Exosphere.ATProto.OAuth.Client (Exosphere v0.4.0)

Runtime OAuth client configuration: the metadata document paired with the private client-authentication key.

Confidential clients keep a long-lived ES256 key; the matching public JWK is published in the client metadata document (jwks), and the private key signs the private_key_jwt client assertions used at the PAR and token endpoints. Public clients (e.g. loopback development clients) carry no key and authenticate with PKCE alone.

Summary

Types

t()

Functions

assertion(client, issuer, opts \\ [])

Mint a private_key_jwt client assertion (RFC 7523) for an authorization server: iss/sub are the client_id, aud is the server issuer.

client_id(client)

The client identifier (client_id URL).

confidential?(client)

Whether the client authenticates with private_key_jwt.

from_map(map)

Rebuild a client serialized with to_map/1.

new(opts)

Build a client.

new!(opts)

Like new/1, but raises on invalid input.

to_map(client)

The client as a plain, Jason-encodable map for persistence.

Types

t()

@type t() :: %Exosphere.ATProto.OAuth.Client{
  key: map() | nil,
  metadata: Exosphere.ATProto.OAuth.ClientMetadata.t(),
  redirect_uri: String.t()
}

Functions

assertion(client, issuer, opts \\ [])

@spec assertion(t(), String.t(), keyword()) :: {:ok, binary()} | {:error, term()}

Mint a private_key_jwt client assertion (RFC 7523) for an authorization server: iss/sub are the client_id, aud is the server issuer.

Options

:iat - issuance time in seconds (defaults to now); for tests

client_id(client)

@spec client_id(t()) :: String.t()

The client identifier (client_id URL).

confidential?(client)

@spec confidential?(t()) :: boolean()

Whether the client authenticates with private_key_jwt.

from_map(map)

@spec from_map(map()) :: {:ok, t()} | {:error, :invalid_client}

Rebuild a client serialized with to_map/1.

Enum fields may have become strings through a JSON round-trip; they are normalized back to atoms.

new(opts)

@spec new(keyword()) :: {:ok, t()} | {:error, term()}

Build a client.

Options

:metadata (required) - ClientMetadata.t()
:key - private JWK map; required for confidential clients, forbidden for public ones
:redirect_uri (required) - one of metadata.redirect_uris

new!(opts)

@spec new!(keyword()) :: t()

Like new/1, but raises on invalid input.

to_map(client)

@spec to_map(t()) :: map()

The client as a plain, Jason-encodable map for persistence.