Merge pull request #9 from riptideslabs/anthropic-wid

waynz0r · web-flow · commit 850e19a3a62a · 2026-05-12T11:44:06.000+02:00
Add RFC 7523 JWT-bearer token exchange provider and improve code structure
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -14,23 +14,22 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.mod
-    - name: vet
-      run: make vet
-
-    - name: fmt
-      run: make fmt
-
-    - name: golangci-lint
-      uses: golangci/golangci-lint-action@v7
-      with:
-        version: v2.0
-          
-    - name: Build
-      run: go build -v ./...
+      - uses: actions/checkout@v4
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: vet
+        run: make vet
+
+      - name: fmt
+        run: make fmt
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.9
+
+      - name: Build
+        run: go build -v ./...
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -23,6 +23,9 @@ linters:
     - varnamelen
     - wrapcheck
     - wsl
+    - funcorder
+    - wsl_v5
+    - noinlineerr
   settings:
     gocyclo:
       min-complexity: 20
diff --git a/Makefile b/Makefile
@@ -9,7 +9,7 @@ GOPRIVATE = github.com/riptidesio,go.riptides.io
 
 # Dependency versions
 LICENSEI_VERSION = 0.9.0
-GOLANGCI_VERSION = 2.0.2
+GOLANGCI_VERSION = 2.9.0
 LICSENSEI_VERSION = 0.0.1
 
 .PHONY: help
diff --git a/pkg/aws/option.go b/pkg/aws/option.go
@@ -15,6 +15,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/azure/option.go b/pkg/azure/option.go
@@ -15,6 +15,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/gcp/option.go b/pkg/gcp/option.go
@@ -17,6 +17,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/gcp/sts.go b/pkg/gcp/sts.go
@@ -16,6 +16,7 @@ import (
 
 type stsAccessTokenSource struct {
 	oauth2.TokenSource
+
 	stsService *stsv1.Service
 
 	idTokenProvider token.IdentityTokenProvider
diff --git a/pkg/generic/option.go b/pkg/generic/option.go
@@ -17,6 +17,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/k8ssecret/option.go b/pkg/k8ssecret/option.go
@@ -12,6 +12,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/oauth2cc/option.go b/pkg/oauth2cc/option.go
@@ -16,6 +16,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/oci/option.go b/pkg/oci/option.go
@@ -15,6 +15,7 @@ type (
 	}
 	credentialsOption struct {
 		option.Option
+
 		f func(*credentialsConfig)
 	}
 )
diff --git a/pkg/option/value.go b/pkg/option/value.go
@@ -10,6 +10,7 @@ type (
 	}
 	valueOption[T any] struct {
 		Option
+
 		id any
 		v  T
 	}
diff --git a/pkg/rfc7523/anthropic.go b/pkg/rfc7523/anthropic.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2026 Riptides Labs, Inc.
+// SPDX-License-Identifier: MIT
+
+package rfc7523
+
+import (
+	"context"
+
+	"github.com/go-logr/logr"
+
+	"go.riptides.io/tokenex/pkg/option"
+	"go.riptides.io/tokenex/pkg/token"
+)
+
+const anthropicTokenEndpoint = "https://api.anthropic.com/v1/oauth/token"
+
+// AnthropicWIFConfig holds the Anthropic-specific fields required for Workload Identity Federation.
+// See https://platform.claude.com/docs/en/manage-claude/workload-identity-federation
+type AnthropicWIFConfig struct {
+	FederationRuleID string
+	OrganizationID   string
+	ServiceAccountID string
+	WorkspaceID      string
+}
+
+// GetAnthropicCredentials is a convenience wrapper around GetCredentials for the Anthropic WIF endpoint.
+// It sets BodyFormatJSON and injects the required Anthropic fields, accepting any additional options.
+func GetAnthropicCredentials(
+	ctx context.Context,
+	logger logr.Logger,
+	tokenProvider token.IdentityTokenProvider,
+	wif AnthropicWIFConfig,
+	opts ...option.Option,
+) (<-chan Credential, error) {
+	p, err := NewCredentialsProvider(ctx, logger)
+	if err != nil {
+		return nil, err
+	}
+
+	anthropicOpts := []option.Option{
+		WithBodyFormat(BodyFormatJSON),
+		WithAdditionalFields(map[string]string{
+			"federation_rule_id": wif.FederationRuleID,
+			"organization_id":    wif.OrganizationID,
+			"service_account_id": wif.ServiceAccountID,
+			"workspace_id":       wif.WorkspaceID,
+		}),
+	}
+
+	return p.GetCredentials(ctx, anthropicTokenEndpoint, tokenProvider, append(anthropicOpts, opts...)...)
+}
diff --git a/pkg/rfc7523/option.go b/pkg/rfc7523/option.go
@@ -0,0 +1,91 @@
+// Copyright (c) 2026 Riptides Labs, Inc.
+// SPDX-License-Identifier: MIT
+
+package rfc7523
+
+import (
+	"net/http"
+
+	"go.riptides.io/tokenex/pkg/option"
+	"go.riptides.io/tokenex/pkg/token"
+)
+
+type (
+	CredentialsOption interface {
+		Apply(*credentialsConfig)
+	}
+	credentialsOption struct {
+		option.Option
+
+		f func(*credentialsConfig)
+	}
+)
+
+func (o *credentialsOption) Apply(c *credentialsConfig) {
+	o.f(c)
+}
+
+func withCredentialsOption(f func(*credentialsConfig)) option.Option {
+	return &credentialsOption{option.OptionImpl{}, f}
+}
+
+func isCredentialsOption(opt any) (CredentialsOption, bool) {
+	if o, ok := opt.(*credentialsOption); ok {
+		return o, ok
+	}
+
+	return nil, false
+}
+
+// WithTokenEndpointURL sets the OAuth2 token endpoint URL.
+func WithTokenEndpointURL(tokenEndpointURL string) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.tokenEndpointURL = tokenEndpointURL
+	})
+}
+
+// WithTokenProvider sets the identity token provider whose JWT will be used as the assertion.
+func WithTokenProvider(tp token.IdentityTokenProvider) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.tokenProvider = tp
+	})
+}
+
+// WithScopes sets the OAuth2 scopes to request.
+func WithScopes(scopes []string) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.scopes = scopes
+	})
+}
+
+// WithAdditionalParams sets extra key→values merged into a form-encoded request body.
+// Only effective when BodyFormatForm is used (the default).
+func WithAdditionalParams(params map[string][]string) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.additionalParams = params
+	})
+}
+
+// WithAdditionalFields sets extra key→value pairs merged into a JSON request body.
+// Only effective when BodyFormatJSON is used.
+func WithAdditionalFields(fields map[string]string) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.additionalFields = fields
+	})
+}
+
+// WithBodyFormat selects the token request encoding.
+// Use BodyFormatJSON for the Anthropic WIF endpoint; BodyFormatForm (default) for standard RFC 7523 endpoints.
+func WithBodyFormat(f BodyFormat) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.bodyFormat = f
+	})
+}
+
+// WithHTTPClient sets a custom HTTP client for token endpoint requests.
+// Defaults to http.DefaultClient when not provided.
+func WithHTTPClient(client *http.Client) option.Option {
+	return withCredentialsOption(func(c *credentialsConfig) {
+		c.httpClient = client
+	})
+}
diff --git a/pkg/rfc7523/rfc7523.go b/pkg/rfc7523/rfc7523.go
diff --git a/pkg/util/gate.go b/pkg/util/gate.go
diff --git a/pkg/vault/creds.go b/pkg/vault/creds.go
diff --git a/pkg/vault/option.go b/pkg/vault/option.go

Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,7 @@ type (`
`15`	`15`	`}`
`16`	`16`	`credentialsOption struct {`
`17`	`17`	`option.Option`
	`18`	`+`
`18`	`19`	`f func(*credentialsConfig)`
`19`	`20`	`}`
`20`	`21`	`)`
Original file line number	Diff line number	Diff line change
`@@ -17,6 +17,7 @@ type (`
`17`	`17`	`}`
`18`	`18`	`credentialsOption struct {`
`19`	`19`	`option.Option`
	`20`	`+`
`20`	`21`	`f func(*credentialsConfig)`
`21`	`22`	`}`
`22`	`23`	`)`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ type (`
`12`	`12`	`}`
`13`	`13`	`credentialsOption struct {`
`14`	`14`	`option.Option`
	`15`	`+`
`15`	`16`	`f func(*credentialsConfig)`
`16`	`17`	`}`
`17`	`18`	`)`
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,7 @@ type (`
`16`	`16`	`}`
`17`	`17`	`credentialsOption struct {`
`18`	`18`	`option.Option`
	`19`	`+`
`19`	`20`	`f func(*credentialsConfig)`
`20`	`21`	`}`
`21`	`22`	`)`