auth

package
v1.11.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 10, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessDeniedError

type AccessDeniedError struct{}

AccessDeniedError indicates the user denied authorization.

func (*AccessDeniedError) Error

func (e *AccessDeniedError) Error() string

type Auth

type Auth interface {
	StartDeviceAuth(ctx context.Context) (*DeviceAuth, error)
	WaitForAuth(ctx context.Context, deviceCode string, interval time.Duration) (*Result, error)
	IsAuthenticated() bool
	GetAccessToken(ctx context.Context) (string, error)
	GetUserID(ctx context.Context) (string, error)
	ClearTokens() error
	RefreshTokenWithoutOrganization(ctx context.Context) (string, error)
	RefreshTokenWithOrganization(ctx context.Context, workosOrgID domain.WorkosOrganizationID) (string, error)
}

Auth provides authentication operations.

type AuthenticationResponse

type AuthenticationResponse struct {
	AccessToken  string
	RefreshToken string
	User         User
}

AuthenticationResponse represents a successful authentication.

type AuthorizationPendingError

type AuthorizationPendingError struct{}

AuthorizationPendingError indicates the user hasn't completed authentication yet.

func (*AuthorizationPendingError) Error

func (e *AuthorizationPendingError) Error() string

type DeviceAuth

type DeviceAuth struct {
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	DeviceCode              string // Kept internally for polling
	ExpiresIn               int
	Interval                int
}

DeviceAuth contains the information needed to display to the user.

type DeviceAuthResponse

type DeviceAuthResponse struct {
	DeviceCode              string
	UserCode                string
	VerificationURI         string
	VerificationURIComplete string
	ExpiresIn               int
	Interval                int
}

DeviceAuthResponse represents the response from device authorization.

type ExpiredTokenError

type ExpiredTokenError struct{}

ExpiredTokenError indicates the device code has expired.

func (*ExpiredTokenError) Error

func (e *ExpiredTokenError) Error() string

type OAuthProvider

type OAuthProvider interface {
	AuthorizeDevice(ctx context.Context) (*DeviceAuthResponse, error)
	PollAuthentication(ctx context.Context, deviceCode string) (*AuthenticationResponse, error)
	RefreshToken(ctx context.Context, refreshToken string) (*RefreshResponse, error)
	RefreshTokenWithOrganization(ctx context.Context, refreshToken string, organizationID domain.WorkosOrganizationID) (*RefreshResponse, error)
}

OAuthProvider defines the interface for OAuth device authorization flow. This allows Service to work with any OAuth provider (WorkOS, Auth0, etc.). Concrete implementation: workos.Client

type RefreshResponse

type RefreshResponse struct {
	AccessToken  string
	RefreshToken string
}

RefreshResponse represents a successful token refresh.

type Result

type Result struct {
	AccessToken  string
	RefreshToken string
	User         User
}

Result contains the tokens and user information after successful authentication.

type SecureStorage

type SecureStorage interface {
	// Get retrieves a value by key
	// Returns empty string if key doesn't exist
	Get(key string) (string, error)

	// Set stores a value by key
	Set(key string, value string) error

	// Delete removes a value by key
	Delete(key string) error
}

SecureStorage defines a generic secure key-value storage interface. This allows services to define domain concepts (like "access_token") while keeping the storage implementation generic (OS keychain, encrypted file, etc.). Concrete implementations: keyring.Keyring (OS keychain)

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service handles authentication business logic. It coordinates between the OAuth provider and secure token storage. It defines domain concepts (access_token, refresh_token) and translates them to/from generic key-value storage operations.

func NewService

func NewService(provider OAuthProvider, storage SecureStorage, scope log.Scope) *Service

NewService creates a new authentication service.

func (*Service) ClearTokens

func (s *Service) ClearTokens() error

ClearTokens removes all stored authentication tokens.

func (*Service) GetAccessToken

func (s *Service) GetAccessToken(ctx context.Context) (string, error)

GetAccessToken retrieves the stored access token, refreshing if expired.

func (*Service) GetUserID

func (s *Service) GetUserID(ctx context.Context) (string, error)

GetUserID returns the WorkOS user ID from the current access token.

func (*Service) IsAuthenticated

func (s *Service) IsAuthenticated() bool

IsAuthenticated checks if the user has valid stored credentials.

func (*Service) RefreshTokenWithOrganization

func (s *Service) RefreshTokenWithOrganization(ctx context.Context, workosOrgID domain.WorkosOrganizationID) (string, error)

RefreshTokenWithOrganization refreshes the access token scoped to an organization. This is used after creating/selecting an organization to get a token with the org_id claim. Returns the new access token so callers can update their API clients.

func (*Service) RefreshTokenWithoutOrganization

func (s *Service) RefreshTokenWithoutOrganization(ctx context.Context) (string, error)

RefreshTokenWithoutOrganization refreshes the access token without any organization scope. This is used for bootstrap flows where the user needs a user-scoped token to create an org. Returns the new access token so callers can update their API clients.

func (*Service) StartDeviceAuth

func (s *Service) StartDeviceAuth(ctx context.Context) (*DeviceAuth, error)

StartDeviceAuth initiates the device authorization flow.

func (*Service) WaitForAuth

func (s *Service) WaitForAuth(ctx context.Context, deviceCode string, interval time.Duration) (*Result, error)

WaitForAuth polls the OAuth provider until the user completes authentication or an error occurs. This is a blocking call that handles the polling loop with proper backoff.

type SlowDownError

type SlowDownError struct{}

SlowDownError indicates the client is polling too frequently.

func (*SlowDownError) Error

func (e *SlowDownError) Error() string

type TokenClaims

type TokenClaims struct {
	Sub   string `json:"sub"`
	Email string `json:"email"`
	OrgID string `json:"org_id"`
	Exp   int64  `json:"exp"`
}

TokenClaims holds the parsed claims from a JWT access token.

func ParseToken

func ParseToken(token string) (TokenClaims, error)

ParseToken extracts claims from a JWT access token without signature verification.

func (TokenClaims) ExpiresAt

func (c TokenClaims) ExpiresAt() time.Time

ExpiresAt returns the token's expiration time.

func (TokenClaims) IsExpired

func (c TokenClaims) IsExpired() bool

IsExpired returns true if the token has expired (with a 30-second buffer).

type User

type User struct {
	ID            string
	Email         string
	EmailVerified bool
	FirstName     string
	LastName      string
}

User represents an authenticated user.

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL