@spec config(Ash.Resource.t(), struct() | nil) ::
  {:ok, OpenFeed.Config.t()} | {:error, term()}

Resolve the OpenFeed.Config for a resource.

Reads from otp_app's application config, or delegates to the configured AshOpenFeed.ConfigProvider. DSL-level settings (scopes, key_store) are layered over the result, so non-secret configuration can live next to the resource while secrets stay in runtime.exs.

grant is passed through to a provider; it is ignored for the otp_app path.

@spec config!(Ash.Resource.t(), struct() | nil) :: OpenFeed.Config.t()

Like config/2 but raises.

@spec openfeed_config_key(dsl_or_extended :: module() | map()) ::
  {:ok, atom()} | :error

The key under otp_app's config holding the OpenFeed settings.

@spec openfeed_config_key!(dsl_or_extended :: module() | map()) ::
  atom() | no_return()

The key under otp_app's config holding the OpenFeed settings.

@spec openfeed_config_provider(dsl_or_extended :: module() | map()) ::
  {:ok, atom() | {atom(), keyword()}} | :error

A module implementing AshOpenFeed.ConfigProvider, for credentials that cannot come from static config — a registration per tenant, say. The callback receives the grant record, so tenant context is available. Mutually exclusive with otp_app.

@spec openfeed_config_provider!(dsl_or_extended :: module() | map()) ::
  (atom() | {atom(), keyword()}) | no_return()

A module implementing AshOpenFeed.ConfigProvider, for credentials that cannot come from static config — a registration per tenant, say. The callback receives the grant record, so tenant context is available. Mutually exclusive with otp_app.

@spec openfeed_extra_accept(dsl_or_extended :: module() | map()) ::
  {:ok, [atom()]} | :error

Attributes of your own that upsert_from_tokens should accept, on top of the token fields.

Almost every application needs at least one of these, to attach the grant to a user:

openfeed do
  otp_app :my_app
  extra_accept [:user_id]
end

then:

AshOpenFeed.complete_authorization(Grant, code, flow,
  attributes: %{user_id: current_user.id}
)

For anything more involved than accepting a few attributes, declare your own upsert_from_tokens action — the extension will not overwrite it.

@spec openfeed_extra_accept!(dsl_or_extended :: module() | map()) ::
  [atom()] | no_return()

Attributes of your own that upsert_from_tokens should accept, on top of the token fields.

Almost every application needs at least one of these, to attach the grant to a user:

openfeed do
  otp_app :my_app
  extra_accept [:user_id]
end

then:

AshOpenFeed.complete_authorization(Grant, code, flow,
  attributes: %{user_id: current_user.id}
)

For anything more involved than accepting a few attributes, declare your own upsert_from_tokens action — the extension will not overwrite it.

@spec openfeed_grant_management?(dsl_or_extended :: module() | map()) :: boolean()

Adds the openfeed-au:grant:self:query and openfeed-au:grant:self:revoke scopes, so AshOpenFeed.revoke/2 and AshOpenFeed.refresh_status/2 can be used.

Revocation is worth having: without it you can only infer that a consumer withdrew consent, from a 403 on the next data call.

@spec openfeed_key_store(dsl_or_extended :: module() | map()) ::
  {:ok, atom() | {atom(), keyword()}} | :error

Overrides the key store from application config. See OpenFeed.KeyStore. AshOpenFeed.KeyStore.Ash is the only multi-node-safe option that needs no external secret plumbing.

@spec openfeed_key_store!(dsl_or_extended :: module() | map()) ::
  (atom() | {atom(), keyword()}) | no_return()

Overrides the key store from application config. See OpenFeed.KeyStore. AshOpenFeed.KeyStore.Ash is the only multi-node-safe option that needs no external secret plumbing.

@spec openfeed_options(dsl_or_extended :: module() | map()) :: %{
  required(atom()) => any()
}

openfeed DSL options

Returns a map containing the and any configured or default values.

@spec openfeed_otp_app(dsl_or_extended :: module() | map()) :: {:ok, atom()} | :error

The OTP application whose config holds the OpenFeed credentials, read as Application.get_env(otp_app, config_key). Required unless config_provider is set.

@spec openfeed_otp_app!(dsl_or_extended :: module() | map()) :: atom() | no_return()

The OTP application whose config holds the OpenFeed credentials, read as Application.get_env(otp_app, config_key). Required unless config_provider is set.

@spec openfeed_scopes(dsl_or_extended :: module() | map()) :: {:ok, [any()]} | :error

Scopes to request at authorization. Accepts OpenFeed.Scopes shorthands or literal scope strings.

@spec openfeed_scopes!(dsl_or_extended :: module() | map()) :: [any()] | no_return()

Scopes to request at authorization. Accepts OpenFeed.Scopes shorthands or literal scope strings.

@spec scopes(Ash.Resource.t()) :: [String.t()]

The scopes this resource requests, expanded to full scope strings.

Adds the grant-management scopes when grant_management? is set.