AttestoClient.Token (AttestoClient v2.2.0)

Refresh and revoke OAuth tokens.

Network operations are deadline-bound and are never retried because a timeout can leave the remote outcome unknown. Refresh-token rotation is available through refresh/4, which uses AttestoClient.RefreshCoordinator to prevent concurrent reuse for the same application record.

Returned tokens are not persisted by this library. Applications must perform any compare-and-swap update and choose their own token/session retention policy.

Summary

Functions

refresh(coordinator, key, tokens, opts)

Refresh a token set through a single-flight coordinator.

revoke(token, opts)

Revoke a token according to RFC 7009.

Functions

refresh(coordinator, key, tokens, opts)

@spec refresh(GenServer.server(), term(), AttestoClient.TokenSet.t(), keyword()) ::
  {:ok, AttestoClient.RefreshResult.t()} | {:error, term()}

Refresh a token set through a single-flight coordinator.

Required options are :token_endpoint, :issuer, :client_id, and the :subject from the previously verified ID Token; :client_auth and :req_options match AttestoClient.AuthorizationCode.callback/3. The issuer is validated before the request so an ID Token returned with a rotated refresh token can always be verified rather than losing the rotation result after the response.

:client_auth also accepts {:private_key_jwt, jwk, assertion_opts} for an explicitly registered assertion algorithm, key id, audience, lifetime, time, or JWT id.

revoke(token, opts)

@spec revoke(
  String.t(),
  keyword()
) :: :ok | {:error, term()}

Revoke a token according to RFC 7009.

A successful 2xx response is :ok, including when the server did not know the token. Required options: :revocation_endpoint, :client_id; optional :token_type_hint, :client_auth, :req_options, and :timeout.