Documentation
¶
Overview ¶
Package refresh is keryx's token-refresh seam (spec 0010): a Refresher per platform plus a name-keyed registry, mirroring pkg/publish. Each platform adapter registers a Refresher that rotates/refreshes its token where it can and reports a Status (incl. an Alert + a re-auth deadline) where it can't. The `auth refresh` command fans out across the enabled platforms.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ParseRFC3339 ¶
ParseRFC3339 parses an RFC3339 timestamp, returning the zero time on error (a missing/unparseable expiry → "unknown").
func Register ¶
func Register(name string, c Constructor)
Register adds a platform refresher. Called from an adapter package's init().
func Registered ¶
func Registered() []string
Registered returns the names of all compiled-in refreshers.
Types ¶
type Action ¶
type Action string
Action is what a Refresh did (or, in dry-run, would do).
const ( ActionRotated Action = "rotated" // exchanged for a new (rotated) token, persisted ActionRefreshed Action = "refreshed" // refreshed-in-place / minted, persisted ActionHealthy Action = "healthy" // token validated, nothing to persist ActionReauth Action = "reauth-required" // can't refresh; interactive re-auth needed ActionSkipped Action = "skipped" // nothing to do (e.g. not near expiry) )
type Constructor ¶
Constructor builds a Refresher from the config Store (it both reads current token/expiry via the Store's View and persists rotations via Apply) + the chosen write-back backend. Constructor builds a Refresher. It receives BOTH stores (spec 0042 §3.4): stores.Config for the platform wiring it reads, stores.Credentials() for any token it rotates. The unattended refresh path is exactly where a credential must not follow config routing into a committable project file.
type Refresher ¶
type Refresher interface {
Name() string
Refresh(ctx context.Context, dryRun bool) (Status, error)
}
Refresher refreshes/rotates one platform's tokens (or reports it cannot).
type Status ¶
type Status struct {
Platform string
Action Action
ExpiresAt time.Time // usable-/refresh-token expiry (zero if unknown)
ReauthBy time.Time // when interactive re-auth becomes necessary (non-refreshable)
Alert bool // surfaced to the notifier + a non-zero exit
Detail string
}
Status reports a platform's token health after a Refresh.
func Probe ¶ added in v0.22.0
func Probe(ctx context.Context, platform string, exp time.Time, check func(context.Context) error, rejected func(error) bool, reauth string) (Status, error)
Probe is a dry run's health check. It does not promise what a live run would do; it asks the platform whether the token is accepted now, so a dead token is reported before the unattended job that depends on it (spec 0010: a silently stale token is the top failure mode). check makes the cheapest authenticated call the platform has; rejected says whether its error means the token, as opposed to the network; reauth names the command to run.
Source Files