logto-io / go

☁️ Logto Golang SDKs.
MIT License
19 stars 13 forks source link

feature request: GetAccessToken should generate JWT access tokens #63

Closed Tc-001 closed 1 year ago

Tc-001 commented 1 year ago

What problem did you meet?

Currently client.GetAccessToken seems to generate a global (not resource-specific even if a resource is provided) access token that is also not a JWT. Because of that, it is currently not possible to use the token for https://docs.logto.io/docs/recipes/protect-your-api/

const resource = "https://example.com/"

func getLogtoConfig() *client.LogtoConfig {
    logtoConfig := &client.LogtoConfig{
        Endpoint: "https://login.example.com", 
        AppId:    "appid",
        Resources: []string{resource},
    }
    return logtoConfig
}

// Login flow logic here

func getAccessToken() string {
    logtoConfig := getLogtoConfig()
    logtoClient := client.NewLogtoClient(
        logtoConfig,
        &SessionStorage{},
    )

    accessToken, err := logtoClient.GetAccessToken(resource)
    if err != nil {
        panic(err)
    }

    return accessToken.Token // Returns "bI3z3p99j2VGTuogz0kqI5aN3zH8G0hG8ezahZSI52j"
}

Also I am not 100% certain but I believe the correct resource isn't even passed when fetching the token here: https://github.com/logto-io/go/blob/7b2a0e1fd27c2f7ca04d6589b7812f488da0f55b/client/client.go#L109-L114

Describe what you'd like Logto to have

Calling client.GetAccessToken should return a JWT, resource-specific access token string as it does in the JS SDK: https://docs.logto.io/docs/recipes/integrate-logto/vanilla-js/#backend-api-authorization

xiaoyijun commented 1 year ago

Done in https://github.com/logto-io/go/pull/64