Source File
	sso.go

Belonging Package
	github.com/workos/workos-go/v9

// Code generated by oagen. DO NOT EDIT.

package workos

import (
	"context"
	"fmt"
	"net/url"
	"strings"
)

// SSOService handles SSO operations.
type SSOService struct {
	client *Client
}

// SSOListConnectionsParams contains the parameters for ListConnections.
type SSOListConnectionsParams struct {
	PaginationParams
	// ConnectionType is filter Connections by their type.
	ConnectionType *ConnectionsConnectionType `url:"connection_type,omitempty" json:"-"`
	// Domain is filter Connections by their associated domain.
	Domain *string `url:"domain,omitempty" json:"-"`
	// OrganizationID is filter Connections by their associated organization.
	OrganizationID *string `url:"organization_id,omitempty" json:"-"`
	// Search is searchable text to match against Connection names.
	Search *string `url:"search,omitempty" json:"-"`
}

// ListConnections
// Get a list of all of your existing connections matching the criteria specified.
func (s *SSOService) ListConnections(ctx context.Context, params *SSOListConnectionsParams, opts ...RequestOption) *Iterator[Connection] {
	return newIterator[Connection](ctx, s.client, "GET", "/connections", params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// GetConnection get a Connection
// Get the details of an existing connection.
func (s *SSOService) GetConnection(ctx context.Context, id string, opts ...RequestOption) (*Connection, error) {
	var result Connection
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/connections/%s", url.PathEscape(id)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// DeleteConnection delete a Connection
// Permanently deletes an existing connection. It cannot be undone.
func (s *SSOService) DeleteConnection(ctx context.Context, id string, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/connections/%s", url.PathEscape(id)), nil, nil, nil, opts)
	return err
}

// SSOGetAuthorizationURLParams contains the parameters for GetAuthorizationURL.
type SSOGetAuthorizationURLParams struct {
	// ProviderScopes is additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.
	ProviderScopes []string `url:"provider_scopes,omitempty" json:"-"`
	// ProviderQueryParams is key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.
	ProviderQueryParams map[string]string `url:"provider_query_params,omitempty" json:"-"`
	// Domain is deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.
	//
	// Deprecated: this parameter is deprecated.
	Domain *string `url:"domain,omitempty" json:"-"`
	// Provider is used to initiate OAuth authentication with various providers.
	Provider *SSOProvider `url:"provider,omitempty" json:"-"`
	// RedirectURI is where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.
	RedirectURI string `url:"redirect_uri" json:"-"`
	// State is an optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.
	State *string `url:"state,omitempty" json:"-"`
	// Connection is used to initiate SSO for a connection. The value should be a WorkOS connection ID.
	// You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.
	Connection *string `url:"connection,omitempty" json:"-"`
	// Organization is used to initiate SSO for an organization. The value should be a WorkOS organization ID.
	// You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.
	Organization *string `url:"organization,omitempty" json:"-"`
	// DomainHint is can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.
	DomainHint *string `url:"domain_hint,omitempty" json:"-"`
	// LoginHint is can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.
	LoginHint *string `url:"login_hint,omitempty" json:"-"`
	// Nonce is a random string generated by the client that is used to mitigate replay attacks.
	Nonce *string `url:"nonce,omitempty" json:"-"`
}

// GetAuthorizationURL initiate SSO
// Initiates the single sign-on flow.
func (s *SSOService) GetAuthorizationURL(params *SSOGetAuthorizationURLParams, opts ...RequestOption) string {
	query := url.Values{}
	query.Set("response_type", "code")
	if s.client.clientID != "" {
		query.Set("client_id", s.client.clientID)
	}
	if params.ProviderScopes != nil {
		query.Set("provider_scopes", strings.Join(params.ProviderScopes, ","))
	}
	if params.ProviderQueryParams != nil {
		for k, v := range params.ProviderQueryParams {
			query.Set(fmt.Sprintf("provider_query_params[%s]", k), fmt.Sprintf("%v", v))
		}
	}
	if params.Domain != nil {
		query.Set("domain", *params.Domain)
	}
	if params.Provider != nil {
		query.Set("provider", fmt.Sprintf("%v", *params.Provider))
	}
	query.Set("redirect_uri", params.RedirectURI)
	if params.State != nil {
		query.Set("state", *params.State)
	}
	if params.Connection != nil {
		query.Set("connection", *params.Connection)
	}
	if params.Organization != nil {
		query.Set("organization", *params.Organization)
	}
	if params.DomainHint != nil {
		query.Set("domain_hint", *params.DomainHint)
	}
	if params.LoginHint != nil {
		query.Set("login_hint", *params.LoginHint)
	}
	if params.Nonce != nil {
		query.Set("nonce", *params.Nonce)
	}
	return s.client.buildURL("/sso/authorize", query, opts)
}

// SSOGetLogoutURLParams contains the parameters for GetLogoutURL.
type SSOGetLogoutURLParams struct {
	// Token is the logout token returned from the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
	Token string `url:"token" json:"-"`
}

// GetLogoutURL logout Redirect
// Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provider user will be identified in the browser session.
// Before redirecting to this endpoint, you need to generate a short-lived logout token using the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
func (s *SSOService) GetLogoutURL(params *SSOGetLogoutURLParams, opts ...RequestOption) string {
	query := url.Values{}
	query.Set("token", params.Token)
	return s.client.buildURL("/sso/logout", query, opts)
}

// SSOAuthorizeLogoutParams contains the parameters for AuthorizeLogout.
type SSOAuthorizeLogoutParams struct {
	// ProfileID is the unique ID of the profile to log out.
	ProfileID string `json:"profile_id" url:"-"`
}

// AuthorizeLogout logout Authorize
// You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](https://workos.com/docs/reference/sso/logout) endpoint.
func (s *SSOService) AuthorizeLogout(ctx context.Context, params *SSOAuthorizeLogoutParams, opts ...RequestOption) (*SSOLogoutAuthorizeResponse, error) {
	var result SSOLogoutAuthorizeResponse
	_, err := s.client.request(ctx, "POST", "/sso/logout/authorize", nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// GetProfile get a User Profile
// Exchange an access token for a user's [Profile](https://workos.com/docs/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](https://workos.com/docs/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
func (s *SSOService) GetProfile(ctx context.Context, opts ...RequestOption) (*Profile, error) {
	var result Profile
	_, err := s.client.request(ctx, "GET", "/sso/profile", nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// SSOGetProfileAndTokenParams contains the parameters for GetProfileAndToken.
type SSOGetProfileAndTokenParams struct {
	// Code is the authorization code received from the authorization callback.
	Code string `json:"code" url:"-"`
}

// getProfileAndTokenBody is the JSON request body for GetProfileAndToken.
type getProfileAndTokenBody struct {
	GrantType    string `json:"grant_type"`
	Code         string `json:"code"`
	ClientID     string `json:"client_id,omitempty"`
	ClientSecret string `json:"client_secret,omitempty"`
}

// GetProfileAndToken get a Profile and Token
// Get an access token along with the user [Profile](https://workos.com/docs/reference/sso/profile) using the code passed to your [Redirect URI](https://workos.com/docs/reference/sso/get-authorization-url/redirect-uri).
func (s *SSOService) GetProfileAndToken(ctx context.Context, params *SSOGetProfileAndTokenParams, opts ...RequestOption) (*SSOTokenResponse, error) {
	body := getProfileAndTokenBody{
		GrantType: "authorization_code",
		Code:      params.Code,
	}
	body.ClientID = s.client.clientID
	body.ClientSecret = s.client.apiKey
	var result SSOTokenResponse
	_, err := s.client.request(ctx, "POST", "/sso/token", params, body, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

The pages are generated with Golds v0.8.2. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @zigo_101 (reachable from the left QR code) to get the latest news of Golds.