Class AuthFlowDefinition
- Namespace
- Kuestenlogik.Bowire.Security.Scanner
- Assembly
- Kuestenlogik.Bowire.Security.Scanner.dll
A headless authentication flow (#190): an ordered chain of HTTP requests (login → refresh → token), each optionally capturing values from its response into named variables, ending with one variable that holds the bearer token to inject into every subsequent probe.
This is the CI-facing slice of the auth-recording epic — a
bowire scan --auth-flow flow.json runs the chain once, extracts the
token, and injects it as an auth header ahead of the scan. Interactive
grants that need a browser (OAuth auth-code / device, SAML/OIDC web-flow)
and the workbench capture UI are tracked as follow-ups.
Secrets are never inlined: request fields substitute {{env.NAME}}
from the process environment (and {{var}} from earlier captures), so
a checked-in flow file references {{env.CLIENT_SECRET}} rather than
the secret itself.
public sealed class AuthFlowDefinition- Inheritance
-
AuthFlowDefinition
- Inherited Members
Constructors
AuthFlowDefinition()
public AuthFlowDefinition()Properties
Grant
Informational grant label (client_credentials / password / refresh_token / custom). Not interpreted — the steps describe the actual requests.
[JsonPropertyName("grant")]
public string? Grant { get; init; }Property Value
InjectHeader
Header name to inject the token under. Default Authorization.
[JsonPropertyName("injectHeader")]
public string InjectHeader { get; init; }Property Value
InjectPrefix
Value prefix prepended to the token. Default Bearer (trailing space intentional). Set to empty for raw API-key headers.
[JsonPropertyName("injectPrefix")]
public string InjectPrefix { get; init; }Property Value
Steps
Ordered requests to run. Captures from earlier steps are available as {{var}} in later ones.
[JsonPropertyName("steps")]
public IReadOnlyList<AuthStep> Steps { get; init; }Property Value
Token
Captured variable that holds the token to inject. Defaults to access_token, then token when present.
[JsonPropertyName("token")]
public string? Token { get; init; }