Add oidcauth package - #48
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
firecow
force-pushed
the
add-oidcauth-package
branch
9 times, most recently
from
August 5, 2026 08:29
20e2937 to
09f67c7
Compare
Authorization code flow with PKCE against an OIDC provider, with the verified id token kept in an httpOnly cookie as the session so there is no session store to run, and role gating read from the client_roles claim. Services that need a browser login hand-roll this today: bearer-guard spends 450 lines on it in package main, so none of it is importable, and mysql-admin another 300.
firecow
force-pushed
the
add-oidcauth-package
branch
from
August 5, 2026 08:34
09f67c7 to
20e683c
Compare
User implements slog.LogValuer so "user", user renders user.id, user.type, user.email, user.full_name and user.roles, matching what the php package logs, and the request path and errors go through url.path and the go-lib error helper.
|
LauJosefsen
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
oidcauthpackage: authorization code flow with PKCE for browsers, bearer tokens for api clients, the verified id token as the session cookie, no session storeRegister(mux)wires /auth/login, /auth/callback and /auth/logout;HandlerFunc(h, roles...)gates a handler on any of the roles, or on being authenticated when given none, andMiddleware(roles...)is the same gate for chiclient_rolesandresource_access.<client>.roles, so it suits cegos golang projects