auth

package
v0.1.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 3, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrNoToken      = errors.New("not authenticated; run 'slack-wait login'")
	ErrTokenExpired = errors.New("refresh token expired; run 'slack-wait login'")
)

Functions

func Challenge

func Challenge(verifier string) string

Challenge derives the code_challenge from a verifier using S256.

func Delete

func Delete() error

func GenerateVerifier

func GenerateVerifier() (string, error)

GenerateVerifier creates a PKCE code_verifier (43 URL-safe chars, per RFC 7636).

func Save

func Save(t *Token) error

Types

type Session added in v0.1.2

type Session struct {
	// contains filtered or unexported fields
}

Session keeps the active token in process memory and refreshes it on demand. The access token never touches the keyring for rotating apps; only the rotating refresh token is persisted, so a long-running `wait` can keep refreshing the access token transparently while it waits.

func NewSession added in v0.1.2

func NewSession(clientID string) (*Session, error)

NewSession loads the stored credentials and prepares an in-memory session.

func (*Session) Token added in v0.1.2

func (s *Session) Token() (string, error)

Token returns a currently-valid access token, refreshing transparently when the cached one is missing or close to expiry. The rotated refresh token is persisted on every refresh so the next run can authenticate without a browser. Safe for concurrent use.

type Token

type Token struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	ExpiresAt    time.Time `json:"expires_at"`
}

Token holds the Slack OAuth credentials. The access token and its expiry are kept in process memory only; see persisted for what is actually written to the keyring.

func ExchangeCode

func ExchangeCode(clientID, code, verifier, redirectURI string) (*Token, error)

ExchangeCode trades an authorization code (plus PKCE verifier) for a token. No client_secret is sent; this is a public-client flow.

func Load

func Load() (*Token, error)

func Refresh

func Refresh(clientID, refreshToken string) (*Token, error)

Refresh exchanges a refresh_token for a new token pair.

func (*Token) Valid

func (t *Token) Valid() bool

Valid reports whether the access token is usable (present and not expiring within 5 minutes). A zero ExpiresAt means the token has no known expiry (non-rotating app). An empty AccessToken is never valid — this is the state of a freshly loaded rotating token, which must be refreshed before use.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
⌂ 换网址