auth

func ClientIDFromContext ¶ added in v1.85.1

func ClientIDFromContext(ctx context.Context) (string, bool)

ClientIDFromContext returns the OAuth2 client a Granter is granting for. TokenHTTPHandler sets it only after the provider's ID token was validated with that client as its audience, so it names the client the provider issued the tokens to, not merely the one the request claimed. It is absent outside of a Granter called by TokenHTTPHandler.

func ContextWithClaims ¶

func ContextWithClaims[T any](ctx context.Context, claims UserClaims[T]) context.Context

ContextWithClaims returns a new Context that holds claims.

func ContextWithClientID ¶ added in v1.85.1

func ContextWithClientID(ctx context.Context, clientID string) context.Context

ContextWithClientID returns a new Context that holds clientID for ClientIDFromContext, as TokenHTTPHandler hands it to a Granter.

func EncodeSecretID ¶

func EncodeSecretID(id string) string

EncodeSecretID encodes the given ID to be compatible with SecretStore implementations.

func GenerateSelfSignedCert ¶

func GenerateSelfSignedCert(
	dnsNames []string, subject pkix.Name, expiresIn time.Duration,
) (certPEM []byte, keyPEM []byte, err error)

GenerateSelfSignedCert returns a PEM‑encoded private key and a PEM‑encoded X.509 certificate that are mutually compatible.

func NewClient ¶

func NewClient(
	ctx context.Context, conf oauth2.Config,
	visitURLCallback func(string) error,
	opts ...ClientOption,
) (*http.Client, oauth2.TokenSource, error)

NewClient starts an oauth2 like NewClientWithPorts but will setup a callback listener on a random port. See NewClientWithPorts for more details.

func NewClientWithPorts ¶

func NewClientWithPorts(
	ctx context.Context, conf oauth2.Config,
	visitURLCallback func(string) error,
	tryPorts []int, opts ...ClientOption,
) (*http.Client, oauth2.TokenSource, error)

NewClientWithPorts starts a oauth2 flow with the given oaut2 config and returns an *http.Client that will refresh the token as necessary, or an error if there's an error completing the oauth2 flow.

This client can be used against WithMiddleware if configured to use a Token endpoint managed by the handler returned by TokenHTTPHandler.

Oftentimes oauth2 providers want the callback url to be in a whitelist so listening on a random port won't work. The parameter tryPorts is designed to enable users to whitelist a (hopefully long) list of known ports and pass them to this constructor.

func SignToken ¶

func SignToken[T any](key Key, userID, email string, extraClaims T, expiry time.Duration) (string, error)

SignToken creates a new JWT token with the given user, email and role claims.

func TokenHTTPHandler ¶

func TokenHTTPHandler[T any](
	keys Keys, secretStore SecretStore, granter Granter[T],
	expiry time.Duration,
) http.Handler

TokenHTTPHandler returns a http.Handler that handles oauth2 token requests by forwarding the request to an upstream channel and intercepting an id token to associate with the returned access token. This function returns an error if the given upstreamURL could not be parsed as a url.URL.

It uses the given granter to grant extra claims to the user.

If client secret is not present in the request (i.e. PCKE) then a client secret is fetched from secretStore with the client id as the base64 encoded (url encoded, no padding) as the secret id.

func WithMiddleware ¶

func WithMiddleware[T any](next http.Handler, config MiddlewareConfig[T]) http.Handler

WithMiddleware wraps next with a middleware that expects an oauth2 Authorization header to authenticate and extract user details to authorize a user. The Authorizer set in the config determines to what resources each user role has access to.