Lockspire.Protocol.RequestObject (lockspire v1.6.1)

Copy Markdown

Orchestrates JAR (RFC 9101) request-object consumption for /authorize and /par.

Composes Lockspire.Protocol.Jar.{decode/1, verify_signature/2, validate_claims/2} into a single pipeline step that:

  1. Rejects outer-parameter conflicts and request / request_uri collisions.
  2. Asserts the client has inline jwks registered.
  3. Decodes, verifies the signature, and validates the request JWT claims with the configured :max_age ceiling.
  4. Projects JAR claims into the flat authorization-parameter shape consumed by both authorization entrypoints, so their existing validation runs unchanged.

Out of scope

  • JAR-by-reference (request_uri pointing to an external JWT URL)
  • jwks_uri HTTP fetch
  • JAR substituting as client authentication at /par
  • JTI replay cache

Summary

Types

result()

Functions

consume(params, client, opts \\ [])

Types

result()

@type result() ::
  {:ok, map()}
  | {:browser_error, Lockspire.Protocol.AuthorizationRequest.Error.t()}
  | {:redirect_error, Lockspire.Protocol.AuthorizationRequest.Error.t()}

Functions

consume(params, client, opts \\ [])

@spec consume(map(), Lockspire.Domain.Client.t(), keyword()) :: result()