contract

package
v1.9.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 3, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package contract wires the oauth2provider plugin into the forge-dashboard contract registry: the nine intents that manage OAuth2 clients, the issuer an app's id_tokens name, and that issuer's signing keys.

The plugin package imports this one, so this one cannot import the plugin. It declares the service it needs as OAuth2Service, in its own types, and the plugin passes an adapter over itself.

handlers.go: OAuth2 client, issuer and signing key intent handlers.

Each handler resolves the caller's app, calls the plugin and projects the answer onto a wire type. No wire type carries a secret hash. Only create and rotateSecret carry a plaintext secret, once, and both register with dispatcher.SecretResponse so the dispatcher never replays them.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrClientNotFound = fmt.Errorf("oauth2 client not found")
	ErrOperatorKey    = fmt.Errorf("signing key is managed by configuration")
	ErrSharedKey      = fmt.Errorf("signing key is shared by every app")
	ErrKeyTooNew      = fmt.Errorf("signing key is too new to rotate")
	ErrNoSigningKey   = fmt.Errorf("no id_token signing key available")
)

ErrClientNotFound, ErrOperatorKey, ErrSharedKey, ErrKeyTooNew and ErrNoSigningKey are what an OAuth2Service answers for the failures the handlers name. A request the service refused is a *ValidationError.

Functions

func Register 

func Register(
	d *dispatcher.Dispatcher,
	reg contract.Registry,
	wreg contract.WardenRegistry,
	deps Deps,
) error

Types

type Client added in v1.9.1 

type Client struct {
	ID           string
	ClientID     string
	Name         string
	Public       bool
	FirstParty   bool
	RedirectURIs []string
	Scopes       []string
	GrantTypes   []string
	Resources    []string
	AuthMethod   string
	DPoPMode     string
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

Client is one OAuth2 client as the dashboard sees it. It carries no secret.

type ClientDetail added in v1.9.1 

type ClientDetail struct {
	ClientSummary
	Resources  []string `json:"resources"`
	AuthMethod string   `json:"authMethod"`
	DPoPMode   string   `json:"dpopMode"`
	UpdatedAt  string   `json:"updatedAt"`
}

type ClientIDInput added in v1.9.1 

type ClientIDInput struct {
	ID string `json:"id"`
}

type ClientListResponse added in v1.9.1 

type ClientListResponse struct {
	Clients []ClientSummary `json:"clients"`
}

type ClientSummary added in v1.9.1 

type ClientSummary struct {
	ID           string   `json:"id"`
	ClientID     string   `json:"clientId"`
	Name         string   `json:"name"`
	Public       bool     `json:"public"`
	FirstParty   bool     `json:"firstParty"`
	RedirectURIs []string `json:"redirectUris"`
	Scopes       []string `json:"scopes"`
	GrantTypes   []string `json:"grantTypes"`
	CreatedAt    string   `json:"createdAt"`
}

ClientSummary is one client in a list. ID addresses the client in inputs; ClientID is the public OAuth client_id a person sees.

type CreateClientInput added in v1.9.1 

type CreateClientInput struct {
	Name         string   `json:"name"`
	Public       bool     `json:"public"`
	FirstParty   bool     `json:"firstParty"`
	RedirectURIs []string `json:"redirectUris"`
	Scopes       []string `json:"scopes"`
	GrantTypes   []string `json:"grantTypes"`
	Resources    []string `json:"resources"`
}

type CreateParams added in v1.9.1 

type CreateParams struct {
	Name         string
	Public       bool
	FirstParty   bool
	RedirectURIs []string
	Scopes       []string
	GrantTypes   []string
	Resources    []string
}

CreateParams is what a new client is registered with.

type Created added in v1.9.1 

type Created struct {
	ID           string
	ClientID     string
	ClientSecret string
}

Created is a freshly registered client. ClientSecret is the plaintext, set only for a confidential client.

type CreatedClient added in v1.9.1 

type CreatedClient struct {
	ID           string `json:"id"`
	ClientID     string `json:"clientId"`
	ClientSecret string `json:"clientSecret,omitempty"`
}

CreatedClient carries the plaintext secret of a confidential client, once.

type Deps 

type Deps struct {
	Engine *authsome.Engine
	Plugin OAuth2Service
}

Deps carries the engine, which resolves the caller's app, and the plugin.

type IssuerDetails added in v1.9.1 

type IssuerDetails struct {
	Issuer       string
	DiscoveryURL string
	JWKSURI      string
	AppIssuer    bool
	Algs         []string
}

IssuerDetails describes the issuer an app's id_tokens name.

type IssuerInfoResponse added in v1.9.1 

type IssuerInfoResponse struct {
	Issuer       string   `json:"issuer"`
	DiscoveryURL string   `json:"discoveryUrl"`
	JWKSURI      string   `json:"jwksUri"`
	AppIssuer    bool     `json:"appIssuer"`
	Algs         []string `json:"algs"`
}

type KeyInfo added in v1.9.1 

type KeyInfo struct {
	KID       string
	Alg       string
	Source    string
	Status    string
	CreatedAt time.Time
	RetiresAt *time.Time
}

KeyInfo is one id_token signing key.

type KeyListResponse added in v1.9.1 

type KeyListResponse struct {
	Issuer string       `json:"issuer"`
	Keys   []KeySummary `json:"keys"`
}

type KeySummary added in v1.9.1 

type KeySummary struct {
	KID       string `json:"kid"`
	Alg       string `json:"alg"`
	Source    string `json:"source"`
	Status    string `json:"status"`
	CreatedAt string `json:"createdAt"`
	RetiresAt string `json:"retiresAt,omitempty"`
}

type OAuth2Service added in v1.9.1 

type OAuth2Service interface {
	CreateClientFor(ctx context.Context, appID id.AppID, in CreateParams) (Created, error)
	ListClientsFor(ctx context.Context, appID id.AppID) ([]Client, error)
	GetClientFor(ctx context.Context, appID id.AppID, clientID string) (Client, error)
	UpdateClientFor(ctx context.Context, appID id.AppID, clientID string, in UpdateParams) (Client, error)
	DeleteClientFor(ctx context.Context, appID id.AppID, clientID string) error
	RotateClientSecretFor(ctx context.Context, appID id.AppID, clientID string) (RotatedClient, error)
	SigningKeys(ctx context.Context, appID id.AppID) (issuer string, keys []KeyInfo, err error)
	RotateSigningKey(ctx context.Context, appID id.AppID) (KeyInfo, error)
	IssuerInfo(ctx context.Context, appID id.AppID) (IssuerDetails, error)
}

OAuth2Service is the surface of the oauth2provider plugin the handlers need. Every method acts for one app and treats another app's client as not found.

type RotatedClient added in v1.9.1 

type RotatedClient struct {
	ID           string
	ClientID     string
	ClientSecret string
}

RotatedClient is a client whose secret was just replaced.

type RotatedSecret added in v1.9.1 

type RotatedSecret struct {
	ID           string `json:"id"`
	ClientID     string `json:"clientId"`
	ClientSecret string `json:"clientSecret"`
}

type UpdateClientInput added in v1.9.1 

type UpdateClientInput struct {
	ID           string    `json:"id"`
	Name         *string   `json:"name,omitempty"`
	RedirectURIs *[]string `json:"redirectUris,omitempty"`
	Scopes       *[]string `json:"scopes,omitempty"`
	GrantTypes   *[]string `json:"grantTypes,omitempty"`
	Resources    *[]string `json:"resources,omitempty"`
}

UpdateClientInput changes the fields it carries. A nil field is left alone.

type UpdateParams added in v1.9.1 

type UpdateParams struct {
	Name         *string
	RedirectURIs *[]string
	Scopes       *[]string
	GrantTypes   *[]string
	Resources    *[]string
}

UpdateParams carries the fields to change. A nil field is left alone.

type ValidationError added in v1.9.1 

type ValidationError struct{ Msg string }

ValidationError is a request the service refused. Its message is safe to show the operator.

func (*ValidationError) Error added in v1.9.1 

func (e *ValidationError) Error() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.