Exosphere.ATProto.OAuth.Request (Exosphere v0.5.0)

Copy Markdown View Source

DPoP-bound HTTP requests against OAuth endpoints.

One executor shared by every consumer of a DPoP session — the PAR and token requests in Exosphere.ATProto.OAuth.Flow, session refresh in Exosphere.ATProto.OAuth.Session, and XRPC calls — so nonce handling (400 use_dpop_nonce / 401 with a DPoP-Nonce header → store → retry once) is implemented exactly once.

Options

In addition to the Exosphere.ATProto.HTTP.Behaviour request options:

  • :form - map/keyword of form fields, sent as an application/x-www-form-urlencoded body

Summary

Functions

authorized(http, method, url, opts, dpop_key, access_token)

Perform method url with a DPoP proof header (and, when access_token is given, a DPoP-scheme Authorization header).

Functions

authorized(http, method, url, opts, dpop_key, access_token)

@spec authorized(
  module() | nil,
  atom(),
  String.t(),
  keyword(),
  Exosphere.ATProto.OAuth.DPoP.private_key(),
  String.t() | nil
) :: {:ok, Exosphere.ATProto.HTTP.response()} | {:error, term()}

Perform method url with a DPoP proof header (and, when access_token is given, a DPoP-scheme Authorization header).

When the server answers with a nonce challenge, the nonce is stored and the request is retried once with a fresh proof.