AshAuthentication.Oauth2Server.ClientMetadata (ash_authentication_oauth2_server v0.3.0)

Copy Markdown View Source

Shared validation for OAuth client metadata, whichever way it arrives — a Dynamic Client Registration request body (RFC 7591) or a fetched Client ID Metadata Document. Both are JSON objects with the same field vocabulary, and this server accepts the same subset from each: public clients only (token_endpoint_auth_method: "none"), the authorization_code + refresh_token grants, and code responses.

All functions take the decoded metadata map (string keys) and return :ok or {:error, error_code, description} in RFC 7591's error vocabulary.

Summary

Functions

narrow_grant_types(params)

The subset of the client's requested grant_types this server supports — what actually gets registered. Defaults to ["authorization_code"] when the field is absent.

validate_auth_method(arg1)

Validate token_endpoint_auth_method when present — public clients ("none") only.

validate_grant_types(arg1)

Validate grant_types when present.

validate_redirect_uris(arg1)

Validate redirect_uris: required, non-empty, and every entry must be https (or http on a loopback host), have a host, and carry no fragment.

validate_response_types(arg1)

Validate response_types when present — code only.

Functions

narrow_grant_types(params)

@spec narrow_grant_types(map()) :: [String.t()]

The subset of the client's requested grant_types this server supports — what actually gets registered. Defaults to ["authorization_code"] when the field is absent.

validate_auth_method(arg1)

@spec validate_auth_method(map()) :: :ok | {:error, String.t(), String.t()}

Validate token_endpoint_auth_method when present — public clients ("none") only.

validate_grant_types(arg1)

@spec validate_grant_types(map()) :: :ok | {:error, String.t(), String.t()}

Validate grant_types when present.

The client must list authorization_code — it is the only way to obtain a token from this server. Grants beyond what this server supports are tolerated rather than rejected: RFC 7591 §2 lets the server "reject or replace" requested metadata, and a client's metadata (particularly a CIMD document, which is shared across every server the client talks to) routinely describes capabilities aimed at other authorization servers. The stored registration is narrowed to the supported subset via narrow_grant_types/1.

validate_redirect_uris(arg1)

@spec validate_redirect_uris(map()) :: :ok | {:error, String.t(), String.t()}

Validate redirect_uris: required, non-empty, and every entry must be https (or http on a loopback host), have a host, and carry no fragment.

validate_response_types(arg1)

@spec validate_response_types(map()) :: :ok | {:error, String.t(), String.t()}

Validate response_types when present — code only.