[Go] Support GNAP (RFC 9635) authentication

[mahmudsudo]

Summary

RFC 9635 (GNAP) is used by the Open Payments API (openpayments.dev) for
authorization. The Interledger Foundation's SDK Grant program is funding
GNAP support across the OpenAPI/Kiota toolchain:

• GNAP as an OpenAPI securityScheme (Henry Andrews, OpenAPI Initiative — in progress)
• A TypeScript Kiota implementation (Chris Wood, OpenAPI Initiative — funded)
• GNAP support for Go, Python, and PHP targets — open for proposals
  (interledger/Grants wiki: SDK-grant-program)

Client library/SDK language

None

Describe the solution you'd like

I'd like to scope a Go implementation and would appreciate maintainer input
before drafting a PR.

Proposed approach

• Implement a GNAP AccessTokenProvider in kiota-abstractions-go, matching
  the existing authentication provider interface used by other providers
• Support grant request + continuation (interactive and non-interactive)
• Support request signing per RFC 9421 (HTTP Message Signatures), required by GNAP
• Validate end-to-end against Open Payments' public test auth server
  (auth.interledger-test.dev)

Questions for maintainers

1. Should this live in kiota-abstractions-go, or elsewhere in the generator pipeline?
2. Is there design material for the TypeScript GNAP implementation to align with?
3. Open to reviewing a draft PR built against a working prototype?

[jeremiahlee]

I appreciate the enthusiasm for the Interledger Foundation's SDK Grant program. However, I must note that this issue has not been created by a grantee of the program, nor has a proposal for this specific work been awarded at this time. The official granted proposal list is maintained at interledger/Grants.

The OpenAPI Initiative has not yet ratified a way for RFC 9635 GNAP to be represented in OpenAPI Specification as a security scheme. Discussing how Kiota could add support for it may be premature at this time.

[mahmudsudo]

Thanks for the clarification, Jeremiah Lee (@jeremiahlee) appreciate you taking the time to
respond.

To be clear: I'm not claiming any grantee status or awarded proposal here,
just trying to do the scoping and maintainer engagement the program guidelines
ask for (interledger/Grants wiki notes proposals should show how you'll
engage maintainers to gather requirements before submitting). I should have
made that context explicit in the issue itself rather than assuming it; my
apologies for the ambiguity.

Good to know the OpenAPI GNAP security scheme isn't ratified yet , that
makes sense as a hard dependency, and I agree it's premature to design Kiota
support against a moving target. I'll hold off on further design discussion
here until that lands.

In the meantime I'm also looking at the Ruby target, which doesn't have that
kind of upstream dependency. I'll leave this issue open for reference but
won't push it further until there's something concrete on the OpenAPI side
to build against. Thanks again.

[gavinbarron]

I'm going to close this as this is a feature request for an unratified security scheme and has no actual expression in OAS.