Lockspire.Protocol.RegistrationManagement (lockspire v1.6.1)

Copy Markdown

RFC 7592 dynamic client registration management — Plug.Conn-free orchestrator.

Public entries:

  • read/2 — return current RFC 7591 metadata for the RAT-bound client.
  • update/2 — full-replace via the same validator pipeline as Registration.register/1;
                 on success rotates the RAT and returns the new plaintext exactly once.
  • delete/2 — soft-disable through the neutral client lifecycle.

All three functions accept (client_id_from_url, %Domain.Client{} ...) where client is the row matched by Repository.get_client_by_registration_access_token_hash/1. URL/RAT mismatches ALWAYS collapse to {:error, :invalid_token} — the discriminator stays in telemetry only, defending against client-ID enumeration.

Summary

Types

update_request()
update_result()

Functions

delete(client_id_from_url, client)
read(client_id_from_url, client)
rotate_registration_access_token(client)
update(client_id_from_url, request)

Types

update_request()

@type update_request() :: %{
  metadata: map(),
  server_policy: Lockspire.Domain.ServerPolicy.t(),
  client: Lockspire.Domain.Client.t()
}

update_result()

@type update_result() ::
  {:ok, Lockspire.Protocol.RegistrationManagement.UpdateSuccess.t()}
  | {:error, Lockspire.Protocol.Registration.Error.t() | :invalid_token}

Functions

delete(client_id_from_url, client)

@spec delete(String.t(), Lockspire.Domain.Client.t()) ::
  :ok | {:error, :invalid_token | term()}

read(client_id_from_url, client)

@spec read(String.t(), Lockspire.Domain.Client.t()) ::
  {:ok, Lockspire.Domain.Client.t()} | {:error, :invalid_token}

rotate_registration_access_token(client)

@spec rotate_registration_access_token(Lockspire.Domain.Client.t()) ::
  {:ok, String.t(), Lockspire.Domain.Client.t()} | {:error, term()}

update(client_id_from_url, request)

@spec update(String.t(), update_request()) :: update_result()