MoneyHub.Auth.IdToken (MoneyHub v1.0.0)

Copy Markdown View Source

Verifies and decodes the id_token returned from Moneyhub's token endpoint.

The id_token is a JWS signed by Moneyhub's own key (published at {identity_url}/oidc/certs, see MoneyHub.Auth.JWKS). Its payload carries the resolved values of every claim requested via MoneyHub.Claims - most importantly the connected user's sub (when registering a new user) and, for payment/recurring-payment/standing-order flows, the resulting resource id under the matching mh:* claim.

Summary

Types

claims()

Functions

fetch(claims, key)

Extracts a single mh:* (or any top-level) claim value from decoded id_token claims, returning :error if absent.

verify(id_token, config)

Verifies the signature on a compact JWS id_token against Moneyhub's published JWKS and returns its decoded claims.

Types

claims()

@type claims() :: %{optional(String.t()) => term()}

Functions

fetch(claims, key)

@spec fetch(claims(), String.t()) :: {:ok, term()} | :error

Extracts a single mh:* (or any top-level) claim value from decoded id_token claims, returning :error if absent.

Useful after verify/2 to pull out, for example, the new user's sub or a created payment's id from claims["mh:payment"].

verify(id_token, config)

@spec verify(String.t(), MoneyHub.Config.t()) ::
  {:ok, claims()} | {:error, MoneyHub.Error.t()}

Verifies the signature on a compact JWS id_token against Moneyhub's published JWKS and returns its decoded claims.

Also performs basic structural validation: aud must include config.client_id, and exp must not be in the past.