mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Roland HussandDrew Newberry
8dc55e21ee
* feat(sdk/go): complete Go SDK with domain clients, auth, and hardening Add the Go SDK implementation covering all gateway RPC services with domain-typed clients, comprehensive OIDC authentication flows, fake test doubles, and proto converters. Domain clients: Sandbox, Provider, Exec, File, TCP, SSH, Policy, Profile, Health, Service, Config, Workspace, Inference, Refresh. Each client validates inputs, resolves sandboxes by name, and converts between domain types and proto at the boundary. Auth: OIDC authorization code (PKCE), device code (RFC 8628), and client credentials (RFC 6749 Section 4.4) flows with gateway config auto-resolution. Token refresh with singleflight deduplication and exponential backoff. Edge tunnel proxy for gRPC-over-WebSocket. Gateway: On-disk gateway discovery with user/system directory precedence, lazy token loading, and auth mode mapping. Testing: In-memory fake client with deep-copy isolation, watch broadcasting with filtering, and workspace-scoped object stores. Bufconn-based gRPC tests for all domain clients. Ref: #2044 Signed-off-by: Roland Huß <rhuss@redhat.com> * feat(sdk/go): add gateway client options for logger, timeout, and retry Add WithLogger, WithTimeout, and WithRetryPolicy options to the gateway package's NewClient function. These forward the corresponding Config fields (Logger, Timeout, RetryPolicy) through to the underlying SDK client, giving callers full control over observability, connection timeouts, and retry behavior when constructing clients from on-disk gateway configurations. Also adds RetryPolicy type to types package and extends Config with the three new fields. * fix(mise): sync sccache lock entry Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Roland Huß <rhuss@redhat.com> Signed-off-by: Drew Newberry <anewberry@nvidia.com> Co-authored-by: Drew Newberry <anewberry@nvidia.com>
44 lines
1.8 KiB
Go
44 lines
1.8 KiB
Go
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package oidc
|
|
|
|
import "errors"
|
|
|
|
// Sentinel errors for OIDC authentication failures. All wrapped errors
|
|
// returned by this package support classification via [errors.Is].
|
|
var (
|
|
// ErrDiscovery is returned when the OIDC discovery document
|
|
// (.well-known/openid-configuration) cannot be fetched or parsed.
|
|
ErrDiscovery = errors.New("oidc: discovery failed")
|
|
|
|
// ErrAuthCode is returned when the authorization code exchange
|
|
// fails (invalid code, expired code, provider error).
|
|
ErrAuthCode = errors.New("oidc: auth code exchange failed")
|
|
|
|
// ErrDeviceCode is returned when the device code flow fails
|
|
// (request error, expired device code, provider error).
|
|
ErrDeviceCode = errors.New("oidc: device code flow failed")
|
|
|
|
// ErrClientCredentials is returned when the client credentials
|
|
// grant fails (invalid credentials, provider error). The error
|
|
// message never contains the client secret.
|
|
ErrClientCredentials = errors.New("oidc: client credentials exchange failed")
|
|
|
|
// ErrTimeout is returned when an interactive login flow
|
|
// (browser, keyboard, or device code) exceeds its deadline.
|
|
ErrTimeout = errors.New("oidc: login timed out")
|
|
|
|
// ErrCallbackServer is returned when the localhost HTTP server
|
|
// for the authorization code redirect cannot bind to any port.
|
|
ErrCallbackServer = errors.New("oidc: callback server failed")
|
|
|
|
// ErrTokenPersist is returned when the token cannot be written
|
|
// to disk (permission error, invalid path).
|
|
ErrTokenPersist = errors.New("oidc: token persistence failed")
|
|
|
|
// ErrOIDCConfig is returned when gateway metadata is missing
|
|
// the required oidc_issuer or oidc_client_id fields.
|
|
ErrOIDCConfig = errors.New("oidc: gateway OIDC config missing")
|
|
)
|