Latch.TokenResponse (latch v0.3.0)

Parses token endpoint responses per the atproto OAuth profile.

Summary

Functions

Validates a decoded token response and extracts the fields we use.

Types

t()

@type t() :: %Latch.TokenResponse{
  access_token: String.t(),
  expires_in: pos_integer(),
  refresh_token: String.t(),
  scope: String.t(),
  sub: String.t()
}

Functions

parse(response)

@spec parse(map()) :: {:ok, t()} | {:error, {:missing | :invalid, String.t()}}

Validates a decoded token response and extracts the fields we use.

refresh_token and expires_in are optional in RFC 6749 but required here: background polling depends on refresh, and refresh scheduling depends on expiry, so a server omitting either fails at login instead of failing later. token_type must be DPoP (compared case-insensitively per RFC 6749) and carries no information once validated, so it is not kept on the struct.

sub is only checked syntactically. The caller must verify it equals the DID resolved from the user's handle before trusting it.