Supplies an OpenFeed.Config at runtime, for credentials that cannot come from static application config.

The usual case does not need this — set otp_app in the DSL and put credentials in runtime.exs. Reach for a provider when the registration varies per request: one OpenFeed app registration per tenant, for instance, or credentials held in a secrets manager that must be fetched rather than configured.

The callback receives the grant record, so anything on it — including its tenant — is available.

Example

defmodule MyApp.OpenFeed.TenantConfig do
  @behaviour AshOpenFeed.ConfigProvider

  @impl true
  def config(grant, _opts) do
    tenant = MyApp.Tenants.get!(grant.tenant_id)

    OpenFeed.Config.new(
      client_id: tenant.openfeed_client_id,
      redirect_uri: tenant.openfeed_redirect_uri,
      key_store: {AshOpenFeed.KeyStore.Ash, resource: MyApp.OpenFeed.Key, tenant: tenant.id}
    )
  end
end

And on the resource:

openfeed do
  config_provider MyApp.OpenFeed.TenantConfig
end

Building a config without a grant

Some operations happen before any grant exists — starting the consent flow, or getting a client-credentials token. Those call config/2 with nil, so a provider must handle it, or return an error explaining what it needs.