Managoat.OAuth.Clients (managoat_oauth v0.1.1)

Copy Markdown View Source

The public-client registry: a list in configuration, not a table. Each client is an id, a display name and the redirect URIs it may be sent to, matched exactly. Public clients have no secret; the allowlist and PKCE are the whole binding between a code and the app that asked for it.

Summary

Types

client()

Functions

get_client(clients, id)

The client with id, or nil.

normalize(clients)

Normalise a configured client list: atom or string keys, name falling back to id, every value a string. What redirect_uris a JSON registry decoded into is accepted as it is.

redirect_origins(clients)

The distinct origins (scheme://host[:port]) of every client's redirect URIs, for a consent page's form-action CSP.

validate_request(clients, params)

Validate an authorization request's identity part against the registry: {:ok, client} or {:error, :unknown_client | :redirect_uri_mismatch | :unsupported_code_challenge_method | :invalid_code_challenge}.

Types

client()

@type client() :: %{id: String.t(), name: String.t(), redirect_uris: [String.t()]}

Functions

get_client(clients, id)

@spec get_client([client()], term()) :: client() | nil

The client with id, or nil.

normalize(clients)

@spec normalize([map()]) :: [client()]

Normalise a configured client list: atom or string keys, name falling back to id, every value a string. What redirect_uris a JSON registry decoded into is accepted as it is.

redirect_origins(clients)

@spec redirect_origins([client()]) :: [String.t()]

The distinct origins (scheme://host[:port]) of every client's redirect URIs, for a consent page's form-action CSP.

validate_request(clients, params)

@spec validate_request([client()], map()) :: {:ok, client()} | {:error, atom()}

Validate an authorization request's identity part against the registry: {:ok, client} or {:error, :unknown_client | :redirect_uri_mismatch | :unsupported_code_challenge_method | :invalid_code_challenge}.