A pending authorization code. code is raw on the way in and is never
stored; the adapter persists Secret.token_hash(code).
refresh_family_id is allocated at code issuance so that the refresh token
minted from this code, and every rotation after it, share one family — which
is what makes family revocation on replay possible.
Summary
Types
@type t() :: %Noizu.MCP.Auth.Server.Store.AuthorizationCode{ client_id: String.t(), code: String.t() | nil, code_challenge: String.t(), code_challenge_method: String.t(), expires_at: DateTime.t(), inserted_at: DateTime.t() | nil, nonce: String.t() | nil, redirect_uri: String.t(), refresh_family_id: String.t() | nil, resource: String.t() | nil, scope: [String.t()], subject: String.t(), upstream_ref: map() | nil, used_at: DateTime.t() | nil }