Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func InitBatchMetrics ¶ added in v1.142.0
func InitBatchMetrics(reg prometheus.Registerer) error
InitBatchMetrics registers the batch record counter with reg. It lives here because batch is internal to this package tree, so auth cannot import it.
func InitMetrics ¶ added in v1.79.0
func InitMetrics(reg prometheus.Registerer) error
InitMetrics registers the token endpoint metrics with reg. Call once, from auth.NewComponents, before serving traffic.
Types ¶
type OauthHandler ¶
type OauthHandler struct {
// contains filtered or unexported fields
}
func NewServer ¶
func NewServer(provider *core.Provider, loginManager *login.Manager, consentManager *consent.Manager, federationBroker *federation.Broker) *OauthHandler
func (*OauthHandler) SetupRoutes ¶
func (o *OauthHandler) SetupRoutes(mux *http.ServeMux)
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package accesstokens is the public API for access-token persistence.
|
Package accesstokens is the public API for access-token persistence. |
|
Package authcodes is the public API for authorization-code persistence.
|
Package authcodes is the public API for authorization-code persistence. |
|
Package clients serves the OAuth client management API (gRPC, internal HTTP, and the public unauthenticated dynamic client registration endpoint).
|
Package clients serves the OAuth client management API (gRPC, internal HTTP, and the public unauthenticated dynamic client registration endpoint). |
|
Package consent persists consent challenges and verifiers as the consent stage of the oauth_flows table.
|
Package consent persists consent challenges and verifiers as the consent stage of the oauth_flows table. |
|
Package discovery serves the authorization server's /.well-known metadata: OIDC/OAuth provider metadata, including the MCP-scoped variants, and RFC 7033 WebFinger.
|
Package discovery serves the authorization server's /.well-known metadata: OIDC/OAuth provider metadata, including the MCP-scoped variants, and RFC 7033 WebFinger. |
|
Package doorkeeperrefreshtokens is the public API for refresh tokens replicated from gitlab-rails/Doorkeeper.
|
Package doorkeeperrefreshtokens is the public API for refresh tokens replicated from gitlab-rails/Doorkeeper. |
|
internal
|
|
|
batch
Package batch holds the per-record upsert pipeline and result handling shared by the bulk gRPC handlers.
|
Package batch holds the per-record upsert pipeline and result handling shared by the bulk gRPC handlers. |
|
csrf
Package csrf provides the CSRF cookie and token helpers shared by the OAuth login and consent flows.
|
Package csrf provides the CSRF cookie and token helpers shared by the OAuth login and consent flows. |
|
mcp
Package mcp lists GitLab's MCP resources and the scope each one maps to.
|
Package mcp lists GitLab's MCP resources and the scope each one maps to. |
|
utils
Package utils holds the HTTP response writers the OAuth endpoints share: JSON bodies that must not be cached, and RFC 6749 §5.2 error bodies.
|
Package utils holds the HTTP response writers the OAuth endpoints share: JSON bodies that must not be cached, and RFC 6749 §5.2 error bodies. |
|
Package introspection serves RFC 7662 token introspection over HTTP.
|
Package introspection serves RFC 7662 token introspection over HTTP. |
|
Package login creates the oauth_flows row from the authorize request, and persists login challenges and verifiers as the login stage of that row.
|
Package login creates the oauth_flows row from the authorize request, and persists login challenges and verifiers as the login stage of that row. |
|
Package oidc is the public API for OpenID Connect session persistence.
|
Package oidc is the public API for OpenID Connect session persistence. |
|
Package pkce is the public API for PKCE-request persistence.
|
Package pkce is the public API for PKCE-request persistence. |
|
Package refreshtokens is the public API for refresh-token persistence.
|
Package refreshtokens is the public API for refresh-token persistence. |
|
Package revocation implements the OAuth 2.0 token revocation endpoint per RFC 7009.
|
Package revocation implements the OAuth 2.0 token revocation endpoint per RFC 7009. |
|
Package revokedtokens is the public API for the revoked-token denylist.
|
Package revokedtokens is the public API for the revoked-token denylist. |
|
Package tokens serves the internal InternalOAuthTokensService gRPC API, through which gitlab-rails revokes the tokens IAM holds for a (user, client) pair on OAuth app de-authorization and checks whether an access token has been revoked.
|
Package tokens serves the internal InternalOAuthTokensService gRPC API, through which gitlab-rails revokes the tokens IAM holds for a (user, client) pair on OAuth app de-authorization and checks whether an access token has been revoked. |
|
Package userinfo calls GitLab Rails' `/api/v4/iam/userinfo` endpoint, authenticated with the access token minted for the same token exchange as a bearer credential.
|
Package userinfo calls GitLab Rails' `/api/v4/iam/userinfo` endpoint, authenticated with the access token minted for the same token exchange as a bearer credential. |
Click to show internal directories.
Click to hide internal directories.