Documentation
¶
Index ¶
- Constants
- func EffectiveRefreshLead(configured, lifetime time.Duration) time.Duration
- func IsRefreshInvalidGrant(err error) bool
- func NewRefreshInvalidGrantError(cause error) error
- func RefreshJitter(key Key, lead time.Duration) time.Duration
- func ShouldRefresh(now, expiresAt time.Time, configured, lifetime time.Duration) bool
- type InstanceID
- type Key
- type RefreshInvalidGrantError
Constants ¶
const ( // DefaultRefreshLead is the default lead for every registry and inline // provider, including the workspace provider. DefaultRefreshLead = 15 * time.Minute // MinUsefulRefreshLead is the minimum effective lead; below it a refresh // would race the token's own expiry. MinUsefulRefreshLead = 30 * time.Second )
Refresh policy shared by request-time resolution and the background refresh watcher. Both must call the same ShouldRefresh decision; they must not maintain different thresholds.
Variables ¶
This section is empty.
Functions ¶
func EffectiveRefreshLead ¶
EffectiveRefreshLead computes the refresh lead applied to one token:
effectiveRefreshLead = min(configuredRefreshLead, originalTokenLifetime * 20%) minimum useful lead = 30 seconds
configured <= 0 selects DefaultRefreshLead. lifetime <= 0 means the original token lifetime is unavailable: the configured lead is used unchanged and the caller must enforce a per-token refresh cooldown instead.
func IsRefreshInvalidGrant ¶
IsRefreshInvalidGrant reports whether err carries invalid_grant classification from the OAuth refresh broker.
func NewRefreshInvalidGrantError ¶
NewRefreshInvalidGrantError wraps a parsed invalid_grant response.
func RefreshJitter ¶
RefreshJitter derives a small deterministic per-key offset (up to 10% of lead) so multiple pods and users do not refresh simultaneously. Determinism keeps request-time and background decisions for the same key identical.
func ShouldRefresh ¶
ShouldRefresh reports whether a token expiring at expiresAt should refresh now under the provider's configured lead and the token's original lifetime. Tokens without a known expiry never trigger refresh.
Types ¶
type InstanceID ¶
type InstanceID string
InstanceID uniquely identifies a running process instance (hostname:pid:uuid). The UUID suffix handles container recycling where hostname+PID may be reused.
func NewInstanceID ¶
func NewInstanceID() InstanceID
NewInstanceID creates a new InstanceID for the current process.
type Key ¶
type Key struct {
Subject string // user identifier (from EffectiveUserID)
Provider string // oauth provider name (e.g. "google", "default")
}
Key identifies a token set for a user+provider pair.
type RefreshInvalidGrantError ¶
type RefreshInvalidGrantError struct {
// contains filtered or unexported fields
}
RefreshInvalidGrantError classifies a parsed invalid_grant response from the OAuth token endpoint without coupling the token manager to service/auth.
func (*RefreshInvalidGrantError) Error ¶
func (e *RefreshInvalidGrantError) Error() string
func (*RefreshInvalidGrantError) Unwrap ¶
func (e *RefreshInvalidGrantError) Unwrap() error
Source Files