oidc

package module

Go to main page

Versions in this module

v0

v0.5.1

Mar 26, 2026

Changes in this version

+ const DefaultClientCacheTTL

type BinaryUUID

+ func (BinaryUUID) GormDBDataType(db *gorm.DB, _ *schema.Field) string

type DPoPClaims

+ ATH string

type DPoPProof

+ ATH string

type Hash256

+ func (Hash256) GormDBDataType(db *gorm.DB, _ *schema.Field) string

type SecretBytes

+ func (SecretBytes) GormDBDataType(db *gorm.DB, _ *schema.Field) string

+ func (s *SecretBytes) UnmarshalJSON(b []byte) error

type SecretString

+ func (SecretString) GormDBDataType(db *gorm.DB, _ *schema.Field) string

+ func (s *SecretString) UnmarshalJSON(b []byte) error

type StringSlice

+ func (StringSlice) GormDBDataType(db *gorm.DB, _ *schema.Field) string

type TieredStorage

+ ClientCacheTTL time.Duration

+ type TieredStorageOption func(*TieredStorage)

+ func WithClientCacheTTL(ttl time.Duration) TieredStorageOption

v0.5.0

Mar 23, 2026

v0.4.3

Mar 23, 2026

v0.4.2

Mar 18, 2026

Changes in this version

type RegisteredClient

+ func GetAndVerifyClient(ctx context.Context, storage ClientStorage, clientIDStr string) (RegisteredClient, error)

v0.4.1

Mar 17, 2026

v0.4.0

Mar 14, 2026

Changes in this version

+ type AMR = string

+ const AMR_Bio

+ const AMR_Email

+ const AMR_Face

+ const AMR_Fingerprint

+ const AMR_Geo

+ const AMR_HardwareKey

+ const AMR_Iris

+ const AMR_KBA

+ const AMR_MCA

+ const AMR_MFA

+ const AMR_OTP

+ const AMR_PIN

+ const AMR_Password

+ const AMR_PhishingResistant

+ const AMR_PoP

+ const AMR_Retina

+ const AMR_Risk

+ const AMR_SMS

+ const AMR_SmartCard

+ const AMR_SoftwareKey

+ const AMR_Tel

+ const AMR_UserPresence

+ const AMR_Voice

+ const AMR_WIA

type AccessTokenClaims

+ ACR string

+ AMR []AMR

+ AuthTime *jwt.NumericDate

type AuthCodeSession

+ SessionID string

type AuthorizeRequest

+ ACR string

+ ACRValues string

+ AMR []AMR

+ SessionID string

type ClientMetadata

+ BackchannelLogoutSessionRequired bool

+ BackchannelLogoutURI string

+ LogoutRedirectURIs StringSlice

+ func (c *ClientMetadata) GetBackchannelLogoutSessionRequired() bool

+ func (c *ClientMetadata) GetBackchannelLogoutURI() string

+ func (c *ClientMetadata) GetLogoutRedirectURIs() []string

type ClientRegistrationRequest

+ LogoutRedirectURIs []string

type ClientRegistrationResponse

+ LogoutRedirectURIs []string

type IDTokenClaims

+ SessionID string

type IssuerRequest

+ ACR string

+ AMR []AMR

+ SessionID string

+ type LogoutTokenClaims struct

+ Events map[string]interface{}

+ SessionID string

+ func (lc *LogoutTokenClaims) SignedString(method jwt.SigningMethod, privateKey crypto.PrivateKey) (string, error)

type PARRequest

+ ACR string

+ ACRValues string

+ AMR []AMR

type RefreshTokenSession

+ SessionID string

type RegisteredClient

+ GetBackchannelLogoutSessionRequired func() bool

+ GetBackchannelLogoutURI func() string

+ GetLogoutRedirectURIs func() []string

v0.3.10

Dec 30, 2025

v0.3.9

Dec 23, 2025

Changes in this version

+ func IsConfidentialClient(method string) bool

v0.3.8

Dec 22, 2025

v0.3.7

Dec 22, 2025

v0.3.6

Dec 20, 2025

v0.3.5

Dec 20, 2025

v0.3.4

Dec 20, 2025

v0.3.3

Dec 19, 2025

Changes in this version

+ type IntrospectionRequest struct

+ ClientID string

+ ClientSecret string

+ Token string

+ TokenTypeHint string

v0.3.2

Dec 18, 2025

Changes in this version

type ClientMetadata

+ func (c *ClientMetadata) Metadata() *ClientMetadata

type RegisteredClient

+ Metadata func() *ClientMetadata

v0.3.1

Dec 15, 2025

v0.3.0

Dec 11, 2025

Changes in this version

+ var ErrCannotRemoveActiveKey = errors.New("cannot remove active key")

+ var ErrCircuitBreakerOpen = errors.New("remote JWKS unavailable (circuit breaker open)")

+ var ErrDefaultPassword = errors.New("default password")

+ var ErrDeviceFlowNotSupported = errors.New("server does not support device flow")

+ var ErrEnvTokenSecretRequired = errors.New("env OIDC_TOKEN_SECRET is required")

+ var ErrHasherNotConfigured = errors.New("hasher not configured")

+ var ErrHasherRequired = errors.New("hasher implementation is required")

+ var ErrIntrospectionNotSupported = errors.New("server does not support introspection")

+ var ErrInvalidIdentifier = errors.New("invalid identifier")

+ var ErrInvalidJWKType = errors.New("invalid JWK type")

+ var ErrInvalidURNFormat = errors.New("invalid urn format")

+ var ErrIssuerURLRequired = errors.New("issuer url is required")

+ var ErrKIDEmpty = errors.New("kid cannot be empty")

+ var ErrKeyExpired = errors.New("key expired")

+ var ErrKeyInterfaceNotImplemented = errors.New("stored key does not implement Key interface")

+ var ErrKeyTooShort = errors.New("key must be at least 32 bytes")

+ var ErrMemoryProviderOnly = errors.New("operation only supported for MemoryKeyProvider")

+ var ErrMissingJWKFields = errors.New("missing JWK fields")

+ var ErrNoActiveKey = errors.New("no active key set")

+ var ErrNoActiveRefreshTokenKey = errors.New("hmac key check failed: no active key for refresh tokens")

+ var ErrNonceMismatch = errors.New("nonce mismatch")

+ var ErrPARNotSupported = errors.New("server does not support PAR")

+ var ErrRevocationNotSupported = errors.New("server does not support revocation")

+ var ErrRotationInProgress = errors.New("rotation already in progress by another instance")

+ var ErrSchedulerAlreadyStarted = errors.New("scheduler already started")

+ var ErrSecretHasherRequired = errors.New("secret hasher is required for confidential clients")

+ var ErrStorageRequired = errors.New("storage implementation is required")

+ var ErrUnparseableError = errors.New("request failed with unparseable error")

+ var ErrUserForbidden = errors.New("user forbidden")

+ var ErrUserNotConfirmed = errors.New("user not confirmed")

+ func RefreshTokenRevoke(ctx context.Context, storage TokenStorage, secretManager *SecretManager, ...) error

type AuthCodeSession

+ func (AuthCodeSession) TableName() string

type AuthCodeStorage

+ AuthCodeConsume func(ctx context.Context, code string) (*AuthCodeSession, error)

+ AuthCodeSave func(ctx context.Context, session *AuthCodeSession) error

type BinaryUUID

+ func NewBinaryUUID() (BinaryUUID, error)

type Client

+ func (c *Client) AccessTokenRevoke(ctx context.Context, token string, hint string) error

type ClientCache

+ ClientGetByID func(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ ClientInvalidate func(ctx context.Context, clientID BinaryUUID) error

+ ClientSave func(ctx context.Context, client RegisteredClient, ttl time.Duration) error

type ClientMetadata

+ IsConfidentialClient bool

+ UpdatedAt time.Time

+ func (ClientMetadata) TableName() string

+ func (c *ClientMetadata) Deserialize(data string) error

+ func (c *ClientMetadata) GetGrantTypes() []string

+ func (c *ClientMetadata) GetID() BinaryUUID

+ func (c *ClientMetadata) GetRedirectURIs() []string

+ func (c *ClientMetadata) GetScope() string

+ func (c *ClientMetadata) Serialize() (string, error)

+ func (c *ClientMetadata) ValidateSecret(ctx context.Context, hasher Hasher, secret string) error

type ClientRegistrationResponse

+ func ClientUpdate(ctx context.Context, storage ClientStorage, req *ClientUpdateRequest) (*ClientRegistrationResponse, error)

type ClientStorage

+ ClientCreate func(ctx context.Context, metadata *ClientMetadata) (RegisteredClient, error)

+ ClientDeleteByID func(ctx context.Context, clientID BinaryUUID) error

+ ClientGetByID func(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ ClientListAll func(ctx context.Context, query ListQuery) ([]RegisteredClient, error)

+ ClientListByOwner func(ctx context.Context, ownerID BinaryUUID) ([]RegisteredClient, error)

+ ClientUpdate func(ctx context.Context, clientID BinaryUUID, metadata *ClientMetadata) (RegisteredClient, error)

type DeviceCodeSession

+ func (DeviceCodeSession) TableName() string

type DeviceCodeStorage

+ DeviceCodeDelete func(ctx context.Context, deviceCode string) error

+ DeviceCodeGet func(ctx context.Context, deviceCode string) (*DeviceCodeSession, error)

+ DeviceCodeGetByUserCode func(ctx context.Context, userCode string) (*DeviceCodeSession, error)

+ DeviceCodeSave func(ctx context.Context, session *DeviceCodeSession) error

+ DeviceCodeUpdate func(ctx context.Context, deviceCode string, session *DeviceCodeSession) error

type Error

+ func ServerError(description string) *Error

type Issuer

+ func (g *Issuer) IssuePasswordResetAccessToken(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

type IssuerConfig

+ RefreshTokenGracePeriod time.Duration

+ type JWK struct

+ CreatedAt time.Time

+ JWK SecretString

+ KID string

type KeyManager

+ func (km *KeyManager) JWKGetSigning(ctx context.Context) (string, error)

type KeyStorage

+ JWKDelete func(ctx context.Context, kid string) error

+ JWKGet func(ctx context.Context, kid string) (jwk.Key, error)

+ JWKGetSigning func(ctx context.Context) (string, error)

+ JWKList func(ctx context.Context) ([]jwk.Key, error)

+ JWKMarkSigning func(ctx context.Context, kid string) error

+ JWKSave func(ctx context.Context, key jwk.Key) error

type PARStorage

+ PARSessionConsume func(ctx context.Context, requestURI string) (*AuthorizeRequest, error)

+ PARSessionSave func(ctx context.Context, requestURI string, req *AuthorizeRequest, ...) error

type Persistence

+ Close func()

type RefreshTokenSession

+ func (RefreshTokenSession) TableName() string

type RevocationStorage

+ AccessTokenIsRevoked func(ctx context.Context, jti string) (bool, error)

+ AccessTokenRevoke func(ctx context.Context, jti string, expiration time.Time) error

+ type SecretBytes []byte

+ func (s *SecretBytes) Scan(value interface{}) error

+ func (s SecretBytes) GoString() string

+ func (s SecretBytes) MarshalJSON() ([]byte, error)

+ func (s SecretBytes) String() string

+ func (s SecretBytes) Value() (driver.Value, error)

+ type SecretString string

+ func (s *SecretString) Scan(value interface{}) error

+ func (s SecretString) GoString() string

+ func (s SecretString) MarshalJSON() ([]byte, error)

+ func (s SecretString) String() string

+ func (s SecretString) Value() (driver.Value, error)

type Server

+ func (s *Server) ClientUpdate(ctx context.Context, req *ClientUpdateRequest) (*ClientRegistrationResponse, error)

type ServerConfig

+ RefreshTokenGracePeriod time.Duration

+ type StringSlice []string

+ func (ss *StringSlice) Scan(value interface{}) error

+ func (ss StringSlice) Value() (driver.Value, error)

type TieredStorage

+ func (s *TieredStorage) ClientCreate(ctx context.Context, metadata *ClientMetadata) (RegisteredClient, error)

+ func (s *TieredStorage) ClientDeleteByID(ctx context.Context, clientID BinaryUUID) error

+ func (s *TieredStorage) ClientGetByID(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ func (s *TieredStorage) ClientListAll(ctx context.Context, query ListQuery) ([]RegisteredClient, error)

+ func (s *TieredStorage) ClientListByOwner(ctx context.Context, ownerID BinaryUUID) ([]RegisteredClient, error)

+ func (s *TieredStorage) ClientUpdate(ctx context.Context, clientID BinaryUUID, metadata *ClientMetadata) (RegisteredClient, error)

+ func (s *TieredStorage) JWKDelete(ctx context.Context, kid string) error

+ func (s *TieredStorage) JWKGet(ctx context.Context, kid string) (jwk.Key, error)

+ func (s *TieredStorage) JWKGetSigning(ctx context.Context) (string, error)

+ func (s *TieredStorage) JWKList(ctx context.Context) ([]jwk.Key, error)

+ func (s *TieredStorage) JWKMarkSigning(ctx context.Context, kid string) error

+ func (s *TieredStorage) JWKSave(ctx context.Context, key jwk.Key) error

+ func (s *TieredStorage) RefreshTokenCreate(ctx context.Context, session *RefreshTokenSession) error

+ func (s *TieredStorage) RefreshTokenGet(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ func (s *TieredStorage) RefreshTokenRevoke(ctx context.Context, tokenID Hash256) error

+ func (s *TieredStorage) RefreshTokenRevokeUser(ctx context.Context, userID BinaryUUID) ([]Hash256, error)

+ func (s *TieredStorage) RefreshTokenRotate(ctx context.Context, oldTokenID Hash256, newSession *RefreshTokenSession, ...) error

type TokenCache

+ RefreshTokenGet func(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ RefreshTokenInvalidate func(ctx context.Context, tokenID Hash256) error

+ RefreshTokenRotate func(ctx context.Context, oldTokenID Hash256, newSession *RefreshTokenSession, ...) error

+ RefreshTokenSave func(ctx context.Context, session *RefreshTokenSession, ttl time.Duration) error

+ RefreshTokensInvalidate func(ctx context.Context, tokenIDs []Hash256) error

type TokenStorage

+ RefreshTokenCreate func(ctx context.Context, session *RefreshTokenSession) error

+ RefreshTokenGet func(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ RefreshTokenListByUser func(ctx context.Context, userID BinaryUUID) ([]*RefreshTokenSession, error)

+ RefreshTokenRevoke func(ctx context.Context, tokenID Hash256) error

+ RefreshTokenRevokeUser func(ctx context.Context, userID BinaryUUID) ([]Hash256, error)

+ RefreshTokenRotate func(ctx context.Context, oldTokenID Hash256, newSession *RefreshTokenSession, ...) error

type UserAuthenticator

+ AuthenticateByPassword func(ctx context.Context, username, password string) (BinaryUUID, error)

type UserInfo

+ Metadata map[string]interface{}

+ func (u *UserInfo) MarshalJSON() ([]byte, error)

+ func (u *UserInfo) UnmarshalJSON(data []byte) error

type UserInfoGetter

+ UserCreateInfo func(ctx context.Context, userInfo *UserInfo) error

+ UserGetInfoByID func(ctx context.Context, userID BinaryUUID, scopes []string) (*UserInfo, error)

v0.1.0

Nov 29, 2025

Changes in this version

+ const AuthMethodClientSecretBasic

+ const AuthMethodClientSecretPost

+ const CodeChallengeMethodPlain

+ const CodeChallengeMethodS256

+ const DefaultKeyCacheTTL

+ const DeviceCodeStatusAllowed

+ const DeviceCodeStatusDenied

+ const DeviceCodeStatusPending

+ const GrantTypeAuthorizationCode

+ const GrantTypeClientCredentials

+ const GrantTypeDeviceCode

+ const GrantTypePassword

+ const GrantTypeRefreshToken

+ const ResponseTypeCode

+ const ScopeEmail

+ const ScopeOfflineAccess

+ const ScopeOpenID

+ const ScopePhone

+ const ScopeProfile

+ const SubjectTypePublic

+ var AllowedSchemes = map[string]struct

+ var DefaultSupportedSigningAlgs = []string

+ var ErrAZPMismatch = errors.New("azp does not match client_id")

+ var ErrAZPNotAuthorized = errors.New("azp is not authorized to access resource")

+ var ErrAZPRequired = errors.New("azp claim is required when multiple audiences are present")

+ var ErrAZPRequiredForTrust = errors.New("azp claim is required for trusted client validation")

+ var ErrAccessDenied = errors.New("access_denied")

+ var ErrAuthorizationPending = errors.New("authorization_pending")

+ var ErrBinaryUUIDUnsupportedType = errors.New("BinaryUUID: cannot scan type")

+ var ErrCannotRemoveSigningKey = errors.New("cannot remove current signing key")

+ var ErrClientNotFound = errors.New("client not found")

+ var ErrCodeNotFound = errors.New("authorization code not found or consumed")

+ var ErrExpClaimRequired = errors.New("exp claim is required")

+ var ErrExpiredToken = errors.New("expired_token")

+ var ErrFailedToGenerateUUID = errors.New("failed to generate UUIDv7")

+ var ErrHash256InvalidLength = errors.New("Hash256 must be exactly 32 bytes")

+ var ErrHash256ScanInvalidLength = errors.New("scan failed: expected 32 bytes for Hash256")

+ var ErrHash256UnsupportedType = errors.New("scan failed: unsupported type for Hash256")

+ var ErrInvalidAudience = errors.New("invalid audience")

+ var ErrInvalidClient = errors.New("invalid_client")

+ var ErrInvalidEd25519KeySize = errors.New("invalid Ed25519 private key size")

+ var ErrInvalidEd25519PublicKeySize = errors.New("invalid Ed25519 public key size")

+ var ErrInvalidGrant = errors.New("invalid_grant")

+ var ErrInvalidHexStringLength = errors.New("invalid hex string length")

+ var ErrInvalidIssuer = errors.New("invalid issuer")

+ var ErrInvalidIssuerURL = errors.New("issuer must be a valid URL")

+ var ErrInvalidNonce = errors.New("invalid nonce")

+ var ErrInvalidRSAKey = errors.New("invalid RSA private key")

+ var ErrInvalidRequest = errors.New("invalid_request")

+ var ErrInvalidScope = errors.New("invalid_scope")

+ var ErrInvalidTTL = errors.New("token TTL must be greater than 0")

+ var ErrIssuerEmpty = errors.New("issuer cannot be empty")

+ var ErrKeyManagerNil = errors.New("keyManager cannot be nil")

+ var ErrKeyNil = errors.New("key cannot be nil")

+ var ErrKeyNotEC = errors.New("key is not EC")

+ var ErrKeyNotEd25519 = errors.New("key is not Ed25519")

+ var ErrKeyNotFound = errors.New("key not found")

+ var ErrKeyNotRSA = errors.New("key is not RSA")

+ var ErrNoSigningKey = errors.New("no signing key configured")

+ var ErrNotFound = errors.New("resource not found")

+ var ErrPKCERandomnessGenerationFailed = errors.New("failed to generate randomness for pkce")

+ var ErrPKCEVerificationFailed = errors.New("pkce verification failed")

+ var ErrPKCEVerifierEmpty = errors.New("pkce verifier cannot be empty")

+ var ErrPKCEVerifierInvalidChars = errors.New("invalid characters in pkce verifier")

+ var ErrPKCEVerifierInvalidLength = errors.New("invalid pkce verifier length")

+ var ErrRSAKeyTooSmall = errors.New("RSA private key must be at least 2048 bits")

+ var ErrSecretManagerNil = errors.New("secretManager cannot be nil")

+ var ErrServerError = errors.New("server_error")

+ var ErrSigningKeyMissing = errors.New("current signing key is missing")

+ var ErrSlowDown = errors.New("slow_down")

+ var ErrTemporarilyUnavailable = errors.New("temporarily_unavailable")

+ var ErrTokenExpired = errors.New("token is expired")

+ var ErrTokenForged = errors.New("token forged")

+ var ErrTokenFormatInvalid = errors.New("token format is invalid")

+ var ErrTokenIsInvalid = errors.New("token is invalid")

+ var ErrTokenNotFound = errors.New("token not found or expired")

+ var ErrTokenRevoked = errors.New("token has been revoked")

+ var ErrTokenSignatureInvalid = errors.New("token signature is invalid")

+ var ErrUnauthorizedClient = errors.New("unauthorized_client")

+ var ErrUnexpectedSigningMethod = errors.New("unexpected signing method")

+ var ErrUnsupportedAlgForHash = errors.New("unsupported alg for hash calculation")

+ var ErrUnsupportedCurve = errors.New("jwks: unsupported curve")

+ var ErrUnsupportedECDSACurve = errors.New("unsupported ECDSA curve")

+ var ErrUnsupportedGrantType = errors.New("unsupported_grant_type")

+ var ErrUnsupportedJWKPublicKeyType = errors.New("jwks: unsupported key type")

+ var ErrUnsupportedKeyType = errors.New("unsupported key type")

+ var ErrUnsupportedKtyForThumbprint = errors.New("unsupported kty for thumbprint")

+ var ErrUnsupportedPKCEChallengeMethod = errors.New("unsupported pkce challenge method")

+ var ErrUnsupportedPrivateKeyType = errors.New("unsupported private key type")

+ var ErrUnsupportedSigningKeyType = errors.New("unsupported signing key type")

+ var ErrUserIDRequired = errors.New("user_id is required to generate authorization code")

+ var ErrUserNotFound = errors.New("user not found")

+ func BuildDPoPBoundAccessTokenURI(fullURL string) (string, error)

+ func BuildRedirectURL(baseURI, code, state string) (string, error)

+ func BuildRequestURI(r *http.Request) string

+ func ComputeJKT(jwk map[string]interface{}) (string, error)

+ func ComputePKCEChallenge(method, verifier string) (string, error)

+ func DPoPMiddleware(cache ReplayCache, required bool) func(http.Handler) http.Handler

+ func DPoPOptionalMiddleware(cache ReplayCache) func(http.Handler) http.Handler

+ func DPoPProtectedEndpoints() []string

+ func DPoPRequiredMiddleware(cache ReplayCache) func(http.Handler) http.Handler

+ func DecodeJSON(r io.Reader, v any) error

+ func DeviceAuthorized(ctx context.Context, storage Storage, req *DeviceAuthorizedRequest) error

+ func DeviceDenied(ctx context.Context, storage Storage, userCode string) error

+ func EndSession(ctx context.Context, storage Storage, verifier TokenVerifier, ...) (string, error)

+ func ExtractDPoPJKT(ctx context.Context) string

+ func GeneratePKCEVerifier() (string, error)

+ func GetSigningMethod(key crypto.PrivateKey) jwt.SigningMethod

+ func Hash(method jwt.SigningMethod, str string) (string, error)

+ func LoadTokenSecret() ([]byte, error)

+ func ParseECDSAPublicKeyFromJWK(jwk *JSONWebKey) (*ecdsa.PublicKey, error)

+ func ParseEd25519PublicKeyFromJWK(jwk *JSONWebKey) (ed25519.PublicKey, error)

+ func ParseRSAPublicKeyFromJWK(jwk *JSONWebKey) (*rsa.PublicKey, error)

+ func RandomString(n int) (string, error)

+ func RegisterMetrics()

+ func ResponseAuthorized(ctx context.Context, storage AuthCodeStorage, req *AuthorizeRequest, ...) (string, error)

+ func RevokeAccessToken(ctx context.Context, storage RevocationStorage, verifier TokenVerifier, ...) error

+ func RevokeRefreshToken(ctx context.Context, storage TokenStorage, secretManager *SecretManager, ...) error

+ func RevokeToken(ctx context.Context, storage Storage, secretManager *SecretManager, ...) error

+ func SaveKey(path string, key Key, password []byte) error

+ func SetServerTimeHeader(w http.ResponseWriter)

+ func ShouldUseDPoP(path string) bool

+ func UnregisterClient(ctx context.Context, storage ClientStorage, clientIDStr string) error

+ func ValidateKeySecurity(key Key) error

+ func ValidateRegistrationRequest(req *ClientRegistrationRequest, allowedSchemes map[string]struct{}) error

+ func ValidateScopes(allowedScopeStr, requestedScopeStr string) error

+ func ValidateStructuredRefreshToken(ctx context.Context, sm *SecretManager, token RefreshToken) error

+ func ValidateURN(uri string) error

+ func VerifyDPoPProof(ctx context.Context, req *http.Request, w http.ResponseWriter, ...) (jkt string, err error)

+ func VerifyPKCE(challenge, method, verifier string) error

+ type AccessToken String

+ func (ac AccessToken) Hash(alg jwt.SigningMethod) (string, error)

+ type AccessTokenClaims struct

+ AuthorizedParty string

+ Confirmation map[string]interface{}

+ Scope string

+ func (ac *AccessTokenClaims) SignedString(method jwt.SigningMethod, privateKey crypto.PrivateKey) (AccessToken, error)

+ type AuthCodeOption func(url.Values)

+ func WithNonce(nonce string) AuthCodeOption

+ func WithPKCE(codeChallenge, codeChallengeMethod string) AuthCodeOption

+ type AuthCodeSession struct

+ ACR string

+ AMR []string

+ AuthTime time.Time

+ ClientID BinaryUUID

+ Code string

+ CodeChallenge string

+ CodeChallengeMethod string

+ DPoPJKT string

+ ExpiresAt time.Time

+ Nonce string

+ RedirectURI string

+ Scope string

+ UserID BinaryUUID

+ type AuthCodeStorage interface

+ LoadAndConsumeAuthCode func(ctx context.Context, code string) (*AuthCodeSession, error)

+ SaveAuthCode func(ctx context.Context, session *AuthCodeSession) error

+ type AuthorizeRequest struct

+ AuthTime time.Time

+ ClientID string

+ CodeChallenge string

+ CodeChallengeMethod string

+ DPoPJKT string

+ FinalScope string

+ Nonce string

+ RedirectURI string

+ RequestURI string

+ ResponseType string

+ Scope string

+ State string

+ UserID string

+ func LoadPARSession(ctx context.Context, storage PARStorage, requestURI string) (*AuthorizeRequest, error)

+ type BinaryUUID uuid.UUID

+ func ParseUUID(s string) (BinaryUUID, error)

+ func (BinaryUUID) GormDataType() string

+ func (b *BinaryUUID) Scan(value interface{}) error

+ func (b *BinaryUUID) UnmarshalJSON(data []byte) error

+ func (b BinaryUUID) MarshalJSON() ([]byte, error)

+ func (b BinaryUUID) String() string

+ func (b BinaryUUID) Value() (driver.Value, error)

+ type Bytes []byte

+ func (s *Bytes) Scan(value interface{}) error

+ func (s Bytes) GoString() string

+ func (s Bytes) MarshalJSON() ([]byte, error)

+ func (s Bytes) String() string

+ func (s Bytes) Value() (driver.Value, error)

+ type Cache interface

+ type Client struct

+ func NewClient(ctx context.Context, cfg ClientConfig, httpClient *http.Client) (*Client, error)

+ func (c *Client) AuthCodeURL(state string, opts ...AuthCodeOption) string

+ func (c *Client) ExchangeAuthorizationCode(ctx context.Context, code, codeVerifier string) (*Token, error)

+ func (c *Client) ExchangeClientCredentials(ctx context.Context, scope ...string) (*Token, error)

+ func (c *Client) ExchangeRefreshToken(ctx context.Context, refreshToken string) (*Token, error)

+ func (c *Client) GeneratePKCE() (verifier, challenge string, err error)

+ func (c *Client) Introspect(ctx context.Context, token string) (*IntrospectionResponse, error)

+ func (c *Client) PollDeviceToken(ctx context.Context, deviceCode string, interval int) (*Token, error)

+ func (c *Client) PushAuthorize(ctx context.Context, state string, opts ...AuthCodeOption) (authURL string, requestURI string, err error)

+ func (c *Client) RequestDeviceAuthorization(ctx context.Context) (*DeviceAuthorizationResponse, error)

+ func (c *Client) Revoke(ctx context.Context, token string, hint string) error

+ func (c *Client) UserInfo(ctx context.Context, accessToken string) (*UserInfo, error)

+ func (c *Client) WithDPoP(key Key) *Client

+ type ClientCache interface

+ GetClient func(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ InvalidateClient func(ctx context.Context, clientID BinaryUUID) error

+ SaveClient func(ctx context.Context, client RegisteredClient, ttl time.Duration) error

+ type ClientConfig struct

+ ClientID string

+ ClientSecret string

+ Issuer string

+ RedirectURI string

+ Scopes []string

+ type ClientFactory interface

+ New func() RegisteredClient

+ type ClientMetadata struct

+ CreatedAt time.Time

+ GrantTypes []string

+ ID BinaryUUID

+ IsConfidential bool

+ LogoURI string

+ Name string

+ OwnerID BinaryUUID

+ RedirectURIs []string

+ Scope string

+ Secret String

+ TokenEndpointAuthMethod string

+ type ClientRegistrationRequest struct

+ ClientName string

+ ClientURI string

+ GrantTypes []string

+ LogoURI string

+ OwnerID string

+ RedirectURIs []string

+ ResponseTypes []string

+ Scope string

+ TokenEndpointAuthMethod string

+ type ClientRegistrationResponse struct

+ ClientID string

+ ClientName string

+ ClientSecret string

+ ClientSecretExpiresAt int64

+ GrantTypes []string

+ LogoURI string

+ RedirectURIs []string

+ RegistrationAccessToken string

+ RegistrationClientURI string

+ Scope string

+ TokenEndpointAuthMethod string

+ func RegisterClient(ctx context.Context, storage ClientStorage, hasher Hasher, ...) (*ClientRegistrationResponse, error)

+ func UpdateClient(ctx context.Context, storage ClientStorage, req *ClientUpdateRequest) (*ClientRegistrationResponse, error)

+ type ClientStorage interface

+ CreateClient func(ctx context.Context, metadata ClientMetadata) (RegisteredClient, error)

+ DeleteClient func(ctx context.Context, clientID BinaryUUID) error

+ GetClient func(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ ListClients func(ctx context.Context, query ListQuery) ([]RegisteredClient, error)

+ ListClientsByOwner func(ctx context.Context, ownerID BinaryUUID) ([]RegisteredClient, error)

+ UpdateClient func(ctx context.Context, clientID BinaryUUID, metadata ClientMetadata) (RegisteredClient, error)

+ type ClientUpdateRequest struct

+ ClientID string

+ type ClientVerifier struct

+ func NewClientVerifier(issuer, clientID string, keySet KeySource) *ClientVerifier

+ func (v *ClientVerifier) SetSupportedSigningAlgs(algs []string)

+ func (v *ClientVerifier) Verify(ctx context.Context, rawToken string) (*IDTokenClaims, error)

+ type Code String

+ func (c Code) Hash(alg jwt.SigningMethod) (string, error)

+ type DPoPClaims struct

+ JKT string

+ func DPoPFromContext(ctx context.Context) (*DPoPClaims, bool)

+ type DPoPProof struct

+ HTM string

+ HTU string

+ Nonce string

+ type DPoPTimeSkewError struct

+ Err error

+ Info DPoPTimeSkewInfo

+ func (e *DPoPTimeSkewError) Error() string

+ func (e *DPoPTimeSkewError) Unwrap() error

+ type DPoPTimeSkewInfo struct

+ ClientTime time.Time

+ ServerTime time.Time

+ Skew time.Duration

+ func (d DPoPTimeSkewInfo) String() string

+ type DeviceAuthorizationRequest struct

+ ClientID string

+ Scope string

+ type DeviceAuthorizationResponse struct

+ DeviceCode string

+ ExpiresIn int

+ Interval int

+ UserCode string

+ VerificationURI string

+ func DeviceAuthorization(ctx context.Context, storage Storage, issuer string, ...) (*DeviceAuthorizationResponse, error)

+ type DeviceAuthorizedRequest struct

+ ClientID string

+ FinalScope string

+ UserCode string

+ UserID string

+ type DeviceCodeSession struct

+ AuthTime time.Time

+ AuthorizedScope string

+ ClientID BinaryUUID

+ DeviceCode string

+ ExpiresAt time.Time

+ LastPolled time.Time

+ Scope string

+ Status string

+ UserCode string

+ UserID BinaryUUID

+ type DeviceCodeStorage interface

+ GetDeviceCodeSession func(ctx context.Context, deviceCode string) (*DeviceCodeSession, error)

+ GetDeviceCodeSessionByUserCode func(ctx context.Context, userCode string) (*DeviceCodeSession, error)

+ RemoveDeviceCodeSession func(ctx context.Context, deviceCode string) error

+ SaveDeviceCode func(ctx context.Context, session *DeviceCodeSession) error

+ UpdateDeviceCodeSession func(ctx context.Context, deviceCode string, session *DeviceCodeSession) error

+ type Discovery struct

+ AuthorizationEndpoint string

+ ClaimsSupported []string

+ CodeChallengeMethodsSupported []string

+ DeviceAuthorizationEndpoint string

+ EndSessionEndpoint string

+ GrantTypesSupported []string

+ IDTokenSigningAlgValuesSupported []string

+ IntrospectionEndpoint string

+ Issuer string

+ JWKSURI string

+ PushedAuthorizationRequestEndpoint string

+ RegistrationEndpoint string

+ ResponseModesSupported []string

+ ResponseTypesSupported []string

+ RevocationEndpoint string

+ ScopesSupported []string

+ SubjectTypesSupported []string

+ TokenEndpoint string

+ TokenEndpointAuthMethodsSupported []string

+ UserInfoEndpoint string

+ func Discover(ctx context.Context, issuer string, httpClient *http.Client) (*Discovery, error)

+ type DistributedLock interface

+ Lock func(ctx context.Context, key string, ttl time.Duration) (bool, error)

+ Unlock func(ctx context.Context, key string) error

+ type DpopContextKey struct

+ type EndSessionRequest struct

+ AccessToken string

+ IDTokenHint string

+ PostLogoutRedirectURI string

+ State string

+ type Error struct

+ Code string

+ Description string

+ StatusCode int

+ func AccessDeniedError(description string) *Error

+ func AuthorizationPendingError(description string) *Error

+ func ExpiredTokenError(description string) *Error

+ func InvalidClientError(description string) *Error

+ func InvalidGrantError(description string) *Error

+ func InvalidRequestError(description string) *Error

+ func InvalidScopeError(description string) *Error

+ func NewError(code string, description string, statusCode int) *Error

+ func ServerErrorWithDescription(description string) *Error

+ func SlowDownError(description string) *Error

+ func TemporarilyUnavailableError(description string) *Error

+ func UnauthorizedClientError(description string) *Error

+ func UnsupportedGrantTypeError(description string) *Error

+ func (e *Error) BizStatus() string

+ func (e *Error) Error() string

+ func (e *Error) HTTPStatus() int

+ func (e *Error) PublicMessage() string

+ type GCWorker struct

+ func NewGCWorker(persistence Persistence, interval time.Duration) *GCWorker

+ func (w *GCWorker) Start(ctx context.Context)

+ func (w *GCWorker) Stop()

+ type Hash256 []byte

+ func (Hash256) GormDataType() string

+ func (h *Hash256) Scan(value interface{}) error

+ func (h *Hash256) UnmarshalJSON(data []byte) error

+ func (h Hash256) MarshalJSON() ([]byte, error)

+ func (h Hash256) String() string

+ func (h Hash256) Value() (driver.Value, error)

+ type Hasher interface

+ Compare func(ctx context.Context, hashedPassword []byte, password []byte) error

+ Hash func(ctx context.Context, password []byte) ([]byte, error)

+ type IDToken String

+ type IDTokenClaims struct

+ AtHash string

+ AuthTime int64

+ AuthorizedParty string

+ CHash string

+ Email *string

+ EmailVerified *bool

+ Name *string

+ Nonce string

+ PhoneNumber *string

+ PhoneNumberVerified *bool

+ Picture *string

+ PreferredUsername *string

+ func (ic *IDTokenClaims) SignedString(method jwt.SigningMethod, privateKey crypto.PrivateKey) (IDToken, error)

+ type IntrospectionResponse struct

+ Active bool

+ Aud string

+ ClientID string

+ Cnf map[string]interface{}

+ Exp int64

+ Iat int64

+ Iss string

+ Jti string

+ Nbf int64

+ Scope string

+ Sub string

+ TokenType string

+ Username string

+ func Introspect(ctx context.Context, storage Storage, verifier TokenVerifier, ...) (*IntrospectionResponse, error)

+ type Issuer struct

+ func NewIssuer(cfg IssuerConfig, keyManager *KeyManager) (*Issuer, error)

+ func (g *Issuer) IssueClientCredentialsToken(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

+ func (g *Issuer) IssueOAuthTokens(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

+ func (g *Issuer) IssueOIDCTokens(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

+ func (g *Issuer) RefreshOAuthTokens(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

+ func (g *Issuer) RefreshOIDCTokens(ctx context.Context, req *IssuerRequest) (*IssuerResponse, error)

+ func (i *Issuer) Issuer() string

+ func (i *Issuer) SecretManager() *SecretManager

+ type IssuerConfig struct

+ AccessTokenTTL time.Duration

+ IDTokenTTL time.Duration

+ Issuer string

+ RefreshTokenTTL time.Duration

+ SecretManager *SecretManager

+ type IssuerRequest struct

+ AccessTokenDuration time.Duration

+ Audience []string

+ AuthTime time.Time

+ ClientID BinaryUUID

+ Code Code

+ DPoPJKT string

+ Email *string

+ EmailVerified *bool

+ IDTokenDuration time.Duration

+ Name *string

+ Nonce string

+ PhoneNumber *string

+ PhoneNumberVerified *bool

+ Picture *string

+ PreferredUsername *string

+ RefreshTokenDuration time.Duration

+ Scopes string

+ UserID BinaryUUID

+ type IssuerResponse struct

+ AccessToken string

+ ExpiresIn int64

+ IDToken string

+ RefreshToken string

+ Scope string

+ TokenType string

+ func DeviceTokenExchange(ctx context.Context, storage Storage, issuer *Issuer, req *TokenRequest) (*IssuerResponse, error)

+ func ExchangeClientCredentials(ctx context.Context, storage ClientStorage, hasher Hasher, issuer *Issuer, ...) (*IssuerResponse, error)

+ func ExchangeCode(ctx context.Context, storage Storage, hasher Hasher, issuer *Issuer, ...) (*IssuerResponse, error)

+ func PasswordGrant(ctx context.Context, storage Storage, hasher Hasher, issuer *Issuer, ...) (*IssuerResponse, error)

+ func RefreshTokens(ctx context.Context, storage Storage, secretManager *SecretManager, ...) (*IssuerResponse, error)

+ type JSONWebKey struct

+ Alg string

+ Crv string

+ E string

+ Kid string

+ Kty string

+ N string

+ Use string

+ X string

+ Y string

+ func PublicKeyToJWK(pub crypto.PublicKey, kid, alg string) (JSONWebKey, error)

+ func (jwk *JSONWebKey) Thumbprint() (string, error)

+ type JSONWebKeySet struct

+ Keys []JSONWebKey

+ type Key interface

+ Equal func(x crypto.PrivateKey) bool

+ Public func() crypto.PublicKey

+ Sign func(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

+ func LoadKey(path string, password []byte) (Key, error)

+ func LoadOrGenerateKey(path string, keyType KeyType, password []byte) (Key, error)

+ func NewKey(keyType KeyType) (key Key, err error)

+ type KeyManager struct

+ func NewKeyManager(storage KeyStorage, cacheTTL time.Duration) *KeyManager

+ func (km *KeyManager) Add(ctx context.Context, key Key) (string, error)

+ func (km *KeyManager) ExportJWKS(ctx context.Context) (*JSONWebKeySet, error)

+ func (km *KeyManager) Generate(ctx context.Context, kty KeyType, setAsSigning bool) (string, error)

+ func (km *KeyManager) GetKey(ctx context.Context, kid string) (crypto.PublicKey, error)

+ func (km *KeyManager) GetKeyInternal(ctx context.Context, kid string) (Key, error)

+ func (km *KeyManager) GetSigningKey(ctx context.Context) (string, Key, error)

+ func (km *KeyManager) GetSigningKeyID(ctx context.Context) (string, error)

+ func (km *KeyManager) ListKeys(ctx context.Context) ([]string, error)

+ func (km *KeyManager) RemoveKey(ctx context.Context, kid string) error

+ func (km *KeyManager) SetSigningKeyID(ctx context.Context, kid string) error

+ type KeyProvider interface

+ GetActiveKey func(ctx context.Context) (string, []byte, error)

+ GetKey func(ctx context.Context, kid string) ([]byte, error)

+ ListKeys func(ctx context.Context) (map[string][]byte, error)

+ type KeyRotationConfig struct

+ CleanupInterval time.Duration

+ EnableAutoRotate bool

+ GracePeriod time.Duration

+ KeyType KeyType

+ RotationInterval time.Duration

+ type KeyRotationScheduler struct

+ func NewKeyRotationScheduler(manager *KeyManager, lock DistributedLock, config KeyRotationConfig) *KeyRotationScheduler

+ func (s *KeyRotationScheduler) GetCurrentKeyID() string

+ func (s *KeyRotationScheduler) GetPendingDeletes() map[string]time.Time

+ func (s *KeyRotationScheduler) RotateNow(ctx context.Context) error

+ func (s *KeyRotationScheduler) Start(ctx context.Context) error

+ func (s *KeyRotationScheduler) Stop()

+ type KeySource interface

+ GetKey func(ctx context.Context, kid string) (crypto.PublicKey, error)

+ type KeyStorage interface

+ Delete func(ctx context.Context, kid string) error

+ Get func(ctx context.Context, kid string) (jwk.Key, error)

+ GetSigningKeyID func(ctx context.Context) (string, error)

+ List func(ctx context.Context) ([]jwk.Key, error)

+ Save func(ctx context.Context, key jwk.Key) error

+ SaveSigningKeyID func(ctx context.Context, kid string) error

+ type KeyType string

+ const KEY_Default

+ const KEY_ECDSA

+ const KEY_Ed25519

+ const KEY_RSA

+ type ListQuery struct

+ Limit int

+ Offset int

+ type MemoryKeyProvider struct

+ func NewMemoryKeyProvider() *MemoryKeyProvider

+ func (m *MemoryKeyProvider) AddKey(kid string, key []byte) error

+ func (m *MemoryKeyProvider) CleanupExpiredKeys(ctx context.Context) int

+ func (m *MemoryKeyProvider) GetActiveKey(ctx context.Context) (string, []byte, error)

+ func (m *MemoryKeyProvider) GetKey(ctx context.Context, kid string) ([]byte, error)

+ func (m *MemoryKeyProvider) ListKeys(ctx context.Context) (map[string][]byte, error)

+ func (m *MemoryKeyProvider) RemoveKey(kid string) error

+ func (m *MemoryKeyProvider) RotateKey(newKID string, newKey []byte, gracePeriod time.Duration) error

+ func (m *MemoryKeyProvider) SetActiveKey(kid string) error

+ type PARRequest struct

+ AdditionalParams map[string]string

+ ClientID string

+ ClientSecret string

+ CodeChallenge string

+ CodeChallengeMethod string

+ DPoPJKT string

+ Nonce string

+ RedirectURI string

+ ResponseType string

+ Scope string

+ State string

+ type PARResponse struct

+ ExpiresIn int

+ RequestURI string

+ func PushedAuthorization(ctx context.Context, storage Storage, hasher Hasher, req *PARRequest) (*PARResponse, error)

+ type PARStorage interface

+ GetAndDeletePARSession func(ctx context.Context, requestURI string) (*AuthorizeRequest, error)

+ SavePARSession func(ctx context.Context, requestURI string, req *AuthorizeRequest, ...) error

+ type Persistence interface

+ Cleanup func(ctx context.Context) (deleted int64, err error)

+ type RefreshToken String

+ func IssueStructuredRefreshToken(ctx context.Context, sm *SecretManager, userID string, ttl time.Duration) (RefreshToken, error)

+ func (t RefreshToken) HashForDB() Hash256

+ type RefreshTokenSession struct

+ ACR string

+ AMR []string

+ AuthTime time.Time

+ ClientID BinaryUUID

+ ExpiresAt time.Time

+ ID Hash256

+ Nonce string

+ Scope string

+ UserID BinaryUUID

+ type RegisteredClient interface

+ Deserialize func(string) error

+ GetGrantTypes func() []string

+ GetID func() BinaryUUID

+ GetRedirectURIs func() []string

+ GetScope func() string

+ IsConfidential func() bool

+ Serialize func() (string, error)

+ ValidateSecret func(ctx context.Context, hasher Hasher, secret string) error

+ func AuthenticateClient(ctx context.Context, storage ClientStorage, clientIDStr, clientSecret string, ...) (RegisteredClient, error)

+ func ListClient(ctx context.Context, storage ClientStorage, query ListQuery) ([]RegisteredClient, error)

+ func RequestAuthorize(ctx context.Context, storage Storage, req *AuthorizeRequest) (RegisteredClient, error)

+ type RemoteKeySet struct

+ func NewRemoteKeySet(ctx context.Context, jwksURI string, httpClient *http.Client, ...) *RemoteKeySet

+ func (r *RemoteKeySet) GetKey(ctx context.Context, kid string) (crypto.PublicKey, error)

+ func (r *RemoteKeySet) Stop()

+ type RemoteKeySetOption func(*RemoteKeySet)

+ func WithCacheDuration(d time.Duration) RemoteKeySetOption

+ type ReplayCache interface

+ CheckAndStore func(ctx context.Context, jti string, ttl time.Duration) (bool, error)

+ type ResourceVerifier struct

+ func NewResourceVerifier(issuer, resourceURI string, keySet KeySource, trustedClients []string) *ResourceVerifier

+ func (v *ResourceVerifier) SetSupportedSigningAlgs(algs []string)

+ func (v *ResourceVerifier) Verify(ctx context.Context, rawToken string) (*AccessTokenClaims, error)

+ type RevocationRequest struct

+ ClientID string

+ ClientSecret string

+ Token string

+ TokenTypeHint string

+ type RevocationStorage interface

+ IsRevoked func(ctx context.Context, jti string) (bool, error)

+ Revoke func(ctx context.Context, jti string, expiration time.Time) error

+ type SecretManager struct

+ func NewSecretManager() *SecretManager

+ func NewSecretManagerWithProvider(provider KeyProvider) *SecretManager

+ func (s *SecretManager) AddKey(id string, hexSecret string) error

+ func (s *SecretManager) CleanupExpiredKeys() (int, error)

+ func (s *SecretManager) GetSigningKey(ctx context.Context) ([]byte, string)

+ func (s *SecretManager) GetVerificationKey(ctx context.Context, kid string) ([]byte, error)

+ func (s *SecretManager) RotateKey(newKID string, newHexSecret string, gracePeriod time.Duration) error

+ func (s *SecretManager) SetActiveKey(kid string) error

+ type Server struct

+ func NewServer(cfg ServerConfig) (*Server, error)

+ func (s *Server) Config() *ServerConfig

+ func (s *Server) DeviceAuthorization(ctx context.Context, req *DeviceAuthorizationRequest) (*DeviceAuthorizationResponse, error)

+ func (s *Server) Discovery() *Discovery

+ func (s *Server) EndSession(ctx context.Context, req *EndSessionRequest) (string, error)

+ func (s *Server) Exchange(ctx context.Context, req *TokenRequest) (resp *IssuerResponse, err error)

+ func (s *Server) GetUserInfo(ctx context.Context, claims *AccessTokenClaims) (*UserInfo, error)

+ func (s *Server) Introspect(ctx context.Context, tokenStr, clientIDStr, clientSecret string) (*IntrospectionResponse, error)

+ func (s *Server) Issuer() *Issuer

+ func (s *Server) KeyManager() *KeyManager

+ func (s *Server) ListClient(ctx context.Context, query ListQuery) ([]RegisteredClient, error)

+ func (s *Server) ParseAccessToken(ctx context.Context, tokenStr string) (*AccessTokenClaims, error)

+ func (s *Server) PushedAuthorization(ctx context.Context, req *PARRequest) (*PARResponse, error)

+ func (s *Server) RegisterClient(ctx context.Context, req *ClientRegistrationRequest) (*ClientRegistrationResponse, error)

+ func (s *Server) RequestAuthorize(ctx context.Context, req *AuthorizeRequest) (client RegisteredClient, err error)

+ func (s *Server) ResponseAuthorized(ctx context.Context, req *AuthorizeRequest) (redirectURL string, err error)

+ func (s *Server) RevokeToken(ctx context.Context, req *RevocationRequest) error

+ func (s *Server) SecretManager() *SecretManager

+ func (s *Server) StartBackgroundWorkers(ctx context.Context)

+ func (s *Server) StopBackgroundWorkers()

+ func (s *Server) UnregisterClient(ctx context.Context, clientIDStr string) error

+ func (s *Server) UpdateClient(ctx context.Context, req *ClientUpdateRequest) (*ClientRegistrationResponse, error)

+ func (s *Server) ValidateKeys(ctx context.Context) error

+ func (s *Server) VerifyAccessToken(ctx context.Context, tokenStr string) (*AccessTokenClaims, error)

+ type ServerConfig struct

+ AccessTokenTTL time.Duration

+ CodeTTL time.Duration

+ EnableGC bool

+ GCInterval time.Duration

+ Hasher Hasher

+ IDTokenTTL time.Duration

+ Issuer string

+ RefreshTokenTTL time.Duration

+ SecretManager *SecretManager

+ Storage Storage

+ SupportedSigningAlgs []string

+ type StaticKeySet struct

+ Keys map[string]crypto.PublicKey

+ func NewStaticKeySet() *StaticKeySet

+ func (s *StaticKeySet) Add(kid string, pub crypto.PublicKey)

+ func (s *StaticKeySet) GetKey(ctx context.Context, kid string) (crypto.PublicKey, error)

+ type Storage interface

+ type String string

+ func (s *String) Scan(value interface{}) error

+ func (s String) GoString() string

+ func (s String) MarshalJSON() ([]byte, error)

+ func (s String) String() string

+ func (s String) Value() (driver.Value, error)

+ type TieredStorage struct

+ func NewTieredStorage(db Persistence, cache Cache) *TieredStorage

+ func (s *TieredStorage) CreateClient(ctx context.Context, metadata ClientMetadata) (RegisteredClient, error)

+ func (s *TieredStorage) CreateRefreshToken(ctx context.Context, session *RefreshTokenSession) error

+ func (s *TieredStorage) Delete(ctx context.Context, kid string) error

+ func (s *TieredStorage) DeleteClient(ctx context.Context, clientID BinaryUUID) error

+ func (s *TieredStorage) Get(ctx context.Context, kid string) (jwk.Key, error)

+ func (s *TieredStorage) GetClient(ctx context.Context, clientID BinaryUUID) (RegisteredClient, error)

+ func (s *TieredStorage) GetRefreshToken(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ func (s *TieredStorage) GetSigningKeyID(ctx context.Context) (string, error)

+ func (s *TieredStorage) List(ctx context.Context) ([]jwk.Key, error)

+ func (s *TieredStorage) ListClients(ctx context.Context, query ListQuery) ([]RegisteredClient, error)

+ func (s *TieredStorage) ListClientsByOwner(ctx context.Context, ownerID BinaryUUID) ([]RegisteredClient, error)

+ func (s *TieredStorage) RevokeRefreshToken(ctx context.Context, tokenID Hash256) error

+ func (s *TieredStorage) RevokeTokensForUser(ctx context.Context, userID BinaryUUID) ([]Hash256, error)

+ func (s *TieredStorage) RotateRefreshToken(ctx context.Context, oldTokenID Hash256, newSession *RefreshTokenSession) error

+ func (s *TieredStorage) Save(ctx context.Context, key jwk.Key) error

+ func (s *TieredStorage) SaveSigningKeyID(ctx context.Context, kid string) error

+ func (s *TieredStorage) UpdateClient(ctx context.Context, clientID BinaryUUID, metadata ClientMetadata) (RegisteredClient, error)

+ type Token struct

+ AccessToken string

+ ExpiresIn int

+ Expiry time.Time

+ IDToken string

+ IDTokenClaims *IDTokenClaims

+ RefreshToken string

+ Scope string

+ TokenType string

+ type TokenCache interface

+ GetRefreshToken func(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ InvalidateRefreshToken func(ctx context.Context, tokenID Hash256) error

+ InvalidateRefreshTokens func(ctx context.Context, tokenIDs []Hash256) error

+ SaveRefreshToken func(ctx context.Context, session *RefreshTokenSession, ttl time.Duration) error

+ type TokenRequest struct

+ ClientID string

+ ClientSecret string

+ Code string

+ CodeVerifier string

+ DPoPJKT string

+ DeviceCode string

+ GrantType string

+ Password string

+ RedirectURI string

+ RefreshToken string

+ Scope string

+ Username string

+ type TokenRotationStorage interface

+ IsInGracePeriod func(ctx context.Context, tokenID Hash256) (bool, error)

+ MarkRefreshTokenAsRotating func(ctx context.Context, tokenID Hash256, gracePeriod time.Duration) error

+ type TokenStorage interface

+ CreateRefreshToken func(ctx context.Context, session *RefreshTokenSession) error

+ GetRefreshToken func(ctx context.Context, tokenID Hash256) (*RefreshTokenSession, error)

+ RevokeRefreshToken func(ctx context.Context, tokenID Hash256) error

+ RevokeTokensForUser func(ctx context.Context, userID BinaryUUID) ([]Hash256, error)

+ RotateRefreshToken func(ctx context.Context, oldTokenID Hash256, newSession *RefreshTokenSession) error

+ type TokenVerifier interface

+ ParseAccessToken func(ctx context.Context, tokenStr string) (*AccessTokenClaims, error)

+ VerifyAccessToken func(ctx context.Context, tokenStr string) (*AccessTokenClaims, error)

+ type UserAuthenticator interface

+ GetUser func(ctx context.Context, username, password string) (BinaryUUID, error)

+ type UserInfo struct

+ Birthdate *string

+ Email *string

+ EmailVerified *bool

+ FamilyName *string

+ Gender *string

+ GivenName *string

+ Locale *string

+ Name *string

+ Nickname *string

+ PhoneNumber *string

+ PhoneNumberVerified *bool

+ Picture *string

+ PreferredUsername *string

+ Profile *string

+ Subject string

+ UpdatedAt int64

+ Website *string

+ Zoneinfo *string

+ func GetUserInfo(ctx context.Context, storage UserInfoGetter, verifier TokenVerifier, ...) (*UserInfo, error)

+ type UserInfoGetter interface

+ CreateUserInfo func(ctx context.Context, userInfo *UserInfo) error

+ GetUserInfo func(ctx context.Context, userID BinaryUUID, scopes []string) (*UserInfo, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL