adk_oidcc_authorization_code_adapter (erlang_adk v0.7.0)

View Source

Oidcc 3.7 authorization-code adapter with mandatory S256 PKCE.

oidcc:retrieve_token/5 validates issuer, signature, audience, time claims, authorization-party and the bound nonce before it returns. This adapter extracts the validated provider subject and retains only the refresh credential needed by the existing token manager. The local principal is a separate issuer-bound identity and remains the credential-store scope; it must not be compared to the provider's raw sub claim.

Summary

Functions

authorization_uri(Context, Opts)
exchange_code(Context, Code, Opts)
validate_context(Context)

Functions

authorization_uri(Context, Opts)

-spec authorization_uri(map(), adk_authorization_code_adapter:authorization_opts()) ->
                           {ok, binary()} | {error, authorization_unavailable}.

exchange_code(Context, Code, Opts)

-spec exchange_code(map(), binary(), adk_authorization_code_adapter:exchange_opts()) ->
                       {ok, adk_credential_store:credential()} | {error, authorization_failed}.

validate_context(Context)

-spec validate_context(map()) -> ok | {error, invalid_adapter_context}.