oauth2

func NewConfigTokenSource ¶

func NewConfigTokenSource(cfg config.Config, httpClient *http.Client, protocol, hostname string, searchEnvForIdentity bool) (oauth2.TokenSource, error)

NewConfigTokenSource returns an oauth2.TokenSource backed by cfg's stored OAuth2 credentials for hostname, refreshing and persisting a rotated token as needed. searchEnvForIdentity controls whether the access token may also come from GITLAB_TOKEN/GITLAB_ACCESS_TOKEN/OAUTH_TOKEN; pass false wherever glab acts on behalf of another process that inherits the user's shell environment, such as the Docker credential helper, so a stray environment variable cannot substitute a different identity's access token.

func ParseExpiryDate ¶ added in v1.117.0

func ParseExpiryDate(s string) (time.Time, error)

unmarshal reads the OAuth2 token for hostname out of cfg. The "token" key is also resolvable from GITLAB_TOKEN/GITLAB_ACCESS_TOKEN/OAUTH_TOKEN, so searchEnvForIdentity gates that lookup the same way it does in api.NewClientFromConfig: callers that act on behalf of another process inheriting the environment (the Docker credential helper) must pass false so a stray environment variable cannot substitute a different identity's access token here. ParseExpiryDate reads a stored oauth2_expiry_date, accepting the RFC822 forms older versions of glab wrote.

func StartDeviceFlow ¶ added in v1.98.0

func StartDeviceFlow(ctx context.Context, cfg config.Config, out io.Writer, httpClient *http.Client, hostname string) (string, error)

StartDeviceFlow performs the OAuth 2.0 Device Authorization Grant (RFC 8628). It displays a one-time user code and verification URL, polls the token endpoint until the user completes authorization on a separate device, then persists the resulting token using the same on-disk shape as StartFlow.

func StartFlow ¶

func StartFlow(ctx context.Context, cfg config.Config, out io.Writer, httpClient *http.Client, hostname string) (string, error)