Packages
attesto_phoenix
0.17.0
2.1.0
2.0.2
2.0.1
2.0.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
0.20.0
0.19.1
0.19.0
0.18.0
0.17.0
0.16.0
0.15.0
0.14.2
0.14.1
0.14.0
0.13.5
0.13.4
0.13.3
0.13.2
0.13.1
0.13.0
0.12.0
0.11.0
0.10.0
0.9.5
0.9.4
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.23
0.6.22
0.6.21
0.6.20
0.6.19
0.6.18
0.6.17
0.6.16
0.6.15
0.6.14
0.6.13
0.6.12
0.6.11
0.6.10
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
Phoenix/Ecto OAuth 2.0 / OIDC authorization server layer over attesto: authorization, token, PAR, revocation, discovery, JWKS, UserInfo, protected-resource plugs, and Ecto-backed token stores.
Current section
Files
Jump to
Current section
Files
lib/attesto_phoenix/authorization_server/token/request.ex
defmodule AttestoPhoenix.AuthorizationServer.Token.Request do
@moduledoc """
A parsed token request, all plain data lifted at the controller edge.
`AttestoPhoenix.Controller.TokenController` authenticates the client
(RFC 6749 §2.3), parses the request body and the relevant `Plug.Conn` facts,
and builds this struct so that `AttestoPhoenix.AuthorizationServer.Token` can
process the grant against data only - never a conn.
## Fields
* `:config` - the validated `%AttestoPhoenix.Config{}` carrying host policy.
* `:client` - the authenticated client (RFC 6749 §2.3), opaque to the core.
* `:client_auth_method` - HOW the client authenticated
(`:client_secret_basic` / `:client_secret_post` / `:private_key_jwt`, or
`:none` for the public-client path). The core gates confidential-only
grants (`client_credentials`, token-exchange) on this, rejecting `:none`.
* `:grant_type` - the requested grant type string (RFC 6749 §1.3).
* `:params` - the request body parameters.
* `:sender_constraint_input` - the conn-free sender-constraint facts
(`t:AttestoPhoenix.AuthorizationServer.SenderConstraint.input/0`): the
presented DPoP proof (RFC 9449), the presented client certificate DER
(RFC 8705), and the canonical request URL/method the proof is bound to.
* `:client_ip` - the request client IP for audit-event metadata, or `nil`.
* `:request_client_id` - the `client_id` derived from the request body or
the Basic credentials, used as the denial-event `client_id` fallback when
the host exposes no `:client_id` callback.
"""
alias AttestoPhoenix.AuthorizationServer.SenderConstraint
alias AttestoPhoenix.Config
@type t :: %__MODULE__{
config: Config.t(),
client: term(),
client_auth_method: :client_secret_basic | :client_secret_post | :private_key_jwt | :none,
grant_type: String.t(),
params: map(),
sender_constraint_input: SenderConstraint.input(),
client_ip: String.t() | nil,
request_client_id: String.t() | nil
}
@enforce_keys [:config, :client, :client_auth_method, :grant_type, :params, :sender_constraint_input]
defstruct [
:config,
:client,
:client_auth_method,
:grant_type,
:params,
:sender_constraint_input,
:client_ip,
:request_client_id
]
end