Backplane.McpProtocol.Client.Authorization.CredentialStore behaviour (backplane_mcp_protocol v0.5.0)

Copy Markdown

Facade for persisted OAuth client credentials bound to an exact issuer.

Applications must configure a secure adapter that encrypts credentials at rest or stores them in a dedicated secret manager:

config :backplane_mcp_protocol, :authorization_credential_store,
  adapter: MyApp.OAuthCredentialStore

The facade does not keep credentials in application configuration, ETS, a process, or environment variables. Adapter configuration contains only connection and routing options; the adapter owns durable secure storage.

Summary

Types

adapter_opts()
credentials()
error()
key()

Callbacks

fetch(key, adapter_opts)

Fetches credentials for an exact {issuer, client_id} key.

put(key, credentials, adapter_opts)

Persists credentials for an exact {issuer, client_id} key.

Functions

fetch(issuer, client_id, opts \\ [])

Fetches credentials through the configured secure adapter.

put(issuer, client_id, credentials, opts \\ [])

Persists credentials through the configured secure adapter.

Types

adapter_opts()

@type adapter_opts() :: keyword()

credentials()

@type credentials() :: map()

error()

@type error() :: {:error, term()}

key()

@type key() :: {issuer :: String.t(), client_id :: String.t()}

Callbacks

fetch(key, adapter_opts)

@callback fetch(key(), adapter_opts()) :: {:ok, credentials()} | error()

Fetches credentials for an exact {issuer, client_id} key.

put(key, credentials, adapter_opts)

@callback put(key(), credentials(), adapter_opts()) :: :ok | error()

Persists credentials for an exact {issuer, client_id} key.

Functions

fetch(issuer, client_id, opts \\ [])

@spec fetch(String.t(), String.t(), keyword()) :: {:ok, credentials()} | error()

Fetches credentials through the configured secure adapter.

Tests and embedded callers may inject a store configuration with the :store option. Production callers normally use the two-argument form.

put(issuer, client_id, credentials, opts \\ [])

@spec put(String.t(), String.t(), credentials(), keyword()) :: :ok | error()

Persists credentials through the configured secure adapter.