PtcRunner.Kernel.MCPOAuth.Primitives (PtcRunner v0.14.0)

Small, auditable OAuth authorization-code primitives owned by PtcRunner.

State and PKCE verifiers are generated independently from 32 random bytes and encoded as 43-byte unpadded Base64URL values. Endpoint construction retains unrelated query bytes exactly and rejects malformed or colliding pre-existing parameters before appending PtcRunner-owned form values.

Summary

Types

flow()

Functions

authorization_endpoint(endpoint, opts \\ [])

Validates an authorization endpoint without appending parameters.

authorization_url(endpoint, parameters, opts \\ [])

Appends authorization parameters while retaining unrelated endpoint query bytes and order.

client_secret_basic(client_id, client_secret)

Constructs RFC 6749 client_secret_basic from independently form-encoded values.

form_encode(parameters)

Encodes ordered OAuth form parameters deterministically.

new_flow()

Generates independent state and S256 PKCE material.

s256_challenge(verifier)

Builds the exact unpadded S256 challenge for a validated verifier.

state_equal?(left, right)

Compares two bounded state values without content-dependent early exit.

token_endpoint(endpoint, opts \\ [])

Validates a token endpoint's retained query against token form names.

valid_verifier?(verifier)

Returns whether a verifier has the RFC 7636 unreserved grammar.

Types

flow()

@type flow() :: %{state: binary(), verifier: binary(), challenge: binary()}

Functions

authorization_endpoint(endpoint, opts \\ [])

@spec authorization_endpoint(
  binary(),
  keyword()
) :: {:ok, binary()} | {:error, :invalid_endpoint}

Validates an authorization endpoint without appending parameters.

authorization_url(endpoint, parameters, opts \\ [])

@spec authorization_url(binary(), [{binary(), binary()}], keyword()) ::
  {:ok, binary()} | {:error, :invalid_endpoint | :invalid_parameters}

Appends authorization parameters while retaining unrelated endpoint query bytes and order.

client_secret_basic(client_id, client_secret)

@spec client_secret_basic(binary(), binary()) ::
  {:ok, binary()} | {:error, :invalid_client_credentials}

Constructs RFC 6749 client_secret_basic from independently form-encoded values.

form_encode(parameters)

@spec form_encode([{binary(), binary()}]) ::
  {:ok, binary()} | {:error, :invalid_parameters}

Encodes ordered OAuth form parameters deterministically.

new_flow()

@spec new_flow() :: flow()

Generates independent state and S256 PKCE material.

s256_challenge(verifier)

@spec s256_challenge(binary()) :: binary()

Builds the exact unpadded S256 challenge for a validated verifier.

state_equal?(left, right)

@spec state_equal?(term(), term()) :: boolean()

Compares two bounded state values without content-dependent early exit.

token_endpoint(endpoint, opts \\ [])

@spec token_endpoint(
  binary(),
  keyword()
) :: {:ok, binary()} | {:error, :invalid_endpoint}

Validates a token endpoint's retained query against token form names.

The returned endpoint is byte-identical because token parameters belong in the POST form body.

valid_verifier?(verifier)

@spec valid_verifier?(term()) :: boolean()

Returns whether a verifier has the RFC 7636 unreserved grammar.