Configures a specific OAuth provider from database settings.

Examples

iex> PhoenixKit.Users.OAuthConfig.configure_provider(:google)
:ok

Configures all OAuth providers from database settings.

This function reads OAuth credentials from the database and updates the application configuration at runtime. It should be called:

• On application startup
• After updating OAuth credentials via admin UI

Skips configuration if OAuth is disabled in settings (oauth_enabled = false).

Examples

iex> PhoenixKit.Users.OAuthConfig.configure_providers()
:ok

Tests OAuth credentials for a specific provider against the database.

Reads the currently-saved credentials and delegates to test_connection/2 — see that function for what "testing" actually does per provider.

Examples

Result depends on what is already stored; shown here for a provider with nothing configured yet:

iex> PhoenixKit.Users.OAuthConfig.test_connection(:google)
{:error, "Missing Google OAuth credentials: Client Secret, Client ID"}

Tests OAuth credentials for a specific provider against an explicit credentials map, instead of reading from the database.

Use this to validate unsaved form values (e.g. an admin "Test Credentials" button) before the settings are saved — test_connection/1 would otherwise validate the stale, already-persisted credentials.

opts is a test hook, not a general passthrough: production call sites pass [] (the default) and only :plug (e.g. [plug: {Req.Test, ...}], to route the underlying request through a stub) is ever honored — see google_live_check/2.

Three distinct outcomes, each with its own tag so a caller can never conflate them:

• {:ok, message} — the credentials were accepted. For Google, this means Google's own token endpoint authenticated the client_id/secret pair (see google_live_check/1). For GitHub/Facebook, no live network round trip is made yet (see the moduledoc note below) — this means only that the fields are present and not implausibly short.
• {:error, message} — the credentials were rejected: missing, blank, too short to be real, or (Google) actively refused by the provider (invalid_client).
• {:inconclusive, message} — could not reach the provider at all (timeout, DNS failure, connection refused — see @google_connect_timeout/ @google_receive_timeout) or got back a response that could not be classified as either of the above. This is a DIFFERENT situation from a rejection and must never be reported as one — an admin in a network-isolated deployment must not read "invalid credentials" when the real story is "no route to Google". A raise or exit inside the check itself is also caught here (google_live_check/2) rather than left to PhoenixKit.Integrations.Probe's own generic, untagged {:error, message} fallback. Only an untrappable :kill — Probe's own deadline firing, or a third party killing the check process outright — is the one gap this cannot close.

Examples

iex> PhoenixKit.Users.OAuthConfig.test_connection(:github, %{client_id: "x", client_secret: "0123456789abcdef"})
{:ok, "GitHub OAuth credentials are properly formatted. Initiate OAuth flow to test actual connection."}

Validates OAuth credentials for a specific provider.

Returns {:ok, provider} if credentials are valid, or {:error, reason} if not. Uses direct database read for accurate validation.

Examples

iex> PhoenixKit.Users.OAuthConfig.validate_credentials(:google)
{:ok, :google}

@spec validate_secret_format(atom(), String.t() | nil) :: :ok | {:error, String.t()}

Validates the format of a single OAuth secret value.

Independent of test_connection/2 below — this needs no network and no already-saved state, so it is cheap enough to run on every settings save, not just on a "Test Credentials" click. A blank value is not an error: OAuth is opt-in per provider, and an unconfigured secret is a legitimate state (PhoenixKit.Settings.Setting.optional_settings/0 already allows these keys to be empty). A value that is only whitespace, or implausibly short (see @min_secret_length), is rejected with a message naming why.

Examples

iex> PhoenixKit.Users.OAuthConfig.validate_secret_format(:google, "")
:ok

iex> {:error, _reason} = PhoenixKit.Users.OAuthConfig.validate_secret_format(:google, "short")