ProtoRune.Atproto.OAuth.Session (proto_rune v0.5.1)

An OAuth-authenticated AT Protocol session.

Returned by ProtoRune.Atproto.OAuth.exchange_code/3 and ProtoRune.Atproto.OAuth.refresh/2. Unlike ProtoRune.Atproto.Session (app password sessions), OAuth access tokens are DPoP-bound: requests must carry a DPoP proof signed with dpop_key instead of a plain Bearer header.

Treat it as an opaque value. The dpop_key is sensitive key material: store it with the same care as the tokens.

Summary

Types

t()

Functions

parse(data, context)

Builds a session from a token endpoint response.

Types

t()

@type t() :: %ProtoRune.Atproto.OAuth.Session{
  access_token: String.t(),
  did: String.t(),
  dpop_jwk: ProtoRune.Atproto.OAuth.DPoP.jwk(),
  dpop_key: ProtoRune.Atproto.OAuth.DPoP.private_key(),
  dpop_nonce: String.t() | nil,
  expires_at: integer() | nil,
  handle: String.t() | nil,
  issuer: String.t() | nil,
  refresh_token: String.t() | nil,
  scope: String.t() | nil,
  service_url: String.t() | nil,
  token_endpoint: String.t() | nil,
  token_type: String.t() | nil
}

Functions

parse(data, context)

@spec parse(map(), map()) :: {:ok, t()} | {:error, :invalid_token_response}

Builds a session from a token endpoint response.

data is the decoded JSON response body (string keys). context carries flow state such as the resolved service_url, issuer, DPoP key material and the account handle when known.