# tama_oauth v0.1.0 - Table of Contents

> Backend-neutral OAuth 2.1 and MCP authorization primitives for Elixir applications.

## Pages

- [TamaOAuth](readme.md)
- [Changelog](changelog.md)
- [LICENSE](license.md)
- [Architecture](architecture.md)

## Modules

- [TamaOAuth](TamaOAuth.md): Framework-neutral OAuth and MCP authorization primitives.
- [TamaOAuth.ClientMetadata.ReqFetcher](TamaOAuth.ClientMetadata.ReqFetcher.md): The default SSRF-resistant Req client-metadata fetcher.
- [TamaOAuth.JWKS.Set](TamaOAuth.JWKS.Set.md): A validated JWKS indexed by key ID.
- [TamaOAuth.RefreshToken.Decision](TamaOAuth.RefreshToken.Decision.md): A persistence-neutral refresh rotation decision.
- [TamaOAuth.RefreshToken.State](TamaOAuth.RefreshToken.State.md): Application-supplied persisted refresh-token state.

- Requests and values
  - [TamaOAuth.AuthorizationRequest](TamaOAuth.AuthorizationRequest.md): Validates an OAuth authorization-code request before client lookup or consent.

  - [TamaOAuth.ClientRegistration](TamaOAuth.ClientRegistration.md): Normalizes public-client Dynamic Client Registration metadata.
  - [TamaOAuth.Error](TamaOAuth.Error.md): A bounded OAuth protocol error independent of any HTTP framework.
  - [TamaOAuth.Introspection](TamaOAuth.Introspection.md): Builds and validates RFC 7662-style token introspection values.
  - [TamaOAuth.PKCE](TamaOAuth.PKCE.md): PKCE `S256` validation and verification as defined by RFC 7636.

  - [TamaOAuth.RefreshToken](TamaOAuth.RefreshToken.md): Computes refresh-token rotation and replay decisions without persistence.
  - [TamaOAuth.Revocation](TamaOAuth.Revocation.md): Parses bounded RFC 7009 token revocation requests.
  - [TamaOAuth.Scope](TamaOAuth.Scope.md): Normalizes space-delimited OAuth scopes against an explicit catalogue.

  - [TamaOAuth.TokenRequest](TamaOAuth.TokenRequest.md): Parses bounded authorization-code and refresh-token requests.
  - [TamaOAuth.URI](TamaOAuth.URI.md): OAuth URI validation helpers, including native-app loopback redirects.

- Client trust
  - [TamaOAuth.ClientAuthentication](TamaOAuth.ClientAuthentication.md): Routes explicit OAuth token-endpoint client authentication methods.
  - [TamaOAuth.ClientAuthentication.None](TamaOAuth.ClientAuthentication.None.md): Validates public clients using `token_endpoint_auth_method=none`.
  - [TamaOAuth.ClientAuthentication.PrivateKeyJWT](TamaOAuth.ClientAuthentication.PrivateKeyJWT.md): Validates RFC 7523 private-key JWT client authentication.
  - [TamaOAuth.ClientMetadata](TamaOAuth.ClientMetadata.md): Validates OAuth Client ID Metadata Documents and returns normalized metadata.
  - [TamaOAuth.RemoteJSON](TamaOAuth.RemoteJSON.md): Fetches bounded JSON documents through an SSRF-resistant network policy.

- Tokens and discovery
  - [TamaOAuth.Crypto](TamaOAuth.Crypto.md): Cryptographic helpers for opaque OAuth credentials and their digests.

  - [TamaOAuth.JWKS](TamaOAuth.JWKS.md): Validates, selects, and publishes JSON Web Key Sets.
  - [TamaOAuth.JWT](TamaOAuth.JWT.md): Asymmetric JWT access-token signing and verification.
  - [TamaOAuth.Metadata.AuthorizationServer](TamaOAuth.Metadata.AuthorizationServer.md): Builds RFC 8414 authorization-server metadata.
  - [TamaOAuth.Metadata.ProtectedResource](TamaOAuth.Metadata.ProtectedResource.md): Builds RFC 9728 protected-resource metadata.

- Adapter behaviours
  - [TamaOAuth.ClientMetadata.Fetcher](TamaOAuth.ClientMetadata.Fetcher.md): A fetch behaviour for OAuth Client ID Metadata Documents.
  - [TamaOAuth.Clock](TamaOAuth.Clock.md): A clock behaviour for deterministic protocol tests.
  - [TamaOAuth.KeyProvider](TamaOAuth.KeyProvider.md): A behaviour for application-owned signing and verification keys.
  - [TamaOAuth.Random](TamaOAuth.Random.md): A cryptographically secure random-byte source behaviour.
  - [TamaOAuth.ReplayStore](TamaOAuth.ReplayStore.md): Atomically claims a client-scoped assertion-ID digest until its acceptance
window ends.

