State an application must retain between the two legs of the authorization flow.
Flow.authorize_url/3 returns a context next to the authorize URL; the
caller persists it (Plug session, database, …) keyed by user/session and
feeds it back into Flow.callback/3. It contains secrets (the PKCE
verifier and the DPoP private key), so it must be stored server-side —
never in a cookie the browser can read, and never as the OAuth state
itself.
to_map/1 / from_map/1 round-trip the context through plain
JSON-encodable maps for persistence.
Summary
Types
@type t() :: %Exosphere.ATProto.OAuth.RequestContext{ auth_server: Exosphere.ATProto.OAuth.ServerMetadata.t(), client: Exosphere.ATProto.OAuth.Client.t(), dpop_key: map(), expected_did: String.t() | nil, pds: String.t() | nil, redirect_uri: String.t(), state: String.t(), verifier: String.t() }