Documentation
¶
Overview ¶
Package auth manages OAuth2 credentials and access tokens for invgate-cli. Secrets are stored in the OS keychain (via go-keyring), never in config files.
Index ¶
Constants ¶
const ( KeyClientID = "client-id" KeyClientSecret = "client-secret" KeyAccessToken = "access-token" )
Keychain keys.
const ServiceName = "invgate-cli"
ServiceName is the keychain service under which all invgate-cli secrets are stored.
Variables ¶
ErrKeyringUnavailable is returned when the OS keychain cannot be accessed (e.g. in CI/Docker environments without a secret store).
var ErrNotFound = errors.New("keychain item not found")
ErrNotFound is returned when a keychain item is not present.
Functions ¶
This section is empty.
Types ¶
type CredentialResolver ¶
CredentialResolver reads credentials in priority order: 1. Explicit flag values (set via SetClientID/SetClientSecret) 2. Environment variables INVGATE_CLIENT_ID / INVGATE_CLIENT_SECRET 3. OS keychain entries client-id / client-secret
func NewCredentialResolver ¶
func NewCredentialResolver(kr Keyring) *CredentialResolver
NewCredentialResolver creates a resolver using the given keyring.
func (*CredentialResolver) Resolve ¶
func (r *CredentialResolver) Resolve() (clientID, clientSecret string, err error)
Resolve returns the best client ID and secret following the credential chain: flags → env → keychain → fallback file. If none are found, returns an AppError guiding the user to run setup.
func (*CredentialResolver) StoreCredentials ¶
func (r *CredentialResolver) StoreCredentials(clientID, clientSecret string) error
StoreCredentials writes client ID and secret to the keychain. If the keychain is unavailable, falls back to a restricted-permission file in the config directory.
func (*CredentialResolver) StoredCredentialsPresent ¶
func (r *CredentialResolver) StoredCredentialsPresent() bool
StoredCredentialsPresent reports whether both client ID and secret are present in the keychain. It does NOT report flag/env presence.
type KeychainManager ¶
type KeychainManager struct {
Resolver *CredentialResolver
TokenURL string
Scopes []string
HTTPClient *http.Client
Keyring Keyring
}
KeychainManager implements Manager using the keychain for credential and token caching, and client-credentials OAuth2 for token fetching.
func NewKeychainManager ¶
func NewKeychainManager(resolver *CredentialResolver, tokenURL string, kr Keyring) *KeychainManager
NewKeychainManager constructs a manager with sensible defaults.
func (*KeychainManager) Login ¶
func (m *KeychainManager) Login(ctx context.Context) error
Login forces a fresh token, ignoring any cached value.
func (*KeychainManager) Logout ¶
func (m *KeychainManager) Logout() error
Logout removes all keychain entries for the service.
func (*KeychainManager) Token ¶
func (m *KeychainManager) Token(ctx context.Context) (string, error)
Token returns a cached token if still valid (with a 60-second buffer), otherwise fetches a new one via the client-credentials grant. Caching to the keychain is best-effort: when the keyring is unavailable (CI/Docker), the freshly-fetched token is returned directly so that env-only credential mode still works.
type Keyring ¶
type Keyring interface {
Get(service, key string) (string, error)
Set(service, key, value string) error
Delete(service, key string) error
}
Keyring is the abstraction over the OS secret store, allowing mock implementations in tests.
type Manager ¶
type Manager interface {
// Token returns a valid access token (cached or freshly fetched).
Token(ctx context.Context) (string, error)
// Login forces a fresh token acquisition, overwriting any cached one.
Login(ctx context.Context) error
// Logout clears all keychain entries for this service.
Logout() error
}
Manager provides authentication operations for the CLI.
type MockKeyring ¶
MockKeyring is an in-memory keyring for tests.
func NewMockKeyring ¶
func NewMockKeyring() *MockKeyring
NewMockKeyring creates a fresh in-memory keyring.
func (*MockKeyring) Delete ¶
func (m *MockKeyring) Delete(service, key string) error
func (*MockKeyring) Set ¶
func (m *MockKeyring) Set(service, key, value string) error
type OSKeyring ¶
type OSKeyring struct{}
OSKeyring wraps github.com/zalando/go-keyring, implementing the Keyring interface. If the OS has no secret store, it returns ErrKeyringUnavailable.
type TokenSource ¶
type TokenSource struct {
Manager Manager
}
TokenSource wraps the Manager as an oauth2.TokenSource, so the HTTP client's transport can auto-refresh on 401 if desired.
Source Files