Affected by GO-2022-0502 and 2 other vulnerabilities

GO-2022-0502: Weave GitOps leaked cluster credentials into logs on connection errors in github.com/weaveworks/weave-gitops

GO-2023-1377: GitOps Run allows for Kubernetes workload injection in github.com/weaveworks/weave-gitops

GO-2023-1388: Gitops Run insecure communication in github.com/weaveworks/weave-gitops

auth

package

v0.2.3 Latest Latest Go to latest Published: Aug 23, 2021 License: MPL-2.0 Imports: 10 Imported by: 0

Details

View Source

const WeGOGithubClientID = "edcb13588d46f254052c"

Uniquely identifies us as a GitHub app. This does not need to be obfuscated because it is publicly available to anyone who does an OAuth request via wego. See the auth ADR for more details: https://github.com/weaveworks/weave-gitops/blob/main/doc/adr/0005-wego-core-auth-strategy.md#design

View Source

var ErrAuthPending = errors.New("auth pending")

This section is empty.

type AuthProvider interface {
	DoCLIAuth(ctx context.Context, stdout io.Writer) (string, error)
}

type BlockingCLIAuthHandler func(context.Context, io.Writer) (string, error)

BlockingCLIAuthHandler takes over the terminal experience and returns a token when the user completes the flow.

func NewAuthProvider(name gitproviders.GitProviderName) (BlockingCLIAuthHandler, error)

func NewGithubDeviceFlowHandler(client *http.Client) BlockingCLIAuthHandler

NewGithubDeviceFlowHandler returns a function which will initiate the Github Device Flow for the CLI.