Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewComponents ¶ added in v1.54.0
func NewComponents(ctx context.Context, cfg config.RuntimeConfig[authConfig.Config], m *metrics.Metrics, _ *trace.Tracer) (boot.Components, error)
NewComponents builds auth's gRPC and HTTP registrations for pkg/boot.Boot. The two registrations get their own AuthService and DB connection each, not a shared one, since gRPC and HTTP may run in separate processes (see auth/AGENTS.md). tracer is unused: pkg/boot instruments the transports.
Types ¶
type AuthService ¶
type AuthService struct {
proto.UnimplementedAuthServiceServer
// contains filtered or unexported fields
}
func NewAuthService ¶
func NewAuthService(ctx context.Context, cfg authConfig.Config, db storage.Database) (*AuthService, error)
func (*AuthService) Health ¶
func (i *AuthService) Health(ctx context.Context, in *proto.HealthRequest) (*proto.HealthResponse, error)
func (*AuthService) SetupRoutes ¶
func (i *AuthService) SetupRoutes(mux *http.ServeMux)
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
testutil/providertest
Package providertest builds a core.Provider over fosite's in-memory store for handler unit tests, so requests exercise fosite's client authentication and token resolution without a database.
|
Package providertest builds a core.Provider over fosite's in-memory store for handler unit tests, so requests exercise fosite's client authentication and token resolution without a database. |
|
oauth
|
|
|
paths
Package paths holds the HTTP paths of IAM's OAuth endpoints.
|
Package paths holds the HTTP paths of IAM's OAuth endpoints. |
|
server/accesstokens
Package accesstokens is the public API for access-token persistence.
|
Package accesstokens is the public API for access-token persistence. |
|
server/authcodes
Package authcodes is the public API for authorization-code persistence.
|
Package authcodes is the public API for authorization-code persistence. |
|
server/clients
Package clients serves the OAuth client management API (gRPC, internal HTTP, and the public unauthenticated dynamic client registration endpoint).
|
Package clients serves the OAuth client management API (gRPC, internal HTTP, and the public unauthenticated dynamic client registration endpoint). |
|
server/consent
Package consent persists consent challenges and verifiers as the consent stage of the oauth_flows table.
|
Package consent persists consent challenges and verifiers as the consent stage of the oauth_flows table. |
|
server/discovery
Package discovery serves the authorization server's /.well-known metadata: OIDC/OAuth provider metadata, including the MCP-scoped variants, and RFC 7033 WebFinger.
|
Package discovery serves the authorization server's /.well-known metadata: OIDC/OAuth provider metadata, including the MCP-scoped variants, and RFC 7033 WebFinger. |
|
server/doorkeeperrefreshtokens
Package doorkeeperrefreshtokens is the public API for refresh tokens replicated from gitlab-rails/Doorkeeper.
|
Package doorkeeperrefreshtokens is the public API for refresh tokens replicated from gitlab-rails/Doorkeeper. |
|
server/internal/csrf
Package csrf provides the CSRF cookie and token helpers shared by the OAuth login and consent flows.
|
Package csrf provides the CSRF cookie and token helpers shared by the OAuth login and consent flows. |
|
server/internal/mcp
Package mcp lists GitLab's MCP resources and the scope each one maps to.
|
Package mcp lists GitLab's MCP resources and the scope each one maps to. |
|
server/internal/utils
Package utils holds the HTTP response writers the OAuth endpoints share: JSON bodies that must not be cached, and RFC 6749 §5.2 error bodies.
|
Package utils holds the HTTP response writers the OAuth endpoints share: JSON bodies that must not be cached, and RFC 6749 §5.2 error bodies. |
|
server/introspection
Package introspection serves RFC 7662 token introspection over HTTP.
|
Package introspection serves RFC 7662 token introspection over HTTP. |
|
server/login
Package login creates the oauth_flows row from the authorize request, and persists login challenges and verifiers as the login stage of that row.
|
Package login creates the oauth_flows row from the authorize request, and persists login challenges and verifiers as the login stage of that row. |
|
server/oidc
Package oidc is the public API for OpenID Connect session persistence.
|
Package oidc is the public API for OpenID Connect session persistence. |
|
server/pkce
Package pkce is the public API for PKCE-request persistence.
|
Package pkce is the public API for PKCE-request persistence. |
|
server/refreshtokens
Package refreshtokens is the public API for refresh-token persistence.
|
Package refreshtokens is the public API for refresh-token persistence. |
|
server/revocation
Package revocation implements the OAuth 2.0 token revocation endpoint per RFC 7009.
|
Package revocation implements the OAuth 2.0 token revocation endpoint per RFC 7009. |
|
server/revokedtokens
Package revokedtokens is the public API for the revoked-token denylist.
|
Package revokedtokens is the public API for the revoked-token denylist. |
|
server/tokens
Package tokens serves the internal InternalOAuthTokensService gRPC API, through which gitlab-rails revokes the tokens IAM holds for a (user, client) pair on OAuth app de-authorization and checks whether an access token has been revoked.
|
Package tokens serves the internal InternalOAuthTokensService gRPC API, through which gitlab-rails revokes the tokens IAM holds for a (user, client) pair on OAuth app de-authorization and checks whether an access token has been revoked. |
|
server/userinfo
Package userinfo calls GitLab Rails' `/api/v4/iam/userinfo` endpoint, authenticated with the access token minted for the same token exchange as a bearer credential.
|
Package userinfo calls GitLab Rails' `/api/v4/iam/userinfo` endpoint, authenticated with the access token minted for the same token exchange as a bearer credential. |
Click to show internal directories.
Click to hide internal directories.