auth

package
v1.22.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 26, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessDeniedError 

type AccessDeniedError struct{}

AccessDeniedError indicates the user denied authorization.

func (*AccessDeniedError) Error 

func (e *AccessDeniedError) Error() string

type Auth 

type Auth interface {
	StartDeviceAuth(ctx context.Context) (*DeviceAuth, error)
	WaitForAuth(ctx context.Context, deviceCode string, interval time.Duration) (*Result, error)
	IsAuthenticated() bool
	GetAccessToken(ctx context.Context) (string, error)
	GetUserID(ctx context.Context) (string, error)
	ClearTokens() error
	RefreshTokenWithoutOrganization(ctx context.Context) (string, error)
	RefreshTokenWithOrganization(ctx context.Context, workosOrgID domain.WorkosOrganizationID) (string, error)
}

Auth provides authentication operations.

type AuthenticationResponse 

type AuthenticationResponse struct {
	AccessToken  string
	RefreshToken string
	User         User
}

AuthenticationResponse represents a successful authentication.

type AuthorizationPendingError 

type AuthorizationPendingError struct{}

AuthorizationPendingError indicates the user hasn't completed authentication yet.

func (*AuthorizationPendingError) Error 

func (e *AuthorizationPendingError) Error() string

type DeviceAuth 

type DeviceAuth struct {
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	DeviceCode              string // Kept internally for polling
	ExpiresIn               int
	Interval                int
}

DeviceAuth contains the information needed to display to the user.

type DeviceAuthResponse 

type DeviceAuthResponse struct {
	DeviceCode              string
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	ExpiresIn               int
	Interval                int
}

DeviceAuthResponse represents the response from device authorization.

type ExpiredTokenError 

type ExpiredTokenError struct{}

ExpiredTokenError indicates the device code has expired.

func (*ExpiredTokenError) Error 

func (e *ExpiredTokenError) Error() string

type OAuthProvider 

type OAuthProvider interface {
	AuthorizeDevice(ctx context.Context) (*DeviceAuthResponse, error)
	PollAuthentication(ctx context.Context, deviceCode string) (*AuthenticationResponse, error)
	RefreshToken(ctx context.Context, refreshToken string) (*RefreshResponse, error)
	RefreshTokenWithOrganization(ctx context.Context, refreshToken string, organizationID domain.WorkosOrganizationID) (*RefreshResponse, error)
}

OAuthProvider defines the interface for OAuth device authorization flow. This allows Service to work with any OAuth provider (WorkOS, Auth0, etc.). Concrete implementation: workos.Client

type RefreshResponse 

type RefreshResponse struct {
	AccessToken  string
	RefreshToken string
}

RefreshResponse represents a successful token refresh.

type Result 

type Result struct {
	AccessToken  string
	RefreshToken string
	User         User
}

Result contains the tokens and user information after successful authentication.

type SecureStorage 

type SecureStorage interface {
	// Get retrieves a value by key
	// Returns empty string if key doesn't exist
	Get(key string) (string, error)

	// Set stores a value by key
	Set(key string, value string) error

	// Delete removes a value by key
	Delete(key string) error
}

SecureStorage defines a generic secure key-value storage interface. This allows services to define domain concepts (like "access_token") while keeping the storage implementation generic (OS keychain, encrypted file, etc.). Concrete implementations: keyring.Keyring (OS keychain)

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service handles authentication business logic. It coordinates between the OAuth provider and secure token storage. It defines domain concepts (access_token, refresh_token) and translates them to/from generic key-value storage operations.

func NewService 

func NewService(provider OAuthProvider, storage SecureStorage, scope log.Scope) *Service

NewService creates a new authentication service.

func (*Service) ClearTokens 

func (s *Service) ClearTokens() error

ClearTokens removes all stored authentication tokens.

func (*Service) ForceRefreshAccessToken added in v1.16.0 

func (s *Service) ForceRefreshAccessToken(ctx context.Context) (string, error)

ForceRefreshAccessToken refreshes the access token unconditionally, bypassing the local expiration check. This is needed when a server rejects a token that the client still considers valid (e.g. due to clock skew).

func (*Service) GetAccessToken 

func (s *Service) GetAccessToken(ctx context.Context) (string, error)

GetAccessToken retrieves the stored access token, refreshing if expired.

func (*Service) GetUserID 

func (s *Service) GetUserID(ctx context.Context) (string, error)

GetUserID returns the WorkOS user ID from the current access token.

func (*Service) IsAuthenticated 

func (s *Service) IsAuthenticated() bool

IsAuthenticated checks if the user has valid stored credentials.

func (*Service) RefreshTokenWithOrganization 

func (s *Service) RefreshTokenWithOrganization(ctx context.Context, workosOrgID domain.WorkosOrganizationID) (string, error)

RefreshTokenWithOrganization refreshes the access token scoped to an organization. This is used after creating/selecting an organization to get a token with the org_id claim. Returns the new access token so callers can update their API clients.

func (*Service) RefreshTokenWithoutOrganization 

func (s *Service) RefreshTokenWithoutOrganization(ctx context.Context) (string, error)

RefreshTokenWithoutOrganization refreshes the access token without any organization scope. This is used for bootstrap flows where the user needs a user-scoped token to create an org. Returns the new access token so callers can update their API clients.

func (*Service) StartDeviceAuth 

func (s *Service) StartDeviceAuth(ctx context.Context) (*DeviceAuth, error)

StartDeviceAuth initiates the device authorization flow.

func (*Service) WaitForAuth 

func (s *Service) WaitForAuth(ctx context.Context, deviceCode string, interval time.Duration) (*Result, error)

WaitForAuth polls the OAuth provider until the user completes authentication or an error occurs. This is a blocking call that handles the polling loop with proper backoff.

type SlowDownError 

type SlowDownError struct{}

SlowDownError indicates the client is polling too frequently.

func (*SlowDownError) Error 

func (e *SlowDownError) Error() string

type TokenClaims 

type TokenClaims struct {
	Sub   string `json:"sub"`
	Email string `json:"email"`
	OrgID string `json:"org_id"`
	Exp   int64  `json:"exp"`
}

TokenClaims holds the parsed claims from a JWT access token.

func ParseToken 

func ParseToken(token string) (TokenClaims, error)

ParseToken extracts claims from a JWT access token without signature verification.

func (TokenClaims) ExpiresAt 

func (c TokenClaims) ExpiresAt() time.Time

ExpiresAt returns the token's expiration time.

func (TokenClaims) IsExpired 

func (c TokenClaims) IsExpired() bool

IsExpired returns true if the token has expired (with a 30-second buffer).

type User 

type User struct {
	ID            string
	Email         string
	EmailVerified bool
	FirstName     string
	LastName      string
}

User represents an authenticated user.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.