Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified
📁 ..	-	2025-05-25 12:27
📄 .travis.yml language: go go: - tip install: - export GOPATH="$HOME/gopath" - mkdir -p "$GOPATH/src/golang.org/x" - mv "$TRAVIS_BUILD_DIR" "$GOPATH/src/golang.org/x/oauth2" - go get -v -t -d golang.org/x/oauth2/... script: - go test -v golang.org/x/oauth2/...	262 B	2025-05-25 12:27
📄 CONTRIBUTING.md # Contributing to Go Go is an open source project. It is the work of hundreds of contributors. We appreciate your help! ## Filing issues When [filing an issue](https://github.com/golang/oauth2/issues), make sure to answer these five questions: 1. What version of Go are you using (`go version`)? 2. What operating system and processor architecture are you using? 3. What did you do? 4. What did you expect to see? 5. What did you see instead? General questions should go to the [golang-nuts mailing list](https://groups.google.com/group/golang-nuts) instead of the issue tracker. The gophers there will answer or ask you to file an issue if you've tripped over a bug. ## Contributing code Please read the [Contribution Guidelines](https://golang.org/doc/contribute.html) before sending patches. Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.	924 B	2025-05-25 12:27
📄 LICENSE Copyright 2009 The Go Authors. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Google LLC nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.	1.42 KB	2025-05-25 12:27
📄 README.md # OAuth2 for Go [![Go Reference](https://pkg.go.dev/badge/golang.org/x/oauth2.svg)](https://pkg.go.dev/golang.org/x/oauth2) [![Build Status](https://travis-ci.org/golang/oauth2.svg?branch=master)](https://travis-ci.org/golang/oauth2) oauth2 package contains a client implementation for OAuth 2.0 spec. See pkg.go.dev for further documentation and examples. * [pkg.go.dev/golang.org/x/oauth2](https://pkg.go.dev/golang.org/x/oauth2) * [pkg.go.dev/golang.org/x/oauth2/google](https://pkg.go.dev/golang.org/x/oauth2/google) ## Policy for new endpoints We no longer accept new provider-specific packages in this repo if all they do is add a single endpoint variable. If you just want to add a single endpoint, add it to the [pkg.go.dev/golang.org/x/oauth2/endpoints](https://pkg.go.dev/golang.org/x/oauth2/endpoints) package. ## Report Issues / Send Patches The main issue tracker for the oauth2 repository is located at https://github.com/golang/oauth2/issues. This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute. The git repository is https://go.googlesource.com/oauth2. Note: * Excluding trivial changes, all contributions should be connected to an existing issue. * API changes must go through the [change proposal process](https://go.dev/s/proposal-process) before they can be accepted. * The code owners are listed at [dev.golang.org/owners](https://dev.golang.org/owners#:~:text=x/oauth2).	1.45 KB	2025-05-25 12:27
📁 amazon	-	2025-05-25 12:27
📁 authhandler	-	2025-05-25 12:27
📁 bitbucket	-	2025-05-25 12:27
📁 cern	-	2025-05-25 12:27
📁 clientcredentials	-	2025-05-25 12:27
📄 deviceauth.go package oauth2 import ( "context" "encoding/json" "errors" "fmt" "io" "net/http" "net/url" "strings" "time" "golang.org/x/oauth2/internal" ) // https://datatracker.ietf.org/doc/html/rfc8628#section-3.5 const ( errAuthorizationPending = "authorization_pending" errSlowDown = "slow_down" errAccessDenied = "access_denied" errExpiredToken = "expired_token" ) // DeviceAuthResponse describes a successful RFC 8628 Device Authorization Response // https://datatracker.ietf.org/doc/html/rfc8628#section-3.2 type DeviceAuthResponse struct { // DeviceCode DeviceCode string `json:"device_code"` // UserCode is the code the user should enter at the verification uri UserCode string `json:"user_code"` // VerificationURI is where user should enter the user code VerificationURI string `json:"verification_uri"` // VerificationURIComplete (if populated) includes the user code in the verification URI. This is typically shown to the user in non-textual form, such as a QR code. VerificationURIComplete string `json:"verification_uri_complete,omitempty"` // Expiry is when the device code and user code expire Expiry time.Time `json:"expires_in,omitempty"` // Interval is the duration in seconds that Poll should wait between requests Interval int64 `json:"interval,omitempty"` } func (d DeviceAuthResponse) MarshalJSON() ([]byte, error) { type Alias DeviceAuthResponse var expiresIn int64 if !d.Expiry.IsZero() { expiresIn = int64(time.Until(d.Expiry).Seconds()) } return json.Marshal(&struct { ExpiresIn int64 `json:"expires_in,omitempty"` Alias }{ ExpiresIn: expiresIn, Alias: (Alias)(&d), }) } func (c DeviceAuthResponse) UnmarshalJSON(data []byte) error { type Alias DeviceAuthResponse aux := &struct { ExpiresIn int64 `json:"expires_in"` // workaround misspelling of verification_uri VerificationURL string `json:"verification_url"` Alias }{ Alias: (Alias)(c), } if err := json.Unmarshal(data, &aux); err != nil { return err } if aux.ExpiresIn != 0 { c.Expiry = time.Now().UTC().Add(time.Second time.Duration(aux.ExpiresIn)) } if c.VerificationURI == "" { c.VerificationURI = aux.VerificationURL } return nil } // DeviceAuth returns a device auth struct which contains a device code // and authorization information provided for users to enter on another device. func (c Config) DeviceAuth(ctx context.Context, opts ...AuthCodeOption) (DeviceAuthResponse, error) { // https://datatracker.ietf.org/doc/html/rfc8628#section-3.1 v := url.Values{ "client_id": {c.ClientID}, } if len(c.Scopes) > 0 { v.Set("scope", strings.Join(c.Scopes, " ")) } for _, opt := range opts { opt.setValue(v) } return retrieveDeviceAuth(ctx, c, v) } func retrieveDeviceAuth(ctx context.Context, c Config, v url.Values) (DeviceAuthResponse, error) { if c.Endpoint.DeviceAuthURL == "" { return nil, errors.New("endpoint missing DeviceAuthURL") } req, err := http.NewRequest("POST", c.Endpoint.DeviceAuthURL, strings.NewReader(v.Encode())) if err != nil { return nil, err } req.Header.Set("Content-Type", "application/x-www-form-urlencoded") req.Header.Set("Accept", "application/json") t := time.Now() r, err := internal.ContextClient(ctx).Do(req) if err != nil { return nil, err } body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20)) if err != nil { return nil, fmt.Errorf("oauth2: cannot auth device: %v", err) } if code := r.StatusCode; code < 200 \|\| code > 299 { return nil, &RetrieveError{ Response: r, Body: body, } } da := &DeviceAuthResponse{} err = json.Unmarshal(body, &da) if err != nil { return nil, fmt.Errorf("unmarshal %s", err) } if !da.Expiry.IsZero() { // Make a small adjustment to account for time taken by the request da.Expiry = da.Expiry.Add(-time.Since(t)) } return da, nil } // DeviceAccessToken polls the server to exchange a device code for a token. func (c Config) DeviceAccessToken(ctx context.Context, da DeviceAuthResponse, opts ...AuthCodeOption) (Token, error) { if !da.Expiry.IsZero() { var cancel context.CancelFunc ctx, cancel = context.WithDeadline(ctx, da.Expiry) defer cancel() } // https://datatracker.ietf.org/doc/html/rfc8628#section-3.4 v := url.Values{ "client_id": {c.ClientID}, "grant_type": {"urn:ietf:params:oauth:grant-type:device_code"}, "device_code": {da.DeviceCode}, } if len(c.Scopes) > 0 { v.Set("scope", strings.Join(c.Scopes, " ")) } for _, opt := range opts { opt.setValue(v) } // "If no value is provided, clients MUST use 5 as the default." // https://datatracker.ietf.org/doc/html/rfc8628#section-3.2 interval := da.Interval if interval == 0 { interval = 5 } ticker := time.NewTicker(time.Duration(interval) time.Second) defer ticker.Stop() for { select { case <-ctx.Done(): return nil, ctx.Err() case <-ticker.C: tok, err := retrieveToken(ctx, c, v) if err == nil { return tok, nil } e, ok := err.(RetrieveError) if !ok { return nil, err } switch e.ErrorCode { case errSlowDown: // https://datatracker.ietf.org/doc/html/rfc8628#section-3.5 // "the interval MUST be increased by 5 seconds for this and all subsequent requests" interval += 5 ticker.Reset(time.Duration(interval) time.Second) case errAuthorizationPending: // Do nothing. case errAccessDenied, errExpiredToken: fallthrough default: return tok, err } } } }	5.35 KB	2025-05-25 12:27
📄 deviceauth_test.go package oauth2 import ( "context" "encoding/json" "fmt" "strings" "testing" "time" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" ) func TestDeviceAuthResponseMarshalJson(t testing.T) { tests := []struct { name string response DeviceAuthResponse want string }{ { name: "empty", response: DeviceAuthResponse{}, want: `{"device_code":"","user_code":"","verification_uri":""}`, }, { name: "soon", response: DeviceAuthResponse{ Expiry: time.Now().Add(100time.Second + 999time.Millisecond), }, want: `{"expires_in":100,"device_code":"","user_code":"","verification_uri":""}`, }, } for _, tc := range tests { t.Run(tc.name, func(t testing.T) { begin := time.Now() gotBytes, err := json.Marshal(tc.response) if err != nil { t.Fatal(err) } if strings.Contains(tc.want, "expires_in") && time.Since(begin) > 999time.Millisecond { t.Skip("test ran too slowly to compare `expires_in`") } got := string(gotBytes) if got != tc.want { t.Errorf("want=%s, got=%s", tc.want, got) } }) } } func TestDeviceAuthResponseUnmarshalJson(t testing.T) { tests := []struct { name string data string want DeviceAuthResponse }{ { name: "empty", data: `{}`, want: DeviceAuthResponse{}, }, { name: "soon", data: `{"expires_in":100}`, want: DeviceAuthResponse{Expiry: time.Now().UTC().Add(100 * time.Second)}, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { begin := time.Now() got := DeviceAuthResponse{} err := json.Unmarshal([]byte(tc.data), &got) if err != nil { t.Fatal(err) } if !cmp.Equal(got, tc.want, cmpopts.IgnoreUnexported(DeviceAuthResponse{}), cmpopts.EquateApproxTime(time.Second+time.Since(begin))) { t.Errorf("want=%#v, got=%#v", tc.want, got) } }) } } func ExampleConfig_DeviceAuth() { var config Config ctx := context.Background() response, err := config.DeviceAuth(ctx) if err != nil { panic(err) } fmt.Printf("please enter code %s at %s\n", response.UserCode, response.VerificationURI) token, err := config.DeviceAccessToken(ctx, response) if err != nil { panic(err) } fmt.Println(token) }	2.17 KB	2025-05-25 12:27
📁 endpoints	-	2025-05-25 12:27
📄 example_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2_test import ( "context" "fmt" "log" "net/http" "time" "golang.org/x/oauth2" ) func ExampleConfig() { ctx := context.Background() conf := &oauth2.Config{ ClientID: "YOUR_CLIENT_ID", ClientSecret: "YOUR_CLIENT_SECRET", Scopes: []string{"SCOPE1", "SCOPE2"}, Endpoint: oauth2.Endpoint{ AuthURL: "https://provider.com/o/oauth2/auth", TokenURL: "https://provider.com/o/oauth2/token", }, } // use PKCE to protect against CSRF attacks // https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-22.html#name-countermeasures-6 verifier := oauth2.GenerateVerifier() // Redirect user to consent page to ask for permission // for the scopes specified above. url := conf.AuthCodeURL("state", oauth2.AccessTypeOffline, oauth2.S256ChallengeOption(verifier)) fmt.Printf("Visit the URL for the auth dialog: %v", url) // Use the authorization code that is pushed to the redirect // URL. Exchange will do the handshake to retrieve the // initial access token. The HTTP Client returned by // conf.Client will refresh the token as necessary. var code string if _, err := fmt.Scan(&code); err != nil { log.Fatal(err) } tok, err := conf.Exchange(ctx, code, oauth2.VerifierOption(verifier)) if err != nil { log.Fatal(err) } client := conf.Client(ctx, tok) client.Get("...") } func ExampleConfig_customHTTP() { ctx := context.Background() conf := &oauth2.Config{ ClientID: "YOUR_CLIENT_ID", ClientSecret: "YOUR_CLIENT_SECRET", Scopes: []string{"SCOPE1", "SCOPE2"}, Endpoint: oauth2.Endpoint{ TokenURL: "https://provider.com/o/oauth2/token", AuthURL: "https://provider.com/o/oauth2/auth", }, } // Redirect user to consent page to ask for permission // for the scopes specified above. url := conf.AuthCodeURL("state", oauth2.AccessTypeOffline) fmt.Printf("Visit the URL for the auth dialog: %v", url) // Use the authorization code that is pushed to the redirect // URL. Exchange will do the handshake to retrieve the // initial access token. The HTTP Client returned by // conf.Client will refresh the token as necessary. var code string if _, err := fmt.Scan(&code); err != nil { log.Fatal(err) } // Use the custom HTTP client when requesting a token. httpClient := &http.Client{Timeout: 2 * time.Second} ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient) tok, err := conf.Exchange(ctx, code) if err != nil { log.Fatal(err) } client := conf.Client(ctx, tok) _ = client }	2.6 KB	2025-05-25 12:27
📁 facebook	-	2025-05-25 12:27
📁 fitbit	-	2025-05-25 12:27
📁 foursquare	-	2025-05-25 12:27
📁 github	-	2025-05-25 12:27
📁 gitlab	-	2025-05-25 12:27
📄 go.mod module golang.org/x/oauth2 go 1.18 require ( cloud.google.com/go/compute/metadata v0.3.0 github.com/google/go-cmp v0.5.9 )	127 B	2025-05-25 12:27
📄 go.sum cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc= cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=	358 B	2025-05-25 12:27
📁 google	-	2025-05-25 12:27
📁 heroku	-	2025-05-25 12:27
📁 hipchat	-	2025-05-25 12:27
📁 instagram	-	2025-05-25 12:27
📁 internal	-	2025-05-25 12:27
📁 jira	-	2025-05-25 12:27
📁 jws	-	2025-05-25 12:27
📁 jwt	-	2025-05-25 12:27
📁 kakao	-	2025-05-25 12:27
📁 linkedin	-	2025-05-25 12:27
📁 mailchimp	-	2025-05-25 12:27
📁 mailru	-	2025-05-25 12:27
📁 mediamath	-	2025-05-25 12:27
📁 microsoft	-	2025-05-25 12:27
📁 nokiahealth	-	2025-05-25 12:27
📄 oauth2.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Package oauth2 provides support for making // OAuth2 authorized and authenticated HTTP requests, // as specified in RFC 6749. // It can additionally grant authorization with Bearer JWT. package oauth2 // import "golang.org/x/oauth2" import ( "bytes" "context" "errors" "net/http" "net/url" "strings" "sync" "time" "golang.org/x/oauth2/internal" ) // NoContext is the default context you should supply if not using // your own context.Context (see https://golang.org/x/net/context). // // Deprecated: Use context.Background() or context.TODO() instead. var NoContext = context.TODO() // RegisterBrokenAuthHeaderProvider previously did something. It is now a no-op. // // Deprecated: this function no longer does anything. Caller code that // wants to avoid potential extra HTTP requests made during // auto-probing of the provider's auth style should set // Endpoint.AuthStyle. func RegisterBrokenAuthHeaderProvider(tokenURL string) {} // Config describes a typical 3-legged OAuth2 flow, with both the // client application information and the server's endpoint URLs. // For the client credentials 2-legged OAuth2 flow, see the clientcredentials // package (https://golang.org/x/oauth2/clientcredentials). type Config struct { // ClientID is the application's ID. ClientID string // ClientSecret is the application's secret. ClientSecret string // Endpoint contains the resource server's token endpoint // URLs. These are constants specific to each server and are // often available via site-specific packages, such as // google.Endpoint or github.Endpoint. Endpoint Endpoint // RedirectURL is the URL to redirect users going through // the OAuth flow, after the resource owner's URLs. RedirectURL string // Scope specifies optional requested permissions. Scopes []string // authStyleCache caches which auth style to use when Endpoint.AuthStyle is // the zero value (AuthStyleAutoDetect). authStyleCache internal.LazyAuthStyleCache } // A TokenSource is anything that can return a token. type TokenSource interface { // Token returns a token or an error. // Token must be safe for concurrent use by multiple goroutines. // The returned Token must not be modified. Token() (Token, error) } // Endpoint represents an OAuth 2.0 provider's authorization and token // endpoint URLs. type Endpoint struct { AuthURL string DeviceAuthURL string TokenURL string // AuthStyle optionally specifies how the endpoint wants the // client ID & client secret sent. The zero value means to // auto-detect. AuthStyle AuthStyle } // AuthStyle represents how requests for tokens are authenticated // to the server. type AuthStyle int const ( // AuthStyleAutoDetect means to auto-detect which authentication // style the provider wants by trying both ways and caching // the successful way for the future. AuthStyleAutoDetect AuthStyle = 0 // AuthStyleInParams sends the "client_id" and "client_secret" // in the POST body as application/x-www-form-urlencoded parameters. AuthStyleInParams AuthStyle = 1 // AuthStyleInHeader sends the client_id and client_password // using HTTP Basic Authorization. This is an optional style // described in the OAuth2 RFC 6749 section 2.3.1. AuthStyleInHeader AuthStyle = 2 ) var ( // AccessTypeOnline and AccessTypeOffline are options passed // to the Options.AuthCodeURL method. They modify the // "access_type" field that gets sent in the URL returned by // AuthCodeURL. // // Online is the default if neither is specified. If your // application needs to refresh access tokens when the user // is not present at the browser, then use offline. This will // result in your application obtaining a refresh token the // first time your application exchanges an authorization // code for a user. AccessTypeOnline AuthCodeOption = SetAuthURLParam("access_type", "online") AccessTypeOffline AuthCodeOption = SetAuthURLParam("access_type", "offline") // ApprovalForce forces the users to view the consent dialog // and confirm the permissions request at the URL returned // from AuthCodeURL, even if they've already done so. ApprovalForce AuthCodeOption = SetAuthURLParam("prompt", "consent") ) // An AuthCodeOption is passed to Config.AuthCodeURL. type AuthCodeOption interface { setValue(url.Values) } type setParam struct{ k, v string } func (p setParam) setValue(m url.Values) { m.Set(p.k, p.v) } // SetAuthURLParam builds an AuthCodeOption which passes key/value parameters // to a provider's authorization endpoint. func SetAuthURLParam(key, value string) AuthCodeOption { return setParam{key, value} } // AuthCodeURL returns a URL to OAuth 2.0 provider's consent page // that asks for permissions for the required scopes explicitly. // // State is an opaque value used by the client to maintain state between the // request and callback. The authorization server includes this value when // redirecting the user agent back to the client. // // Opts may include AccessTypeOnline or AccessTypeOffline, as well // as ApprovalForce. // // To protect against CSRF attacks, opts should include a PKCE challenge // (S256ChallengeOption). Not all servers support PKCE. An alternative is to // generate a random state parameter and verify it after exchange. // See https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 (predating // PKCE), https://www.oauth.com/oauth2-servers/pkce/ and // https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.html#name-cross-site-request-forgery (describing both approaches) func (c Config) AuthCodeURL(state string, opts ...AuthCodeOption) string { var buf bytes.Buffer buf.WriteString(c.Endpoint.AuthURL) v := url.Values{ "response_type": {"code"}, "client_id": {c.ClientID}, } if c.RedirectURL != "" { v.Set("redirect_uri", c.RedirectURL) } if len(c.Scopes) > 0 { v.Set("scope", strings.Join(c.Scopes, " ")) } if state != "" { v.Set("state", state) } for _, opt := range opts { opt.setValue(v) } if strings.Contains(c.Endpoint.AuthURL, "?") { buf.WriteByte('&') } else { buf.WriteByte('?') } buf.WriteString(v.Encode()) return buf.String() } // PasswordCredentialsToken converts a resource owner username and password // pair into a token. // // Per the RFC, this grant type should only be used "when there is a high // degree of trust between the resource owner and the client (e.g., the client // is part of the device operating system or a highly privileged application), // and when other authorization grant types are not available." // See https://tools.ietf.org/html/rfc6749#section-4.3 for more info. // // The provided context optionally controls which HTTP client is used. See the HTTPClient variable. func (c Config) PasswordCredentialsToken(ctx context.Context, username, password string) (Token, error) { v := url.Values{ "grant_type": {"password"}, "username": {username}, "password": {password}, } if len(c.Scopes) > 0 { v.Set("scope", strings.Join(c.Scopes, " ")) } return retrieveToken(ctx, c, v) } // Exchange converts an authorization code into a token. // // It is used after a resource provider redirects the user back // to the Redirect URI (the URL obtained from AuthCodeURL). // // The provided context optionally controls which HTTP client is used. See the HTTPClient variable. // // The code will be in the http.Request.FormValue("code"). Before // calling Exchange, be sure to validate FormValue("state") if you are // using it to protect against CSRF attacks. // // If using PKCE to protect against CSRF attacks, opts should include a // VerifierOption. func (c Config) Exchange(ctx context.Context, code string, opts ...AuthCodeOption) (Token, error) { v := url.Values{ "grant_type": {"authorization_code"}, "code": {code}, } if c.RedirectURL != "" { v.Set("redirect_uri", c.RedirectURL) } for _, opt := range opts { opt.setValue(v) } return retrieveToken(ctx, c, v) } // Client returns an HTTP client using the provided token. // The token will auto-refresh as necessary. The underlying // HTTP transport will be obtained using the provided context. // The returned client and its Transport should not be modified. func (c Config) Client(ctx context.Context, t Token) http.Client { return NewClient(ctx, c.TokenSource(ctx, t)) } // TokenSource returns a TokenSource that returns t until t expires, // automatically refreshing it as necessary using the provided context. // // Most users will use Config.Client instead. func (c Config) TokenSource(ctx context.Context, t Token) TokenSource { tkr := &tokenRefresher{ ctx: ctx, conf: c, } if t != nil { tkr.refreshToken = t.RefreshToken } return &reuseTokenSource{ t: t, new: tkr, } } // tokenRefresher is a TokenSource that makes "grant_type"=="refresh_token" // HTTP requests to renew a token using a RefreshToken. type tokenRefresher struct { ctx context.Context // used to get HTTP requests conf Config refreshToken string } // WARNING: Token is not safe for concurrent access, as it // updates the tokenRefresher's refreshToken field. // Within this package, it is used by reuseTokenSource which // synchronizes calls to this method with its own mutex. func (tf tokenRefresher) Token() (Token, error) { if tf.refreshToken == "" { return nil, errors.New("oauth2: token expired and refresh token is not set") } tk, err := retrieveToken(tf.ctx, tf.conf, url.Values{ "grant_type": {"refresh_token"}, "refresh_token": {tf.refreshToken}, }) if err != nil { return nil, err } if tf.refreshToken != tk.RefreshToken { tf.refreshToken = tk.RefreshToken } return tk, err } // reuseTokenSource is a TokenSource that holds a single token in memory // and validates its expiry before each call to retrieve it with // Token. If it's expired, it will be auto-refreshed using the // new TokenSource. type reuseTokenSource struct { new TokenSource // called when t is expired. mu sync.Mutex // guards t t Token expiryDelta time.Duration } // Token returns the current token if it's still valid, else will // refresh the current token (using r.Context for HTTP client // information) and return the new one. func (s reuseTokenSource) Token() (Token, error) { s.mu.Lock() defer s.mu.Unlock() if s.t.Valid() { return s.t, nil } t, err := s.new.Token() if err != nil { return nil, err } t.expiryDelta = s.expiryDelta s.t = t return t, nil } // StaticTokenSource returns a TokenSource that always returns the same token. // Because the provided token t is never refreshed, StaticTokenSource is only // useful for tokens that never expire. func StaticTokenSource(t Token) TokenSource { return staticTokenSource{t} } // staticTokenSource is a TokenSource that always returns the same Token. type staticTokenSource struct { t Token } func (s staticTokenSource) Token() (Token, error) { return s.t, nil } // HTTPClient is the context key to use with golang.org/x/net/context's // WithValue function to associate an http.Client value with a context. var HTTPClient internal.ContextKey // NewClient creates an http.Client from a Context and TokenSource. // The returned client is not valid beyond the lifetime of the context. // // Note that if a custom http.Client is provided via the Context it // is used only for token acquisition and is not used to configure the // http.Client returned from NewClient. // // As a special case, if src is nil, a non-OAuth2 client is returned // using the provided context. This exists to support related OAuth2 // packages. func NewClient(ctx context.Context, src TokenSource) http.Client { if src == nil { return internal.ContextClient(ctx) } return &http.Client{ Transport: &Transport{ Base: internal.ContextClient(ctx).Transport, Source: ReuseTokenSource(nil, src), }, } } // ReuseTokenSource returns a TokenSource which repeatedly returns the // same token as long as it's valid, starting with t. // When its cached token is invalid, a new token is obtained from src. // // ReuseTokenSource is typically used to reuse tokens from a cache // (such as a file on disk) between runs of a program, rather than // obtaining new tokens unnecessarily. // // The initial token t may be nil, in which case the TokenSource is // wrapped in a caching version if it isn't one already. This also // means it's always safe to wrap ReuseTokenSource around any other // TokenSource without adverse effects. func ReuseTokenSource(t Token, src TokenSource) TokenSource { // Don't wrap a reuseTokenSource in itself. That would work, // but cause an unnecessary number of mutex operations. // Just build the equivalent one. if rt, ok := src.(reuseTokenSource); ok { if t == nil { // Just use it directly. return rt } src = rt.new } return &reuseTokenSource{ t: t, new: src, } } // ReuseTokenSourceWithExpiry returns a TokenSource that acts in the same manner as the // TokenSource returned by ReuseTokenSource, except the expiry buffer is // configurable. The expiration time of a token is calculated as // t.Expiry.Add(-earlyExpiry). func ReuseTokenSourceWithExpiry(t Token, src TokenSource, earlyExpiry time.Duration) TokenSource { // Don't wrap a reuseTokenSource in itself. That would work, // but cause an unnecessary number of mutex operations. // Just build the equivalent one. if rt, ok := src.(reuseTokenSource); ok { if t == nil { // Just use it directly, but set the expiryDelta to earlyExpiry, // so the behavior matches what the user expects. rt.expiryDelta = earlyExpiry return rt } src = rt.new } if t != nil { t.expiryDelta = earlyExpiry } return &reuseTokenSource{ t: t, new: src, expiryDelta: earlyExpiry, } }	13.6 KB	2025-05-25 12:27
📄 oauth2_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2 import ( "context" "errors" "fmt" "io" "io/ioutil" "net/http" "net/http/httptest" "net/url" "testing" "time" ) type mockTransport struct { rt func(req http.Request) (resp http.Response, err error) } func (t mockTransport) RoundTrip(req http.Request) (resp http.Response, err error) { return t.rt(req) } func newConf(url string) Config { return &Config{ ClientID: "CLIENT_ID", ClientSecret: "CLIENT_SECRET", RedirectURL: "REDIRECT_URL", Scopes: []string{"scope1", "scope2"}, Endpoint: Endpoint{ AuthURL: url + "/auth", TokenURL: url + "/token", }, } } func TestAuthCodeURL(t testing.T) { conf := newConf("server") url := conf.AuthCodeURL("foo", AccessTypeOffline, ApprovalForce) const want = "server/auth?access_type=offline&client_id=CLIENT_ID&prompt=consent&redirect_uri=REDIRECT_URL&response_type=code&scope=scope1+scope2&state=foo" if got := url; got != want { t.Errorf("got auth code URL = %q; want %q", got, want) } } func TestAuthCodeURL_CustomParam(t testing.T) { conf := newConf("server") param := SetAuthURLParam("foo", "bar") url := conf.AuthCodeURL("baz", param) const want = "server/auth?client_id=CLIENT_ID&foo=bar&redirect_uri=REDIRECT_URL&response_type=code&scope=scope1+scope2&state=baz" if got := url; got != want { t.Errorf("got auth code = %q; want %q", got, want) } } func TestAuthCodeURL_Optional(t testing.T) { conf := &Config{ ClientID: "CLIENT_ID", Endpoint: Endpoint{ AuthURL: "/auth-url", TokenURL: "/token-url", }, } url := conf.AuthCodeURL("") const want = "/auth-url?client_id=CLIENT_ID&response_type=code" if got := url; got != want { t.Fatalf("got auth code = %q; want %q", got, want) } } func TestURLUnsafeClientConfig(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.Header.Get("Authorization"), "Basic Q0xJRU5UX0lEJTNGJTNGOkNMSUVOVF9TRUNSRVQlM0YlM0Y="; got != want { t.Errorf("Authorization header = %q; want %q", got, want) } w.Header().Set("Content-Type", "application/x-www-form-urlencoded") w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer")) })) defer ts.Close() conf := newConf(ts.URL) conf.ClientID = "CLIENT_ID??" conf.ClientSecret = "CLIENT_SECRET??" _, err := conf.Exchange(context.Background(), "exchange-code") if err != nil { t.Error(err) } } func TestExchangeRequest(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() != "/token" { t.Errorf("Unexpected exchange request URL %q", r.URL) } headerAuth := r.Header.Get("Authorization") if want := "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ="; headerAuth != want { t.Errorf("Unexpected authorization header %q, want %q", headerAuth, want) } headerContentType := r.Header.Get("Content-Type") if headerContentType != "application/x-www-form-urlencoded" { t.Errorf("Unexpected Content-Type header %q", headerContentType) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("Failed reading request body: %s.", err) } if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" { t.Errorf("Unexpected exchange payload; got %q", body) } w.Header().Set("Content-Type", "application/x-www-form-urlencoded") w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer")) })) defer ts.Close() conf := newConf(ts.URL) tok, err := conf.Exchange(context.Background(), "exchange-code") if err != nil { t.Error(err) } if !tok.Valid() { t.Fatalf("Token invalid. Got: %#v", tok) } if tok.AccessToken != "90d64460d14870c08c81352a05dedd3465940a7c" { t.Errorf("Unexpected access token, %#v.", tok.AccessToken) } if tok.TokenType != "bearer" { t.Errorf("Unexpected token type, %#v.", tok.TokenType) } scope := tok.Extra("scope") if scope != "user" { t.Errorf("Unexpected value for scope: %v", scope) } } func TestExchangeRequest_CustomParam(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() != "/token" { t.Errorf("Unexpected exchange request URL, %v is found.", r.URL) } headerAuth := r.Header.Get("Authorization") if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" { t.Errorf("Unexpected authorization header, %v is found.", headerAuth) } headerContentType := r.Header.Get("Content-Type") if headerContentType != "application/x-www-form-urlencoded" { t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("Failed reading request body: %s.", err) } if string(body) != "code=exchange-code&foo=bar&grant_type=authorization_code&redirect_uri=REDIRECT_URL" { t.Errorf("Unexpected exchange payload, %v is found.", string(body)) } w.Header().Set("Content-Type", "application/x-www-form-urlencoded") w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer")) })) defer ts.Close() conf := newConf(ts.URL) param := SetAuthURLParam("foo", "bar") tok, err := conf.Exchange(context.Background(), "exchange-code", param) if err != nil { t.Error(err) } if !tok.Valid() { t.Fatalf("Token invalid. Got: %#v", tok) } if tok.AccessToken != "90d64460d14870c08c81352a05dedd3465940a7c" { t.Errorf("Unexpected access token, %#v.", tok.AccessToken) } if tok.TokenType != "bearer" { t.Errorf("Unexpected token type, %#v.", tok.TokenType) } scope := tok.Extra("scope") if scope != "user" { t.Errorf("Unexpected value for scope: %v", scope) } } func TestExchangeRequest_JSONResponse(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() != "/token" { t.Errorf("Unexpected exchange request URL, %v is found.", r.URL) } headerAuth := r.Header.Get("Authorization") if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" { t.Errorf("Unexpected authorization header, %v is found.", headerAuth) } headerContentType := r.Header.Get("Content-Type") if headerContentType != "application/x-www-form-urlencoded" { t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("Failed reading request body: %s.", err) } if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" { t.Errorf("Unexpected exchange payload, %v is found.", string(body)) } w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"access_token": "90d64460d14870c08c81352a05dedd3465940a7c", "scope": "user", "token_type": "bearer", "expires_in": 86400}`)) })) defer ts.Close() conf := newConf(ts.URL) tok, err := conf.Exchange(context.Background(), "exchange-code") if err != nil { t.Error(err) } if !tok.Valid() { t.Fatalf("Token invalid. Got: %#v", tok) } if tok.AccessToken != "90d64460d14870c08c81352a05dedd3465940a7c" { t.Errorf("Unexpected access token, %#v.", tok.AccessToken) } if tok.TokenType != "bearer" { t.Errorf("Unexpected token type, %#v.", tok.TokenType) } scope := tok.Extra("scope") if scope != "user" { t.Errorf("Unexpected value for scope: %v", scope) } expiresIn := tok.Extra("expires_in") if expiresIn != float64(86400) { t.Errorf("Unexpected non-numeric value for expires_in: %v", expiresIn) } } func TestExtraValueRetrieval(t testing.T) { values := url.Values{} kvmap := map[string]string{ "scope": "user", "token_type": "bearer", "expires_in": "86400.92", "server_time": "1443571905.5606415", "referer_ip": "10.0.0.1", "etag": "\"afZYj912P4alikMz_P11982\"", "request_id": "86400", "untrimmed": " untrimmed ", } for key, value := range kvmap { values.Set(key, value) } tok := Token{raw: values} scope := tok.Extra("scope") if got, want := scope, "user"; got != want { t.Errorf("got scope = %q; want %q", got, want) } serverTime := tok.Extra("server_time") if got, want := serverTime, 1443571905.5606415; got != want { t.Errorf("got server_time value = %v; want %v", got, want) } refererIP := tok.Extra("referer_ip") if got, want := refererIP, "10.0.0.1"; got != want { t.Errorf("got referer_ip value = %v, want %v", got, want) } expiresIn := tok.Extra("expires_in") if got, want := expiresIn, 86400.92; got != want { t.Errorf("got expires_in value = %v, want %v", got, want) } requestID := tok.Extra("request_id") if got, want := requestID, int64(86400); got != want { t.Errorf("got request_id value = %v, want %v", got, want) } untrimmed := tok.Extra("untrimmed") if got, want := untrimmed, " untrimmed "; got != want { t.Errorf("got untrimmed = %q; want %q", got, want) } } const day = 24 * time.Hour func TestExchangeRequest_JSONResponse_Expiry(t testing.T) { seconds := int32(day.Seconds()) for _, c := range []struct { name string expires string want bool nullExpires bool }{ {"normal", fmt.Sprintf(`"expires_in": %d`, seconds), true, false}, {"paypal", fmt.Sprintf(`"expires_in": "%d"`, seconds), true, false}, {"issue_239", fmt.Sprintf(`"expires_in": null`), true, true}, {"wrong_type", `"expires_in": false`, false, false}, {"wrong_type2", `"expires_in": {}`, false, false}, {"wrong_value", `"expires_in": "zzz"`, false, false}, } { t.Run(c.name, func(t testing.T) { testExchangeRequest_JSONResponse_expiry(t, c.expires, c.want, c.nullExpires) }) } } func testExchangeRequest_JSONResponse_expiry(t testing.T, exp string, want, nullExpires bool) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") w.Write([]byte(fmt.Sprintf(`{"access_token": "90d", "scope": "user", "token_type": "bearer", %s}`, exp))) })) defer ts.Close() conf := newConf(ts.URL) t1 := time.Now().Add(day) tok, err := conf.Exchange(context.Background(), "exchange-code") t2 := t1.Add(day) if got := (err == nil); got != want { if want { t.Errorf("unexpected error: got %v", err) } else { t.Errorf("unexpected success") } } if !want { return } if !tok.Valid() { t.Fatalf("Token invalid. Got: %#v", tok) } expiry := tok.Expiry if nullExpires && expiry.IsZero() { return } if expiry.Before(t1) \|\| expiry.After(t2) { t.Errorf("Unexpected value for Expiry: %v (should be between %v and %v)", expiry, t1, t2) } } func TestExchangeRequest_BadResponse(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"scope": "user", "token_type": "bearer"}`)) })) defer ts.Close() conf := newConf(ts.URL) _, err := conf.Exchange(context.Background(), "code") if err == nil { t.Error("expected error from missing access_token") } } func TestExchangeRequest_BadResponseType(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"access_token":123, "scope": "user", "token_type": "bearer"}`)) })) defer ts.Close() conf := newConf(ts.URL) _, err := conf.Exchange(context.Background(), "exchange-code") if err == nil { t.Error("expected error from non-string access_token") } } func TestExchangeRequest_NonBasicAuth(t testing.T) { tr := &mockTransport{ rt: func(r http.Request) (w http.Response, err error) { headerAuth := r.Header.Get("Authorization") if headerAuth != "" { t.Errorf("Unexpected authorization header %q", headerAuth) } return nil, errors.New("no response") }, } c := &http.Client{Transport: tr} conf := &Config{ ClientID: "CLIENT_ID", Endpoint: Endpoint{ AuthURL: "https://accounts.google.com/auth", TokenURL: "https://accounts.google.com/token", AuthStyle: AuthStyleInParams, }, } ctx := context.WithValue(context.Background(), HTTPClient, c) conf.Exchange(ctx, "code") } func TestPasswordCredentialsTokenRequest(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { defer r.Body.Close() expected := "/token" if r.URL.String() != expected { t.Errorf("URL = %q; want %q", r.URL, expected) } headerAuth := r.Header.Get("Authorization") expected = "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" if headerAuth != expected { t.Errorf("Authorization header = %q; want %q", headerAuth, expected) } headerContentType := r.Header.Get("Content-Type") expected = "application/x-www-form-urlencoded" if headerContentType != expected { t.Errorf("Content-Type header = %q; want %q", headerContentType, expected) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Errorf("Failed reading request body: %s.", err) } expected = "grant_type=password&password=password1&scope=scope1+scope2&username=user1" if string(body) != expected { t.Errorf("res.Body = %q; want %q", string(body), expected) } w.Header().Set("Content-Type", "application/x-www-form-urlencoded") w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer")) })) defer ts.Close() conf := newConf(ts.URL) tok, err := conf.PasswordCredentialsToken(context.Background(), "user1", "password1") if err != nil { t.Error(err) } if !tok.Valid() { t.Fatalf("Token invalid. Got: %#v", tok) } expected := "90d64460d14870c08c81352a05dedd3465940a7c" if tok.AccessToken != expected { t.Errorf("AccessToken = %q; want %q", tok.AccessToken, expected) } expected = "bearer" if tok.TokenType != expected { t.Errorf("TokenType = %q; want %q", tok.TokenType, expected) } } func TestTokenRefreshRequest(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() == "/somethingelse" { return } if r.URL.String() != "/token" { t.Errorf("Unexpected token refresh request URL %q", r.URL) } headerContentType := r.Header.Get("Content-Type") if headerContentType != "application/x-www-form-urlencoded" { t.Errorf("Unexpected Content-Type header %q", headerContentType) } body, _ := ioutil.ReadAll(r.Body) if string(body) != "grant_type=refresh_token&refresh_token=REFRESH_TOKEN" { t.Errorf("Unexpected refresh token payload %q", body) } w.Header().Set("Content-Type", "application/json") io.WriteString(w, `{"access_token": "foo", "refresh_token": "bar"}`) })) defer ts.Close() conf := newConf(ts.URL) c := conf.Client(context.Background(), &Token{RefreshToken: "REFRESH_TOKEN"}) c.Get(ts.URL + "/somethingelse") } func TestFetchWithNoRefreshToken(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() == "/somethingelse" { return } if r.URL.String() != "/token" { t.Errorf("Unexpected token refresh request URL, %v is found.", r.URL) } headerContentType := r.Header.Get("Content-Type") if headerContentType != "application/x-www-form-urlencoded" { t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType) } body, _ := ioutil.ReadAll(r.Body) if string(body) != "client_id=CLIENT_ID&grant_type=refresh_token&refresh_token=REFRESH_TOKEN" { t.Errorf("Unexpected refresh token payload, %v is found.", string(body)) } })) defer ts.Close() conf := newConf(ts.URL) c := conf.Client(context.Background(), nil) _, err := c.Get(ts.URL + "/somethingelse") if err == nil { t.Errorf("Fetch should return an error if no refresh token is set") } } func TestTokenRetrieveError(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() != "/token" { t.Errorf("Unexpected token refresh request URL, %v is found.", r.URL) } w.Header().Set("Content-type", "application/json") // "The authorization server responds with an HTTP 400 (Bad Request)" https://www.rfc-editor.org/rfc/rfc6749#section-5.2 w.WriteHeader(http.StatusBadRequest) w.Write([]byte(`{"error": "invalid_grant"}`)) })) defer ts.Close() conf := newConf(ts.URL) _, err := conf.Exchange(context.Background(), "exchange-code") if err == nil { t.Fatalf("got no error, expected one") } re, ok := err.(RetrieveError) if !ok { t.Fatalf("got %T error, expected RetrieveError; error was: %v", err, err) } expected := `oauth2: "invalid_grant"` if errStr := err.Error(); errStr != expected { t.Fatalf("got %#v, expected %#v", errStr, expected) } expected = "invalid_grant" if re.ErrorCode != expected { t.Fatalf("got %#v, expected %#v", re.ErrorCode, expected) } } // TestTokenRetrieveError200 tests handling of unorthodox server that returns 200 in error case func TestTokenRetrieveError200(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.URL.String() != "/token" { t.Errorf("Unexpected token refresh request URL, %v is found.", r.URL) } w.Header().Set("Content-type", "application/json") w.Write([]byte(`{"error": "invalid_grant"}`)) })) defer ts.Close() conf := newConf(ts.URL) _, err := conf.Exchange(context.Background(), "exchange-code") if err == nil { t.Fatalf("got no error, expected one") } re, ok := err.(RetrieveError) if !ok { t.Fatalf("got %T error, expected RetrieveError; error was: %v", err, err) } expected := `oauth2: "invalid_grant"` if errStr := err.Error(); errStr != expected { t.Fatalf("got %#v, expected %#v", errStr, expected) } expected = "invalid_grant" if re.ErrorCode != expected { t.Fatalf("got %#v, expected %#v", re.ErrorCode, expected) } } func TestRefreshToken_RefreshTokenReplacement(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"access_token":"ACCESS_TOKEN", "scope": "user", "token_type": "bearer", "refresh_token": "NEW_REFRESH_TOKEN"}`)) return })) defer ts.Close() conf := newConf(ts.URL) tkr := conf.TokenSource(context.Background(), &Token{RefreshToken: "OLD_REFRESH_TOKEN"}) tk, err := tkr.Token() if err != nil { t.Errorf("got err = %v; want none", err) return } if want := "NEW_REFRESH_TOKEN"; tk.RefreshToken != want { t.Errorf("RefreshToken = %q; want %q", tk.RefreshToken, want) } } func TestRefreshToken_RefreshTokenPreservation(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"access_token":"ACCESS_TOKEN", "scope": "user", "token_type": "bearer"}`)) return })) defer ts.Close() conf := newConf(ts.URL) const oldRefreshToken = "OLD_REFRESH_TOKEN" tkr := conf.TokenSource(context.Background(), &Token{RefreshToken: oldRefreshToken}) tk, err := tkr.Token() if err != nil { t.Fatalf("got err = %v; want none", err) } if tk.RefreshToken != oldRefreshToken { t.Errorf("RefreshToken = %q; want %q", tk.RefreshToken, oldRefreshToken) } } func TestConfigClientWithToken(t testing.T) { tok := &Token{ AccessToken: "abc123", } ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if got, want := r.Header.Get("Authorization"), fmt.Sprintf("Bearer %s", tok.AccessToken); got != want { t.Errorf("Authorization header = %q; want %q", got, want) } return })) defer ts.Close() conf := newConf(ts.URL) c := conf.Client(context.Background(), tok) req, err := http.NewRequest("GET", ts.URL, nil) if err != nil { t.Error(err) } _, err = c.Do(req) if err != nil { t.Error(err) } }	19.55 KB	2025-05-25 12:27
📁 odnoklassniki	-	2025-05-25 12:27
📁 paypal	-	2025-05-25 12:27
📄 pkce.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2 import ( "crypto/rand" "crypto/sha256" "encoding/base64" "net/url" ) const ( codeChallengeKey = "code_challenge" codeChallengeMethodKey = "code_challenge_method" codeVerifierKey = "code_verifier" ) // GenerateVerifier generates a PKCE code verifier with 32 octets of randomness. // This follows recommendations in RFC 7636. // // A fresh verifier should be generated for each authorization. // S256ChallengeOption(verifier) should then be passed to Config.AuthCodeURL // (or Config.DeviceAccess) and VerifierOption(verifier) to Config.Exchange // (or Config.DeviceAccessToken). func GenerateVerifier() string { // "RECOMMENDED that the output of a suitable random number generator be // used to create a 32-octet sequence. The octet sequence is then // base64url-encoded to produce a 43-octet URL-safe string to use as the // code verifier." // https://datatracker.ietf.org/doc/html/rfc7636#section-4.1 data := make([]byte, 32) if _, err := rand.Read(data); err != nil { panic(err) } return base64.RawURLEncoding.EncodeToString(data) } // VerifierOption returns a PKCE code verifier AuthCodeOption. It should be // passed to Config.Exchange or Config.DeviceAccessToken only. func VerifierOption(verifier string) AuthCodeOption { return setParam{k: codeVerifierKey, v: verifier} } // S256ChallengeFromVerifier returns a PKCE code challenge derived from verifier with method S256. // // Prefer to use S256ChallengeOption where possible. func S256ChallengeFromVerifier(verifier string) string { sha := sha256.Sum256([]byte(verifier)) return base64.RawURLEncoding.EncodeToString(sha[:]) } // S256ChallengeOption derives a PKCE code challenge derived from verifier with // method S256. It should be passed to Config.AuthCodeURL or Config.DeviceAccess // only. func S256ChallengeOption(verifier string) AuthCodeOption { return challengeOption{ challenge_method: "S256", challenge: S256ChallengeFromVerifier(verifier), } } type challengeOption struct{ challenge_method, challenge string } func (p challengeOption) setValue(m url.Values) { m.Set(codeChallengeMethodKey, p.challenge_method) m.Set(codeChallengeKey, p.challenge) }	2.3 KB	2025-05-25 12:27
📁 slack	-	2025-05-25 12:27
📁 spotify	-	2025-05-25 12:27
📁 stackoverflow	-	2025-05-25 12:27
📄 token.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2 import ( "context" "fmt" "net/http" "net/url" "strconv" "strings" "time" "golang.org/x/oauth2/internal" ) // defaultExpiryDelta determines how earlier a token should be considered // expired than its actual expiration time. It is used to avoid late // expirations due to client-server time mismatches. const defaultExpiryDelta = 10 * time.Second // Token represents the credentials used to authorize // the requests to access protected resources on the OAuth 2.0 // provider's backend. // // Most users of this package should not access fields of Token // directly. They're exported mostly for use by related packages // implementing derivative OAuth2 flows. type Token struct { // AccessToken is the token that authorizes and authenticates // the requests. AccessToken string `json:"access_token"` // TokenType is the type of token. // The Type method returns either this or "Bearer", the default. TokenType string `json:"token_type,omitempty"` // RefreshToken is a token that's used by the application // (as opposed to the user) to refresh the access token // if it expires. RefreshToken string `json:"refresh_token,omitempty"` // Expiry is the optional expiration time of the access token. // // If zero, TokenSource implementations will reuse the same // token forever and RefreshToken or equivalent // mechanisms for that TokenSource will not be used. Expiry time.Time `json:"expiry,omitempty"` // ExpiresIn is the OAuth2 wire format "expires_in" field, // which specifies how many seconds later the token expires, // relative to an unknown time base approximately around "now". // It is the application's responsibility to populate // `Expiry` from `ExpiresIn` when required. ExpiresIn int64 `json:"expires_in,omitempty"` // raw optionally contains extra metadata from the server // when updating a token. raw interface{} // expiryDelta is used to calculate when a token is considered // expired, by subtracting from Expiry. If zero, defaultExpiryDelta // is used. expiryDelta time.Duration } // Type returns t.TokenType if non-empty, else "Bearer". func (t Token) Type() string { if strings.EqualFold(t.TokenType, "bearer") { return "Bearer" } if strings.EqualFold(t.TokenType, "mac") { return "MAC" } if strings.EqualFold(t.TokenType, "basic") { return "Basic" } if t.TokenType != "" { return t.TokenType } return "Bearer" } // SetAuthHeader sets the Authorization header to r using the access // token in t. // // This method is unnecessary when using Transport or an HTTP Client // returned by this package. func (t Token) SetAuthHeader(r http.Request) { r.Header.Set("Authorization", t.Type()+" "+t.AccessToken) } // WithExtra returns a new Token that's a clone of t, but using the // provided raw extra map. This is only intended for use by packages // implementing derivative OAuth2 flows. func (t Token) WithExtra(extra interface{}) Token { t2 := new(Token) t2 = t t2.raw = extra return t2 } // Extra returns an extra field. // Extra fields are key-value pairs returned by the server as a // part of the token retrieval response. func (t Token) Extra(key string) interface{} { if raw, ok := t.raw.(map[string]interface{}); ok { return raw[key] } vals, ok := t.raw.(url.Values) if !ok { return nil } v := vals.Get(key) switch s := strings.TrimSpace(v); strings.Count(s, ".") { case 0: // Contains no "."; try to parse as int if i, err := strconv.ParseInt(s, 10, 64); err == nil { return i } case 1: // Contains a single "."; try to parse as float if f, err := strconv.ParseFloat(s, 64); err == nil { return f } } return v } // timeNow is time.Now but pulled out as a variable for tests. var timeNow = time.Now // expired reports whether the token is expired. // t must be non-nil. func (t Token) expired() bool { if t.Expiry.IsZero() { return false } expiryDelta := defaultExpiryDelta if t.expiryDelta != 0 { expiryDelta = t.expiryDelta } return t.Expiry.Round(0).Add(-expiryDelta).Before(timeNow()) } // Valid reports whether t is non-nil, has an AccessToken, and is not expired. func (t Token) Valid() bool { return t != nil && t.AccessToken != "" && !t.expired() } // tokenFromInternal maps an internal.Token struct into // a Token struct. func tokenFromInternal(t internal.Token) Token { if t == nil { return nil } return &Token{ AccessToken: t.AccessToken, TokenType: t.TokenType, RefreshToken: t.RefreshToken, Expiry: t.Expiry, raw: t.Raw, } } // retrieveToken takes a Config and uses that to retrieve an internal.Token. // This token is then mapped from internal.Token into an oauth2.Token which is returned along // with an error.. func retrieveToken(ctx context.Context, c Config, v url.Values) (Token, error) { tk, err := internal.RetrieveToken(ctx, c.ClientID, c.ClientSecret, c.Endpoint.TokenURL, v, internal.AuthStyle(c.Endpoint.AuthStyle), c.authStyleCache.Get()) if err != nil { if rErr, ok := err.(internal.RetrieveError); ok { return nil, (RetrieveError)(rErr) } return nil, err } return tokenFromInternal(tk), nil } // RetrieveError is the error returned when the token endpoint returns a // non-2XX HTTP status code or populates RFC 6749's 'error' parameter. // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 type RetrieveError struct { Response http.Response // Body is the body that was consumed by reading Response.Body. // It may be truncated. Body []byte // ErrorCode is RFC 6749's 'error' parameter. ErrorCode string // ErrorDescription is RFC 6749's 'error_description' parameter. ErrorDescription string // ErrorURI is RFC 6749's 'error_uri' parameter. ErrorURI string } func (r RetrieveError) Error() string { if r.ErrorCode != "" { s := fmt.Sprintf("oauth2: %q", r.ErrorCode) if r.ErrorDescription != "" { s += fmt.Sprintf(" %q", r.ErrorDescription) } if r.ErrorURI != "" { s += fmt.Sprintf(" %q", r.ErrorURI) } return s } return fmt.Sprintf("oauth2: cannot fetch token: %v\nResponse: %s", r.Response.Status, r.Body) }	6.13 KB	2025-05-25 12:27
📄 token_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2 import ( "testing" "time" ) func TestTokenExtra(t testing.T) { type testCase struct { key string val interface{} want interface{} } const key = "extra-key" cases := []testCase{ {key: key, val: "abc", want: "abc"}, {key: key, val: 123, want: 123}, {key: key, val: "", want: ""}, {key: "other-key", val: "def", want: nil}, } for _, tc := range cases { extra := make(map[string]interface{}) extra[tc.key] = tc.val tok := &Token{raw: extra} if got, want := tok.Extra(key), tc.want; got != want { t.Errorf("Extra(%q) = %q; want %q", key, got, want) } } } func TestTokenExpiry(t testing.T) { now := time.Now() timeNow = func() time.Time { return now } defer func() { timeNow = time.Now }() cases := []struct { name string tok Token want bool }{ {name: "12 seconds", tok: &Token{Expiry: now.Add(12 time.Second)}, want: false}, {name: "10 seconds", tok: &Token{Expiry: now.Add(defaultExpiryDelta)}, want: false}, {name: "10 seconds-1ns", tok: &Token{Expiry: now.Add(defaultExpiryDelta - 1time.Nanosecond)}, want: true}, {name: "-1 hour", tok: &Token{Expiry: now.Add(-1 time.Hour)}, want: true}, {name: "12 seconds, custom expiryDelta", tok: &Token{Expiry: now.Add(12 * time.Second), expiryDelta: time.Second * 5}, want: false}, {name: "5 seconds, custom expiryDelta", tok: &Token{Expiry: now.Add(time.Second * 5), expiryDelta: time.Second * 5}, want: false}, {name: "5 seconds-1ns, custom expiryDelta", tok: &Token{Expiry: now.Add(time.Second5 - 1time.Nanosecond), expiryDelta: time.Second * 5}, want: true}, {name: "-1 hour, custom expiryDelta", tok: &Token{Expiry: now.Add(-1 * time.Hour), expiryDelta: time.Second * 5}, want: true}, } for _, tc := range cases { if got, want := tc.tok.expired(), tc.want; got != want { t.Errorf("expired (%q) = %v; want %v", tc.name, got, want) } } } func TestTokenTypeMethod(t testing.T) { cases := []struct { name string tok Token want string }{ {name: "bearer-mixed_case", tok: &Token{TokenType: "beAREr"}, want: "Bearer"}, {name: "default-bearer", tok: &Token{}, want: "Bearer"}, {name: "basic", tok: &Token{TokenType: "basic"}, want: "Basic"}, {name: "basic-capitalized", tok: &Token{TokenType: "Basic"}, want: "Basic"}, {name: "mac", tok: &Token{TokenType: "mac"}, want: "MAC"}, {name: "mac-caps", tok: &Token{TokenType: "MAC"}, want: "MAC"}, {name: "mac-mixed_case", tok: &Token{TokenType: "mAc"}, want: "MAC"}, } for _, tc := range cases { if got, want := tc.tok.Type(), tc.want; got != want { t.Errorf("TokenType(%q) = %v; want %v", tc.name, got, want) } } }	2.73 KB	2025-05-25 12:27
📄 transport.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package oauth2 import ( "errors" "log" "net/http" "sync" ) // Transport is an http.RoundTripper that makes OAuth 2.0 HTTP requests, // wrapping a base RoundTripper and adding an Authorization header // with a token from the supplied Sources. // // Transport is a low-level mechanism. Most code will use the // higher-level Config.Client method instead. type Transport struct { // Source supplies the token to add to outgoing requests' // Authorization headers. Source TokenSource // Base is the base RoundTripper used to make HTTP requests. // If nil, http.DefaultTransport is used. Base http.RoundTripper } // RoundTrip authorizes and authenticates the request with an // access token from Transport's Source. func (t Transport) RoundTrip(req http.Request) (http.Response, error) { reqBodyClosed := false if req.Body != nil { defer func() { if !reqBodyClosed { req.Body.Close() } }() } if t.Source == nil { return nil, errors.New("oauth2: Transport's Source is nil") } token, err := t.Source.Token() if err != nil { return nil, err } req2 := cloneRequest(req) // per RoundTripper contract token.SetAuthHeader(req2) // req.Body is assumed to be closed by the base RoundTripper. reqBodyClosed = true return t.base().RoundTrip(req2) } var cancelOnce sync.Once // CancelRequest does nothing. It used to be a legacy cancellation mechanism // but now only it only logs on first use to warn that it's deprecated. // // Deprecated: use contexts for cancellation instead. func (t Transport) CancelRequest(req http.Request) { cancelOnce.Do(func() { log.Printf("deprecated: golang.org/x/oauth2: Transport.CancelRequest no longer does anything; use contexts") }) } func (t Transport) base() http.RoundTripper { if t.Base != nil { return t.Base } return http.DefaultTransport } // cloneRequest returns a clone of the provided http.Request. // The clone is a shallow copy of the struct and its Header map. func cloneRequest(r http.Request) http.Request { // shallow copy of the struct r2 := new(http.Request) r2 = *r // deep copy of the Header r2.Header = make(http.Header, len(r.Header)) for k, s := range r.Header { r2.Header[k] = append([]string(nil), s...) } return r2 }	2.35 KB	2025-05-25 12:27
📄 transport_test.go package oauth2 import ( "errors" "io" "net/http" "net/http/httptest" "testing" "time" ) type tokenSource struct{ token Token } func (t tokenSource) Token() (Token, error) { return t.token, nil } func TestTransportNilTokenSource(t testing.T) { tr := &Transport{} server := newMockServer(func(w http.ResponseWriter, r http.Request) {}) defer server.Close() client := &http.Client{Transport: tr} resp, err := client.Get(server.URL) if err == nil { t.Errorf("got no errors, want an error with nil token source") } if resp != nil { t.Errorf("Response = %v; want nil", resp) } } type readCloseCounter struct { CloseCount int ReadErr error } func (r readCloseCounter) Read(b []byte) (int, error) { return 0, r.ReadErr } func (r readCloseCounter) Close() error { r.CloseCount++ return nil } func TestTransportCloseRequestBody(t testing.T) { tr := &Transport{} server := newMockServer(func(w http.ResponseWriter, r http.Request) {}) defer server.Close() client := &http.Client{Transport: tr} body := &readCloseCounter{ ReadErr: errors.New("readCloseCounter.Read not implemented"), } resp, err := client.Post(server.URL, "application/json", body) if err == nil { t.Errorf("got no errors, want an error with nil token source") } if resp != nil { t.Errorf("Response = %v; want nil", resp) } if expected := 1; body.CloseCount != expected { t.Errorf("Body was closed %d times, expected %d", body.CloseCount, expected) } } func TestTransportCloseRequestBodySuccess(t testing.T) { tr := &Transport{ Source: StaticTokenSource(&Token{ AccessToken: "abc", }), } server := newMockServer(func(w http.ResponseWriter, r http.Request) {}) defer server.Close() client := &http.Client{Transport: tr} body := &readCloseCounter{ ReadErr: io.EOF, } resp, err := client.Post(server.URL, "application/json", body) if err != nil { t.Errorf("got error %v; expected none", err) } if resp == nil { t.Errorf("Response is nil; expected non-nil") } if expected := 1; body.CloseCount != expected { t.Errorf("Body was closed %d times, expected %d", body.CloseCount, expected) } } func TestTransportTokenSource(t testing.T) { ts := &tokenSource{ token: &Token{ AccessToken: "abc", }, } tr := &Transport{ Source: ts, } server := newMockServer(func(w http.ResponseWriter, r http.Request) { if got, want := r.Header.Get("Authorization"), "Bearer abc"; got != want { t.Errorf("Authorization header = %q; want %q", got, want) } }) defer server.Close() client := &http.Client{Transport: tr} res, err := client.Get(server.URL) if err != nil { t.Fatal(err) } res.Body.Close() } // Test for case-sensitive token types, per https://github.com/golang/oauth2/issues/113 func TestTransportTokenSourceTypes(t testing.T) { const val = "abc" tests := []struct { key string val string want string }{ {key: "bearer", val: val, want: "Bearer abc"}, {key: "mac", val: val, want: "MAC abc"}, {key: "basic", val: val, want: "Basic abc"}, } for _, tc := range tests { ts := &tokenSource{ token: &Token{ AccessToken: tc.val, TokenType: tc.key, }, } tr := &Transport{ Source: ts, } server := newMockServer(func(w http.ResponseWriter, r http.Request) { if got, want := r.Header.Get("Authorization"), tc.want; got != want { t.Errorf("Authorization header (%q) = %q; want %q", val, got, want) } }) defer server.Close() client := &http.Client{Transport: tr} res, err := client.Get(server.URL) if err != nil { t.Fatal(err) } res.Body.Close() } } func TestTokenValidNoAccessToken(t testing.T) { token := &Token{} if token.Valid() { t.Errorf("got valid with no access token; want invalid") } } func TestExpiredWithExpiry(t testing.T) { token := &Token{ Expiry: time.Now().Add(-5 time.Hour), } if token.Valid() { t.Errorf("got valid with expired token; want invalid") } } func newMockServer(handler func(w http.ResponseWriter, r http.Request)) httptest.Server { return httptest.NewServer(http.HandlerFunc(handler)) }	3.98 KB	2025-05-25 12:27
📁 twitch	-	2025-05-25 12:27
📁 uber	-	2025-05-25 12:27
📁 vk	-	2025-05-25 12:27
📁 yahoo	-	2025-05-25 12:27
📁 yandex	-	2025-05-25 12:27

Edit File:

Terminal