planetscale 0.2.0 → 0.3.3

data/vendor/golang.org/x/oauth2/internal/token.go

@@ -1,294 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package internal
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"math"
-	"mime"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"golang.org/x/net/context/ctxhttp"
-)
-
-// Token represents the credentials used to authorize
-// the requests to access protected resources on the OAuth 2.0
-// provider's backend.
-//
-// This type is a mirror of oauth2.Token and exists to break
-// an otherwise-circular dependency. Other internal packages
-// should convert this Token into an oauth2.Token before use.
-type Token struct {
-	// AccessToken is the token that authorizes and authenticates
-	// the requests.
-	AccessToken string
-
-	// TokenType is the type of token.
-	// The Type method returns either this or "Bearer", the default.
-	TokenType string
-
-	// RefreshToken is a token that's used by the application
-	// (as opposed to the user) to refresh the access token
-	// if it expires.
-	RefreshToken string
-
-	// Expiry is the optional expiration time of the access token.
-	//
-	// If zero, TokenSource implementations will reuse the same
-	// token forever and RefreshToken or equivalent
-	// mechanisms for that TokenSource will not be used.
-	Expiry time.Time
-
-	// Raw optionally contains extra metadata from the server
-	// when updating a token.
-	Raw interface{}
-}
-
-// tokenJSON is the struct representing the HTTP response from OAuth2
-// providers returning a token in JSON form.
-type tokenJSON struct {
-	AccessToken  string         `json:"access_token"`
-	TokenType    string         `json:"token_type"`
-	RefreshToken string         `json:"refresh_token"`
-	ExpiresIn    expirationTime `json:"expires_in"` // at least PayPal returns string, while most return number
-}
-
-func (e *tokenJSON) expiry() (t time.Time) {
-	if v := e.ExpiresIn; v != 0 {
-		return time.Now().Add(time.Duration(v) * time.Second)
-	}
-	return
-}
-
-type expirationTime int32
-
-func (e *expirationTime) UnmarshalJSON(b []byte) error {
-	if len(b) == 0 || string(b) == "null" {
-		return nil
-	}
-	var n json.Number
-	err := json.Unmarshal(b, &n)
-	if err != nil {
-		return err
-	}
-	i, err := n.Int64()
-	if err != nil {
-		return err
-	}
-	if i > math.MaxInt32 {
-		i = math.MaxInt32
-	}
-	*e = expirationTime(i)
-	return nil
-}
-
-// RegisterBrokenAuthHeaderProvider previously did something. It is now a no-op.
-//
-// Deprecated: this function no longer does anything. Caller code that
-// wants to avoid potential extra HTTP requests made during
-// auto-probing of the provider's auth style should set
-// Endpoint.AuthStyle.
-func RegisterBrokenAuthHeaderProvider(tokenURL string) {}
-
-// AuthStyle is a copy of the golang.org/x/oauth2 package's AuthStyle type.
-type AuthStyle int
-
-const (
-	AuthStyleUnknown  AuthStyle = 0
-	AuthStyleInParams AuthStyle = 1
-	AuthStyleInHeader AuthStyle = 2
-)
-
-// authStyleCache is the set of tokenURLs we've successfully used via
-// RetrieveToken and which style auth we ended up using.
-// It's called a cache, but it doesn't (yet?) shrink. It's expected that
-// the set of OAuth2 servers a program contacts over time is fixed and
-// small.
-var authStyleCache struct {
-	sync.Mutex
-	m map[string]AuthStyle // keyed by tokenURL
-}
-
-// ResetAuthCache resets the global authentication style cache used
-// for AuthStyleUnknown token requests.
-func ResetAuthCache() {
-	authStyleCache.Lock()
-	defer authStyleCache.Unlock()
-	authStyleCache.m = nil
-}
-
-// lookupAuthStyle reports which auth style we last used with tokenURL
-// when calling RetrieveToken and whether we have ever done so.
-func lookupAuthStyle(tokenURL string) (style AuthStyle, ok bool) {
-	authStyleCache.Lock()
-	defer authStyleCache.Unlock()
-	style, ok = authStyleCache.m[tokenURL]
-	return
-}
-
-// setAuthStyle adds an entry to authStyleCache, documented above.
-func setAuthStyle(tokenURL string, v AuthStyle) {
-	authStyleCache.Lock()
-	defer authStyleCache.Unlock()
-	if authStyleCache.m == nil {
-		authStyleCache.m = make(map[string]AuthStyle)
-	}
-	authStyleCache.m[tokenURL] = v
-}
-
-// newTokenRequest returns a new *http.Request to retrieve a new token
-// from tokenURL using the provided clientID, clientSecret, and POST
-// body parameters.
-//
-// inParams is whether the clientID & clientSecret should be encoded
-// as the POST body. An 'inParams' value of true means to send it in
-// the POST body (along with any values in v); false means to send it
-// in the Authorization header.
-func newTokenRequest(tokenURL, clientID, clientSecret string, v url.Values, authStyle AuthStyle) (*http.Request, error) {
-	if authStyle == AuthStyleInParams {
-		v = cloneURLValues(v)
-		if clientID != "" {
-			v.Set("client_id", clientID)
-		}
-		if clientSecret != "" {
-			v.Set("client_secret", clientSecret)
-		}
-	}
-	req, err := http.NewRequest("POST", tokenURL, strings.NewReader(v.Encode()))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	if authStyle == AuthStyleInHeader {
-		req.SetBasicAuth(url.QueryEscape(clientID), url.QueryEscape(clientSecret))
-	}
-	return req, nil
-}
-
-func cloneURLValues(v url.Values) url.Values {
-	v2 := make(url.Values, len(v))
-	for k, vv := range v {
-		v2[k] = append([]string(nil), vv...)
-	}
-	return v2
-}
-
-func RetrieveToken(ctx context.Context, clientID, clientSecret, tokenURL string, v url.Values, authStyle AuthStyle) (*Token, error) {
-	needsAuthStyleProbe := authStyle == 0
-	if needsAuthStyleProbe {
-		if style, ok := lookupAuthStyle(tokenURL); ok {
-			authStyle = style
-			needsAuthStyleProbe = false
-		} else {
-			authStyle = AuthStyleInHeader // the first way we'll try
-		}
-	}
-	req, err := newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle)
-	if err != nil {
-		return nil, err
-	}
-	token, err := doTokenRoundTrip(ctx, req)
-	if err != nil && needsAuthStyleProbe {
-		// If we get an error, assume the server wants the
-		// clientID & clientSecret in a different form.
-		// See https://code.google.com/p/goauth2/issues/detail?id=31 for background.
-		// In summary:
-		// - Reddit only accepts client secret in the Authorization header
-		// - Dropbox accepts either it in URL param or Auth header, but not both.
-		// - Google only accepts URL param (not spec compliant?), not Auth header
-		// - Stripe only accepts client secret in Auth header with Bearer method, not Basic
-		//
-		// We used to maintain a big table in this code of all the sites and which way
-		// they went, but maintaining it didn't scale & got annoying.
-		// So just try both ways.
-		authStyle = AuthStyleInParams // the second way we'll try
-		req, _ = newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle)
-		token, err = doTokenRoundTrip(ctx, req)
-	}
-	if needsAuthStyleProbe && err == nil {
-		setAuthStyle(tokenURL, authStyle)
-	}
-	// Don't overwrite `RefreshToken` with an empty value
-	// if this was a token refreshing request.
-	if token != nil && token.RefreshToken == "" {
-		token.RefreshToken = v.Get("refresh_token")
-	}
-	return token, err
-}
-
-func doTokenRoundTrip(ctx context.Context, req *http.Request) (*Token, error) {
-	r, err := ctxhttp.Do(ctx, ContextClient(ctx), req)
-	if err != nil {
-		return nil, err
-	}
-	body, err := ioutil.ReadAll(io.LimitReader(r.Body, 1<<20))
-	r.Body.Close()
-	if err != nil {
-		return nil, fmt.Errorf("oauth2: cannot fetch token: %v", err)
-	}
-	if code := r.StatusCode; code < 200 || code > 299 {
-		return nil, &RetrieveError{
-			Response: r,
-			Body:     body,
-		}
-	}
-
-	var token *Token
-	content, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
-	switch content {
-	case "application/x-www-form-urlencoded", "text/plain":
-		vals, err := url.ParseQuery(string(body))
-		if err != nil {
-			return nil, err
-		}
-		token = &Token{
-			AccessToken:  vals.Get("access_token"),
-			TokenType:    vals.Get("token_type"),
-			RefreshToken: vals.Get("refresh_token"),
-			Raw:          vals,
-		}
-		e := vals.Get("expires_in")
-		expires, _ := strconv.Atoi(e)
-		if expires != 0 {
-			token.Expiry = time.Now().Add(time.Duration(expires) * time.Second)
-		}
-	default:
-		var tj tokenJSON
-		if err = json.Unmarshal(body, &tj); err != nil {
-			return nil, err
-		}
-		token = &Token{
-			AccessToken:  tj.AccessToken,
-			TokenType:    tj.TokenType,
-			RefreshToken: tj.RefreshToken,
-			Expiry:       tj.expiry(),
-			Raw:          make(map[string]interface{}),
-		}
-		json.Unmarshal(body, &token.Raw) // no error checks for optional fields
-	}
-	if token.AccessToken == "" {
-		return nil, errors.New("oauth2: server response missing access_token")
-	}
-	return token, nil
-}
-
-type RetrieveError struct {
-	Response *http.Response
-	Body     []byte
-}
-
-func (r *RetrieveError) Error() string {
-	return fmt.Sprintf("oauth2: cannot fetch token: %v\nResponse: %s", r.Response.Status, r.Body)
-}

data/vendor/golang.org/x/oauth2/internal/transport.go

@@ -1,33 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package internal
-
-import (
-	"context"
-	"net/http"
-)
-
-// HTTPClient is the context key to use with golang.org/x/net/context's
-// WithValue function to associate an *http.Client value with a context.
-var HTTPClient ContextKey
-
-// ContextKey is just an empty struct. It exists so HTTPClient can be
-// an immutable public variable with a unique type. It's immutable
-// because nobody else can create a ContextKey, being unexported.
-type ContextKey struct{}
-
-var appengineClientHook func(context.Context) *http.Client
-
-func ContextClient(ctx context.Context) *http.Client {
-	if ctx != nil {
-		if hc, ok := ctx.Value(HTTPClient).(*http.Client); ok {
-			return hc
-		}
-	}
-	if appengineClientHook != nil {
-		return appengineClientHook(ctx)
-	}
-	return http.DefaultClient
-}

data/vendor/golang.org/x/oauth2/oauth2.go

@@ -1,381 +0,0 @@
-// Copyright 2014 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package oauth2 provides support for making
-// OAuth2 authorized and authenticated HTTP requests,
-// as specified in RFC 6749.
-// It can additionally grant authorization with Bearer JWT.
-package oauth2 // import "golang.org/x/oauth2"
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-
-	"golang.org/x/oauth2/internal"
-)
-
-// NoContext is the default context you should supply if not using
-// your own context.Context (see https://golang.org/x/net/context).
-//
-// Deprecated: Use context.Background() or context.TODO() instead.
-var NoContext = context.TODO()
-
-// RegisterBrokenAuthHeaderProvider previously did something. It is now a no-op.
-//
-// Deprecated: this function no longer does anything. Caller code that
-// wants to avoid potential extra HTTP requests made during
-// auto-probing of the provider's auth style should set
-// Endpoint.AuthStyle.
-func RegisterBrokenAuthHeaderProvider(tokenURL string) {}
-
-// Config describes a typical 3-legged OAuth2 flow, with both the
-// client application information and the server's endpoint URLs.
-// For the client credentials 2-legged OAuth2 flow, see the clientcredentials
-// package (https://golang.org/x/oauth2/clientcredentials).
-type Config struct {
-	// ClientID is the application's ID.
-	ClientID string
-
-	// ClientSecret is the application's secret.
-	ClientSecret string
-
-	// Endpoint contains the resource server's token endpoint
-	// URLs. These are constants specific to each server and are
-	// often available via site-specific packages, such as
-	// google.Endpoint or github.Endpoint.
-	Endpoint Endpoint
-
-	// RedirectURL is the URL to redirect users going through
-	// the OAuth flow, after the resource owner's URLs.
-	RedirectURL string
-
-	// Scope specifies optional requested permissions.
-	Scopes []string
-}
-
-// A TokenSource is anything that can return a token.
-type TokenSource interface {
-	// Token returns a token or an error.
-	// Token must be safe for concurrent use by multiple goroutines.
-	// The returned Token must not be modified.
-	Token() (*Token, error)
-}
-
-// Endpoint represents an OAuth 2.0 provider's authorization and token
-// endpoint URLs.
-type Endpoint struct {
-	AuthURL  string
-	TokenURL string
-
-	// AuthStyle optionally specifies how the endpoint wants the
-	// client ID & client secret sent. The zero value means to
-	// auto-detect.
-	AuthStyle AuthStyle
-}
-
-// AuthStyle represents how requests for tokens are authenticated
-// to the server.
-type AuthStyle int
-
-const (
-	// AuthStyleAutoDetect means to auto-detect which authentication
-	// style the provider wants by trying both ways and caching
-	// the successful way for the future.
-	AuthStyleAutoDetect AuthStyle = 0
-
-	// AuthStyleInParams sends the "client_id" and "client_secret"
-	// in the POST body as application/x-www-form-urlencoded parameters.
-	AuthStyleInParams AuthStyle = 1
-
-	// AuthStyleInHeader sends the client_id and client_password
-	// using HTTP Basic Authorization. This is an optional style
-	// described in the OAuth2 RFC 6749 section 2.3.1.
-	AuthStyleInHeader AuthStyle = 2
-)
-
-var (
-	// AccessTypeOnline and AccessTypeOffline are options passed
-	// to the Options.AuthCodeURL method. They modify the
-	// "access_type" field that gets sent in the URL returned by
-	// AuthCodeURL.
-	//
-	// Online is the default if neither is specified. If your
-	// application needs to refresh access tokens when the user
-	// is not present at the browser, then use offline. This will
-	// result in your application obtaining a refresh token the
-	// first time your application exchanges an authorization
-	// code for a user.
-	AccessTypeOnline  AuthCodeOption = SetAuthURLParam("access_type", "online")
-	AccessTypeOffline AuthCodeOption = SetAuthURLParam("access_type", "offline")
-
-	// ApprovalForce forces the users to view the consent dialog
-	// and confirm the permissions request at the URL returned
-	// from AuthCodeURL, even if they've already done so.
-	ApprovalForce AuthCodeOption = SetAuthURLParam("prompt", "consent")
-)
-
-// An AuthCodeOption is passed to Config.AuthCodeURL.
-type AuthCodeOption interface {
-	setValue(url.Values)
-}
-
-type setParam struct{ k, v string }
-
-func (p setParam) setValue(m url.Values) { m.Set(p.k, p.v) }
-
-// SetAuthURLParam builds an AuthCodeOption which passes key/value parameters
-// to a provider's authorization endpoint.
-func SetAuthURLParam(key, value string) AuthCodeOption {
-	return setParam{key, value}
-}
-
-// AuthCodeURL returns a URL to OAuth 2.0 provider's consent page
-// that asks for permissions for the required scopes explicitly.
-//
-// State is a token to protect the user from CSRF attacks. You must
-// always provide a non-empty string and validate that it matches the
-// the state query parameter on your redirect callback.
-// See http://tools.ietf.org/html/rfc6749#section-10.12 for more info.
-//
-// Opts may include AccessTypeOnline or AccessTypeOffline, as well
-// as ApprovalForce.
-// It can also be used to pass the PKCE challenge.
-// See https://www.oauth.com/oauth2-servers/pkce/ for more info.
-func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string {
-	var buf bytes.Buffer
-	buf.WriteString(c.Endpoint.AuthURL)
-	v := url.Values{
-		"response_type": {"code"},
-		"client_id":     {c.ClientID},
-	}
-	if c.RedirectURL != "" {
-		v.Set("redirect_uri", c.RedirectURL)
-	}
-	if len(c.Scopes) > 0 {
-		v.Set("scope", strings.Join(c.Scopes, " "))
-	}
-	if state != "" {
-		// TODO(light): Docs say never to omit state; don't allow empty.
-		v.Set("state", state)
-	}
-	for _, opt := range opts {
-		opt.setValue(v)
-	}
-	if strings.Contains(c.Endpoint.AuthURL, "?") {
-		buf.WriteByte('&')
-	} else {
-		buf.WriteByte('?')
-	}
-	buf.WriteString(v.Encode())
-	return buf.String()
-}
-
-// PasswordCredentialsToken converts a resource owner username and password
-// pair into a token.
-//
-// Per the RFC, this grant type should only be used "when there is a high
-// degree of trust between the resource owner and the client (e.g., the client
-// is part of the device operating system or a highly privileged application),
-// and when other authorization grant types are not available."
-// See https://tools.ietf.org/html/rfc6749#section-4.3 for more info.
-//
-// The provided context optionally controls which HTTP client is used. See the HTTPClient variable.
-func (c *Config) PasswordCredentialsToken(ctx context.Context, username, password string) (*Token, error) {
-	v := url.Values{
-		"grant_type": {"password"},
-		"username":   {username},
-		"password":   {password},
-	}
-	if len(c.Scopes) > 0 {
-		v.Set("scope", strings.Join(c.Scopes, " "))
-	}
-	return retrieveToken(ctx, c, v)
-}
-
-// Exchange converts an authorization code into a token.
-//
-// It is used after a resource provider redirects the user back
-// to the Redirect URI (the URL obtained from AuthCodeURL).
-//
-// The provided context optionally controls which HTTP client is used. See the HTTPClient variable.
-//
-// The code will be in the *http.Request.FormValue("code"). Before
-// calling Exchange, be sure to validate FormValue("state").
-//
-// Opts may include the PKCE verifier code if previously used in AuthCodeURL.
-// See https://www.oauth.com/oauth2-servers/pkce/ for more info.
-func (c *Config) Exchange(ctx context.Context, code string, opts ...AuthCodeOption) (*Token, error) {
-	v := url.Values{
-		"grant_type": {"authorization_code"},
-		"code":       {code},
-	}
-	if c.RedirectURL != "" {
-		v.Set("redirect_uri", c.RedirectURL)
-	}
-	for _, opt := range opts {
-		opt.setValue(v)
-	}
-	return retrieveToken(ctx, c, v)
-}
-
-// Client returns an HTTP client using the provided token.
-// The token will auto-refresh as necessary. The underlying
-// HTTP transport will be obtained using the provided context.
-// The returned client and its Transport should not be modified.
-func (c *Config) Client(ctx context.Context, t *Token) *http.Client {
-	return NewClient(ctx, c.TokenSource(ctx, t))
-}
-
-// TokenSource returns a TokenSource that returns t until t expires,
-// automatically refreshing it as necessary using the provided context.
-//
-// Most users will use Config.Client instead.
-func (c *Config) TokenSource(ctx context.Context, t *Token) TokenSource {
-	tkr := &tokenRefresher{
-		ctx:  ctx,
-		conf: c,
-	}
-	if t != nil {
-		tkr.refreshToken = t.RefreshToken
-	}
-	return &reuseTokenSource{
-		t:   t,
-		new: tkr,
-	}
-}
-
-// tokenRefresher is a TokenSource that makes "grant_type"=="refresh_token"
-// HTTP requests to renew a token using a RefreshToken.
-type tokenRefresher struct {
-	ctx          context.Context // used to get HTTP requests
-	conf         *Config
-	refreshToken string
-}
-
-// WARNING: Token is not safe for concurrent access, as it
-// updates the tokenRefresher's refreshToken field.
-// Within this package, it is used by reuseTokenSource which
-// synchronizes calls to this method with its own mutex.
-func (tf *tokenRefresher) Token() (*Token, error) {
-	if tf.refreshToken == "" {
-		return nil, errors.New("oauth2: token expired and refresh token is not set")
-	}
-
-	tk, err := retrieveToken(tf.ctx, tf.conf, url.Values{
-		"grant_type":    {"refresh_token"},
-		"refresh_token": {tf.refreshToken},
-	})
-
-	if err != nil {
-		return nil, err
-	}
-	if tf.refreshToken != tk.RefreshToken {
-		tf.refreshToken = tk.RefreshToken
-	}
-	return tk, err
-}
-
-// reuseTokenSource is a TokenSource that holds a single token in memory
-// and validates its expiry before each call to retrieve it with
-// Token. If it's expired, it will be auto-refreshed using the
-// new TokenSource.
-type reuseTokenSource struct {
-	new TokenSource // called when t is expired.
-
-	mu sync.Mutex // guards t
-	t  *Token
-}
-
-// Token returns the current token if it's still valid, else will
-// refresh the current token (using r.Context for HTTP client
-// information) and return the new one.
-func (s *reuseTokenSource) Token() (*Token, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.t.Valid() {
-		return s.t, nil
-	}
-	t, err := s.new.Token()
-	if err != nil {
-		return nil, err
-	}
-	s.t = t
-	return t, nil
-}
-
-// StaticTokenSource returns a TokenSource that always returns the same token.
-// Because the provided token t is never refreshed, StaticTokenSource is only
-// useful for tokens that never expire.
-func StaticTokenSource(t *Token) TokenSource {
-	return staticTokenSource{t}
-}
-
-// staticTokenSource is a TokenSource that always returns the same Token.
-type staticTokenSource struct {
-	t *Token
-}
-
-func (s staticTokenSource) Token() (*Token, error) {
-	return s.t, nil
-}
-
-// HTTPClient is the context key to use with golang.org/x/net/context's
-// WithValue function to associate an *http.Client value with a context.
-var HTTPClient internal.ContextKey
-
-// NewClient creates an *http.Client from a Context and TokenSource.
-// The returned client is not valid beyond the lifetime of the context.
-//
-// Note that if a custom *http.Client is provided via the Context it
-// is used only for token acquisition and is not used to configure the
-// *http.Client returned from NewClient.
-//
-// As a special case, if src is nil, a non-OAuth2 client is returned
-// using the provided context. This exists to support related OAuth2
-// packages.
-func NewClient(ctx context.Context, src TokenSource) *http.Client {
-	if src == nil {
-		return internal.ContextClient(ctx)
-	}
-	return &http.Client{
-		Transport: &Transport{
-			Base:   internal.ContextClient(ctx).Transport,
-			Source: ReuseTokenSource(nil, src),
-		},
-	}
-}
-
-// ReuseTokenSource returns a TokenSource which repeatedly returns the
-// same token as long as it's valid, starting with t.
-// When its cached token is invalid, a new token is obtained from src.
-//
-// ReuseTokenSource is typically used to reuse tokens from a cache
-// (such as a file on disk) between runs of a program, rather than
-// obtaining new tokens unnecessarily.
-//
-// The initial token t may be nil, in which case the TokenSource is
-// wrapped in a caching version if it isn't one already. This also
-// means it's always safe to wrap ReuseTokenSource around any other
-// TokenSource without adverse effects.
-func ReuseTokenSource(t *Token, src TokenSource) TokenSource {
-	// Don't wrap a reuseTokenSource in itself. That would work,
-	// but cause an unnecessary number of mutex operations.
-	// Just build the equivalent one.
-	if rt, ok := src.(*reuseTokenSource); ok {
-		if t == nil {
-			// Just use it directly.
-			return rt
-		}
-		src = rt.new
-	}
-	return &reuseTokenSource{
-		t:   t,
-		new: src,
-	}
-}