Modules
An OAuth 2.0 authorization server for public clients, as a use macro.
A one-time authorization code (OAuth 2.0 authorization code grant with
PKCE). Stored hashed; bound to the subject who consented, the client and
redirect URI it was issued for, and the PKCE challenge the token exchange
must answer. Five minutes to live, single use (used_at).
The public-client registry: a list in configuration, not a table. Each client is an id, a display name and the redirect URIs it may be sent to, matched exactly. Public clients have no secret; the allowlist and PKCE are the whole binding between a code and the app that asked for it.
The authorization-code half of the state machine: issue a code on consent, exchange it once for a token the host mints. Codes live five minutes, are stored hashed, and are bound to the subject, the client, the redirect URI and the PKCE challenge the exchange must answer.
What one instance of Managoat.OAuth runs with, read from the host's own
otp_app under the instance module's key
The device-authorization half of the state machine (RFC 8628 shape). A poller that cannot hold a password starts a grant, shows a human a short code and the host's approval page, and polls with its own high-entropy device code until a signed-in subject approves. Fifteen minutes to live, single use, one poll per interval.
A device-authorization grant (RFC 8628 shape).
What the platform running Managoat.OAuth supplies: everything the grant
state machine needs to know about subjects, tokens and the record it
leaves, and nothing about grants.
Creates the two tables Managoat.OAuth needs, from a migration of the
host's own (the shape Oban uses; a hex package cannot run mix ecto.migrate for its host). In MyApp.Repo.Migrations.AddOAuth, say