Remove OAuth implementation from client, improved error handling, SSE buffer adjustment (#63)

* Removed OAuth from client

* Updated go.mod dependencies

* Updates after test fixes

* Upgraded go-server version

Author: djthorpe

README.md

@@ -9,7 +9,6 @@ This repository contains a generic HTTP client which can be adapted to provide:
 * Debugging capabilities to see the request and response data
 * Streaming text and JSON events
 * OpenTelemetry tracing for distributed observability
-* OAuth 2.0 client flows including discovery, dynamic client registration, authorization code, device authorization, and client credentials
 
 API Documentation: <https://pkg.go.dev/github.com/mutablelogic/go-client>
 
@@ -21,7 +20,6 @@ There are also some example clients which use this library:
 
 There are also utility packages for working with multipart file uploads, transport middleware, and OpenTelemetry:
 
-* [OAuth 2.0 Package](https://github.com/mutablelogic/go-client/tree/main/pkg/oauth)
 * [OpenTelemetry Package](https://github.com/mutablelogic/go-client/tree/main/pkg/otel)
 * [Transport Middleware Package](https://github.com/mutablelogic/go-client/tree/main/pkg/transport)
 * [Multipart Package](https://github.com/mutablelogic/go-client/tree/main/pkg/multipart)
@@ -240,67 +238,6 @@ func main() {
 
 You can also set the token on a per-request basis using the `OptToken` option in call to the `Do` method.
 
-## OAuth 2.0
-
-The `pkg/oauth` package provides a full OAuth 2.0 client supporting discovery (RFC 8414), dynamic
-client registration (RFC 7591), authorization code + PKCE, device authorization, and client
-credentials flows. Use `c.OAuth()` to run the full flow using the client's own HTTP transport —
-the `Authorize*` methods attach the resulting credentials to the client automatically, and the
-token is refreshed transparently before each request:
-
-```go
-import (
-    "context"
-
-    client "github.com/mutablelogic/go-client"
-    oauth "github.com/mutablelogic/go-client/pkg/oauth"
-)
-
-func main() {
-    ctx := context.Background()
-
-    // Create the API client first so its HTTP transport is reused for all OAuth calls.
-    c, err := client.New(client.OptEndpoint("https://api.example.com"))
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // c.OAuth() returns a flow that injects c's HTTP transport automatically.
-    flow := c.OAuth()
-
-    // 1. Discover server metadata
-    metadata, err := flow.Discover(ctx, "https://example.com")
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // 2. Authorize (client credentials shown; see pkg/oauth for browser/device flows)
-    creds, err := flow.AuthorizeWithCredentials(ctx,
-        &oauth.OAuthCredentials{
-            Metadata:     metadata,
-            ClientID:     "my-client",
-            ClientSecret: "my-secret",
-        },
-    )
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Persist rotated refresh tokens
-    creds.OnRefresh = func(c *oauth.OAuthCredentials) error {
-        return saveToDisk(c) // your persistence logic
-    }
-
-    // 3. Attach credentials; the client refreshes the token automatically on expiry.
-    //    AuthorizeWithCredentials (and all other Authorize* methods) attach credentials
-    //    to the client automatically — no further setup needed.
-}
-```
-
-See [pkg/oauth/README.md](https://github.com/mutablelogic/go-client/tree/main/pkg/oauth) for
-the full API including browser-based, device, and manual code-paste flows, token introspection,
-and revocation.
-
 ## Form submission
 
 You can create a payload with form data:

client.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"encoding/xml"
 	"errors"
-	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -15,12 +14,9 @@ import (
 	"time"
 
 	// Package imports
-	oauth "github.com/mutablelogic/go-client/pkg/oauth"
-	otel "github.com/mutablelogic/go-client/pkg/otel"
 	transport "github.com/mutablelogic/go-client/pkg/transport"
 	httpresponse "github.com/mutablelogic/go-server/pkg/httpresponse"
 	types "github.com/mutablelogic/go-server/pkg/types"
-	oauth2 "golang.org/x/oauth2"
 )
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -49,7 +45,6 @@ type Client struct {
 	atomicToken atomic.Value                                // stores Token — lock-free; written by setToken, read by AccessToken
 	headers     map[string]string                           // setup-only: consumed by New() into HeadersTransport
 	transports  []func(http.RoundTripper) http.RoundTripper // setup-only: consumed by New()
-	oauth       *oauth.OAuthCredentials                     // OAuth credentials for automatic token refresh on requests
 }
 
 type ClientOpt func(*Client) error
@@ -143,23 +138,6 @@ func (client *Client) AccessToken() string {
 	return ""
 }
 
-// setToken stores t atomically so AccessToken() is always consistent.
-// Uses atomic.Value so no mutex is required.
-func (client *Client) setToken(t Token) {
-	client.atomicToken.Store(t)
-}
-
-func (client *Client) String() string {
-	str := "<client"
-	if client.endpoint != nil {
-		str += fmt.Sprintf(" endpoint=%q", otel.RedactedURL(client.endpoint))
-	}
-	if client.Client.Timeout > 0 {
-		str += fmt.Sprint(" timeout=", client.Client.Timeout)
-	}
-	return str + ">"
-}
-
 ///////////////////////////////////////////////////////////////////////////////
 // PUBLIC METHODS
 
@@ -191,59 +169,19 @@ func (client *Client) DoWithContext(ctx context.Context, in Payload, out any, op
 		return err
 	}
 
-	// Narrow critical section: serialise the OAuth check+refresh so that only
-	// one goroutine refreshes the token at a time (prevents thundering-herd).
-	// The lock is released before the main HTTP round-trip so concurrent
-	// requests can proceed in parallel once the token is known to be valid.
-	client.RWMutex.Lock()
-	err = client.refreshOAuth(ctx)
-	client.RWMutex.Unlock()
-	if err != nil {
-		return err
-	}
-
 	// HTTP round-trip (including redirect follows) runs without any lock.
 	// http.Client and its transport stack are safe for concurrent use.
 	return do(client.Client, req, accept, client.strict, out, opts...)
 }
 
 // Do a HTTP request and decode it into an object
 func (client *Client) Request(req *http.Request, out any, opts ...RequestOpt) error {
-	client.RWMutex.Lock()
-	err := client.refreshOAuth(req.Context())
-	client.RWMutex.Unlock()
-	if err != nil {
-		return err
-	}
-
 	return do(client.Client, req, "", false, out, opts...)
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // PRIVATE METHODS
 
-// refreshOAuth refreshes the OAuth token if credentials are set and the token
-// is expired. It injects the client's own HTTP transport into the context so
-// the refresh request honours the same proxy/TLS/logging configuration.
-// It is a no-op when no OAuth credentials are configured or the token is still valid.
-func (client *Client) refreshOAuth(ctx context.Context) error {
-	if client.oauth == nil {
-		return nil
-	}
-	if err := client.oauth.Refresh(context.WithValue(ctx, oauth2.HTTPClient, client.Client)); err != nil {
-		return err
-	}
-	scheme := client.oauth.Token.TokenType
-	if scheme == "" {
-		scheme = Bearer
-	}
-	client.setToken(Token{
-		Scheme: scheme,
-		Value:  client.oauth.Token.AccessToken,
-	})
-	return nil
-}
-
 // request creates a request which can be used to return responses. The accept
 // parameter is the accepted mime-type of the response. If the accept parameter is empty,
 // then the default is application/json.
@@ -300,7 +238,7 @@ func do(client *http.Client, req *http.Request, accept string, strict bool, out
 	// Work on a shallow copy so we never mutate the shared *http.Client.
 	// Per-request timeout and transport changes are therefore safe without
 	// needing a mutex or deferred restoration.
-	localCl := *client
+	localCl := types.Value(client)
 	if reqopts.noTimeout {
 		localCl.Timeout = 0
 	}
@@ -311,6 +249,7 @@ func do(client *http.Client, req *http.Request, accept string, strict bool, out
 		}
 		localCl.Transport = t
 	}
+
 	// Disable the standard client's redirect-following so that our manual
 	// redirect loop below actually sees 3xx responses and can enforce the
 	// method/header-preservation and cross-origin stripping rules.
@@ -392,16 +331,31 @@ func do(client *http.Client, req *http.Request, accept string, strict bool, out
 
 	// Check status code
 	if response.StatusCode < 200 || response.StatusCode > 299 {
+		var httpErr httpresponse.ErrResponse
+
 		// Read any information from the body
 		data, err := io.ReadAll(response.Body)
 		if err != nil {
 			return err
 		}
+
+		// If there's no body, return an error with just the status code
 		if len(data) == 0 {
 			return httpresponse.Err(response.StatusCode).With(response.Status)
-		} else {
+		}
+
+		// Preserve non-JSON error bodies so callers can surface useful server detail.
+		if err := json.Unmarshal(data, &httpErr); err != nil {
 			return httpresponse.Err(response.StatusCode).Withf("%s: %s", response.Status, string(data))
 		}
+
+		// If the response code doesn't match, fall back to the raw body text.
+		if httpErr.Code != response.StatusCode {
+			return httpresponse.Err(response.StatusCode).Withf("%s: %s", response.Status, string(data))
+		}
+
+		// Return the error response with any detail from the body
+		return httpErr
 	}
 
 	// When in strict mode, check content type returned is as expected.

client_test.go

@@ -97,7 +97,7 @@ func Test_OptTimeout_sets_value(t *testing.T) {
 	)
 	require.NoError(t, err)
 	// Roundtrip through String() to make sure it surface the timeout
-	assert.Contains(t, c.String(), "5s")
+	assert.Contains(t, c.Timeout.String(), "5s")
 }
 
 func Test_OptTimeout_zero(t *testing.T) {

clientopts.go

@@ -102,7 +102,7 @@ func OptRateLimit(value float32) ClientOpt {
 // overridden by the client for individual requests using OptToken.
 func OptReqToken(value Token) ClientOpt {
 	return func(client *Client) error {
-		client.setToken(value)
+		client.atomicToken.Store(value)
 		return nil
 	}
 }

go.mod

@@ -3,21 +3,20 @@ module github.com/mutablelogic/go-client
 go 1.25.0
 
 require (
-	github.com/alecthomas/kong v1.14.0
+	github.com/alecthomas/kong v1.15.0
 	github.com/andreburgaud/crypt2go v1.8.0
 	github.com/djthorpe/go-errors v1.0.3
 	github.com/djthorpe/go-tablewriter v0.0.11
-	github.com/mutablelogic/go-server v1.6.18
+	github.com/mutablelogic/go-server v1.6.22
 	github.com/stretchr/testify v1.11.1
 	github.com/xdg-go/pbkdf2 v1.0.0
-	go.opentelemetry.io/otel v1.42.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0
-	go.opentelemetry.io/otel/sdk v1.42.0
-	go.opentelemetry.io/otel/trace v1.42.0
+	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
+	go.opentelemetry.io/otel/sdk v1.43.0
+	go.opentelemetry.io/otel/trace v1.43.0
 	golang.org/x/crypto v0.49.0
-	golang.org/x/oauth2 v0.36.0
 	golang.org/x/term v0.41.0
 )
 
@@ -28,20 +27,19 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/google/jsonschema-go v0.4.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
-	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-runewidth v0.0.22 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )