Modules
A Phoenix/Ecto OAuth 2.0 / OIDC authorization-server and
resource-server layer built on top of Attesto.
The host-owned OAuth client registry contract (RFC 6749 §2 / §3.1.2).
Configuration for the attesto_phoenix authorization-server layer.
The host-owned resource-owner authentication and consent contract (RFC 6749 §3.1 / §4.1.1, OpenID Connect Core §3.1.2).
OAuth 2.0 / OpenID Connect authorization endpoint (RFC 6749 §3.1, OIDC Core §3.1.2).
RFC 8414 - OAuth 2.0 Authorization Server Metadata endpoint.
GET /.well-known/jwks.json - the JSON Web Key Set (RFC 7517 §5).
OpenID Connect Discovery 1.0 - OpenID Provider Metadata endpoint.
Pushed Authorization Request endpoint (RFC 9126).
OAuth 2.0 Dynamic Client Registration endpoint (RFC 7591 §3).
POST /oauth/revoke - OAuth 2.0 Token Revocation (RFC 7009).
OAuth 2.0 token endpoint (RFC 6749 §3.2).
OpenID Connect UserInfo endpoint (OpenID Connect Core 1.0 §5.3).
Neutral event struct and dispatcher for the optional :on_event callback.
The host-owned audit/telemetry contract.
The error value type and the wire-rendering helpers for the authorization-server controllers and the protected-resource plugs.
Behaviour for Pushed Authorization Request storage (RFC 9126).
Phoenix-friendly protected-resource authentication.
Phoenix alias for Attesto.Plug.RequireScopes.
The host-owned subject/principal contract.
The host-owned dynamic client registration persistence contract (RFC 7591 §3 / RFC 7592 §2).
Neutral request-fact helpers the OAuth 2.0 / OIDC flows derive from a Plug.Conn.
Router macro that mounts the authorization-server endpoints.
Ecto schema for the single-use authorization codes backing an
Attesto.CodeStore.
Ecto schema for a single server-issued DPoP nonce (RFC 9449 §8).
Ecto schema for one recorded DPoP proof jti (JWT ID).
Ecto schema for the refresh-token records that back an Ecto-backed
Attesto.RefreshStore.
The host-owned scope-authorization contract (RFC 6749 §3.3).
Ecto implementation of the Attesto.CodeStore behaviour.
Postgres-backed Attesto.DPoP.NonceStore for clustered deployments
(RFC 9449 §8).
Ecto implementation of the Attesto.RefreshStore behaviour.
Ecto-backed, shared-store jti replay check for DPoP proofs
(RFC 9449 §11.1).
Single-node ETS Pushed Authorization Request store.
Optional periodic housekeeping GenServer that deletes expired rows from the
Ecto-backed authorization-code, refresh-token, DPoP-nonce, and DPoP-replay
tables.
Mix Tasks
Generates an Ecto migration that creates the persistence backing the
Ecto-based stores ship with attesto_phoenix.
Installs the attesto_phoenix authorization-server layer into a Phoenix app