Latch.ServerMetadata (latch v0.3.0)

Parses authorization server metadata (/.well-known/oauth-authorization-server) per the atproto OAuth profile.

Validates the document's internal correctness only. The caller must also verify that the issuer matches the origin the document was fetched from.

Summary

Types

t()

Functions

parse(metadata)

Validates a decoded metadata document and extracts the fields we use.

Types

t()

@type t() :: %Latch.ServerMetadata{
  authorization_endpoint: String.t(),
  issuer: String.t(),
  par_endpoint: String.t(),
  revocation_endpoint: String.t() | nil,
  scopes_supported: [String.t()],
  token_endpoint: String.t()
}

Functions

parse(metadata)

@spec parse(map()) :: {:ok, t()} | {:error, {:missing | :invalid, String.t()}}

Validates a decoded metadata document and extracts the fields we use.

Checks every requirement the atproto OAuth spec places on authorization servers, except none in token_endpoint_auth_methods_supported, which only matters to public clients.

Uses a manual validation layer instead of Ecto.Changeset because I want to split this out eventually.