func (*Store) SaveState ¶ added in v1.96.0
SaveState stores an authorization state, replacing any existing state under the same key (the prompt=none retry path re-saves the state with PromptNoneAttempted set).
func (*Store) StartCleanupRoutine ¶ added in v0.15.1
StartCleanupRoutine starts a background goroutine that periodically cleans up expired authorization codes, refresh tokens, and authorization states, and (when dcrTTL > 0) reaps unused dynamically-registered clients older than dcrTTL.
Source Files