# managoat_oauth v0.1.1 - Table of Contents

> OAuth 2.0 authorization code + PKCE and device grant state machine for public clients, behind a host behaviour that mints the token.

## Pages

- [Managoat.OAuth](readme.md)
- [Changelog](changelog.md)

## Modules

- [Managoat.OAuth](Managoat.OAuth.md): An OAuth 2.0 authorization server for public clients, as a `use` macro.
- [Managoat.OAuth.AuthorizationCode](Managoat.OAuth.AuthorizationCode.md): A one-time authorization code (OAuth 2.0 authorization code grant with
PKCE). Stored hashed; bound to the subject who consented, the client and
redirect URI it was issued for, and the PKCE challenge the token exchange
must answer. Five minutes to live, single use (`used_at`).
- [Managoat.OAuth.Clients](Managoat.OAuth.Clients.md): The public-client registry: a list in configuration, not a table. Each
client is an id, a display name and the redirect URIs it may be sent to,
matched **exactly**. Public clients have no secret; the allowlist and PKCE
are the whole binding between a code and the app that asked for it.

- [Managoat.OAuth.Codes](Managoat.OAuth.Codes.md): The authorization-code half of the state machine: issue a code on
consent, exchange it once for a token the host mints. Codes live five
minutes, are stored hashed, and are bound to the subject, the client, the
redirect URI and the PKCE challenge the exchange must answer.

- [Managoat.OAuth.Config](Managoat.OAuth.Config.md): What one instance of `Managoat.OAuth` runs with, read from the host's own
otp_app under the instance module's key
- [Managoat.OAuth.Device](Managoat.OAuth.Device.md): The device-authorization half of the state machine (RFC 8628 shape). A
poller that cannot hold a password starts a grant, shows a human a short
code and the host's approval page, and polls with its own high-entropy
device code until a signed-in subject approves. Fifteen minutes to live,
single use, one poll per interval.

- [Managoat.OAuth.DeviceGrant](Managoat.OAuth.DeviceGrant.md): A device-authorization grant (RFC 8628 shape).
- [Managoat.OAuth.Host](Managoat.OAuth.Host.md): What the platform running `Managoat.OAuth` supplies: everything the grant
state machine needs to know about subjects, tokens and the record it
leaves, and nothing about grants.
- [Managoat.OAuth.Migration](Managoat.OAuth.Migration.md): Creates the two tables `Managoat.OAuth` needs, from a migration of the
host's own (the shape Oban uses; a hex package cannot run `mix
ecto.migrate` for its host). In `MyApp.Repo.Migrations.AddOAuth`, say

