TamaOAuth.RefreshToken (tama_oauth v0.1.0)

Computes refresh-token rotation and replay decisions without persistence.

Applications lock the grant and credential, call evaluate/3, then apply the returned decision atomically. A rotated token presented again always requests family revocation.

Summary

Types

state()

status()

Functions

evaluate(state, now, opts)

Types

state()

@type state() :: %TamaOAuth.RefreshToken.State{
  expires_at: DateTime.t() | nil,
  family_id: term(),
  generation: non_neg_integer(),
  id: term(),
  issued_at: DateTime.t(),
  last_used_at: DateTime.t() | nil,
  status: status()
}

status()

@type status() :: :active | :rotated | :revoked

Functions

evaluate(state, now, opts)

@spec evaluate(state(), DateTime.t(), keyword()) ::
  {:ok, TamaOAuth.RefreshToken.Decision.t()}
  | {:replay, term()}
  | {:error, TamaOAuth.Error.t()}