mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-28 07:13:04 +08:00
Roland HussandDrew Newberry
8dc55e21ee
* feat(sdk/go): complete Go SDK with domain clients, auth, and hardening Add the Go SDK implementation covering all gateway RPC services with domain-typed clients, comprehensive OIDC authentication flows, fake test doubles, and proto converters. Domain clients: Sandbox, Provider, Exec, File, TCP, SSH, Policy, Profile, Health, Service, Config, Workspace, Inference, Refresh. Each client validates inputs, resolves sandboxes by name, and converts between domain types and proto at the boundary. Auth: OIDC authorization code (PKCE), device code (RFC 8628), and client credentials (RFC 6749 Section 4.4) flows with gateway config auto-resolution. Token refresh with singleflight deduplication and exponential backoff. Edge tunnel proxy for gRPC-over-WebSocket. Gateway: On-disk gateway discovery with user/system directory precedence, lazy token loading, and auth mode mapping. Testing: In-memory fake client with deep-copy isolation, watch broadcasting with filtering, and workspace-scoped object stores. Bufconn-based gRPC tests for all domain clients. Ref: #2044 Signed-off-by: Roland Huß <rhuss@redhat.com> * feat(sdk/go): add gateway client options for logger, timeout, and retry Add WithLogger, WithTimeout, and WithRetryPolicy options to the gateway package's NewClient function. These forward the corresponding Config fields (Logger, Timeout, RetryPolicy) through to the underlying SDK client, giving callers full control over observability, connection timeouts, and retry behavior when constructing clients from on-disk gateway configurations. Also adds RetryPolicy type to types package and extends Config with the three new fields. * fix(mise): sync sccache lock entry Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Roland Huß <rhuss@redhat.com> Signed-off-by: Drew Newberry <anewberry@nvidia.com> Co-authored-by: Drew Newberry <anewberry@nvidia.com>
60 lines
1.9 KiB
Go
60 lines
1.9 KiB
Go
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package oidc
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
"os/exec"
|
|
"runtime"
|
|
)
|
|
|
|
// browserCommand returns the platform-specific command name and
|
|
// arguments for opening a URL in the user's default browser.
|
|
func browserCommand(url string) (string, []string) {
|
|
return browserCommandForOS(runtime.GOOS, url)
|
|
}
|
|
|
|
func browserCommandForOS(goos, url string) (string, []string) {
|
|
switch goos {
|
|
case "darwin":
|
|
return "open", []string{url}
|
|
case "linux":
|
|
return "xdg-open", []string{url}
|
|
case "windows":
|
|
// Invoke the URL handler directly. Passing an authorization URL to
|
|
// cmd.exe would allow '&' and other shell metacharacters in its query
|
|
// string to be interpreted as commands.
|
|
return "rundll32", []string{"url.dll,FileProtocolHandler", url}
|
|
default:
|
|
// Fallback: try xdg-open (common on Unix-like systems).
|
|
return "xdg-open", []string{url}
|
|
}
|
|
}
|
|
|
|
// openBrowser attempts to open the given URL in the user's default
|
|
// browser using the platform-appropriate command. Returns an error if
|
|
// the browser could not be launched.
|
|
func openBrowser(rawURL string) error {
|
|
parsed, err := url.Parse(rawURL)
|
|
if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") {
|
|
return fmt.Errorf("refusing to open non-HTTP URL: %s", rawURL)
|
|
}
|
|
name, args := browserCommand(rawURL)
|
|
return openBrowserWith(name, args...)
|
|
}
|
|
|
|
// openBrowserWith runs the given command with the provided arguments.
|
|
// This is separated from openBrowser to allow testing with arbitrary
|
|
// command names.
|
|
func openBrowserWith(name string, args ...string) error {
|
|
cmd := exec.Command(name, args...)
|
|
if err := cmd.Start(); err != nil {
|
|
return fmt.Errorf("failed to open browser with %s: %w", name, err)
|
|
}
|
|
// We don't wait for the browser process to exit. It runs
|
|
// independently, and we only care that it launched.
|
|
return nil
|
|
}
|