Stages and verifies short-lived OAuth authorization candidates.
Summary
Functions
Deletes expired and consumed authorization candidates.
Verifies a staged candidate and stores only its safe identity proof.
Exchanges a claimed OAuth session into an encrypted, short-lived candidate.
Verifies and, when absent, binds the subject of an active connection.
Functions
@spec cleanup_expired_authorizations() :: {:ok, non_neg_integer()} | {:error, term()}
Deletes expired and consumed authorization candidates.
Credential columns are wiped before the rows are deleted, so token ciphertext
never outlives the candidate even if deletion is delayed. Consumed candidates
already have their tokens cleared by finalization; expired candidates that
were never consumed are marked consumed as they are wiped. When anything was
deleted, a :session_expired audit entry records the count and cleanup type
only: no handle, token, or claim data.
Returns {:ok, deleted_count}.
Verifies a staged candidate and stores only its safe identity proof.
Exchanges a claimed OAuth session into an encrypted, short-lived candidate.
Verifies and, when absent, binds the subject of an active connection.