Packages
attesto_phoenix
2.1.0
2.1.0
2.0.2
2.0.1
2.0.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
0.20.0
0.19.1
0.19.0
0.18.0
0.17.0
0.16.0
0.15.0
0.14.2
0.14.1
0.14.0
0.13.5
0.13.4
0.13.3
0.13.2
0.13.1
0.13.0
0.12.0
0.11.0
0.10.0
0.9.5
0.9.4
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.23
0.6.22
0.6.21
0.6.20
0.6.19
0.6.18
0.6.17
0.6.16
0.6.15
0.6.14
0.6.13
0.6.12
0.6.11
0.6.10
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
Phoenix/Ecto OAuth 2.0 / OIDC authorization server layer over attesto: authorization, token, PAR, revocation, discovery, JWKS, UserInfo, protected-resource plugs, and Ecto-backed token stores.
Current section
Files
Jump to
Current section
Files
lib/attesto_phoenix/authorization_server/token/request.ex
defmodule AttestoPhoenix.AuthorizationServer.Token.Request do
@moduledoc """
A parsed token request, all plain data lifted at the controller edge.
`AttestoPhoenix.Controller.TokenController` authenticates the client
(RFC 6749 §2.3), parses the request body and the relevant `Plug.Conn` facts,
and builds this struct so that `AttestoPhoenix.AuthorizationServer.Token` can
process the grant against data only - never a conn.
## Fields
* `:config` - the validated `%AttestoPhoenix.Config{}` carrying host policy.
* `:client` - the authenticated client (RFC 6749 §2.3), opaque to the core.
* `:client_auth_method` - HOW the client authenticated
(`:client_secret_basic` / `:client_secret_post` / `:private_key_jwt`, or
`:none` for the public-client path). The core gates confidential-only
grants (`client_credentials`, token-exchange) on this, rejecting `:none`.
* `:grant_type` - the requested grant type string (RFC 6749 §1.3).
* `:params` - the request body parameters.
* `:sender_constraint_input` - the conn-free sender-constraint facts
(`t:AttestoPhoenix.AuthorizationServer.SenderConstraint.input/0`): the
presented DPoP proof (RFC 9449), the presented client certificate DER
(RFC 8705), and the canonical request URL/method the proof is bound to.
* `:client_ip` - the request client IP for audit-event metadata, or `nil`.
* `:request_client_id` - the authenticated OAuth `client_id` from
`AttestoPhoenix.ClientAuthentication.Result`. It is authoritative for
access-token `client_id` claims and is also the audit fallback when the
host exposes no `:client_id` callback. The field name is retained for
compatibility with direct callers that already build this struct. Direct
callers are a trusted boundary and MUST populate it only from completed
client authentication, never from an unverified request-body parameter.
When omitted for backward compatibility, `Token.issue/2` resolves the
host `:client_id` callback once before processing and never re-resolves it
during the grant.
"""
alias AttestoPhoenix.AuthorizationServer.SenderConstraint
alias AttestoPhoenix.Config
@type t :: %__MODULE__{
config: Config.t(),
client: term(),
client_auth_method: :client_secret_basic | :client_secret_post | :private_key_jwt | :none,
grant_type: String.t(),
params: map(),
sender_constraint_input: SenderConstraint.input(),
client_ip: String.t() | nil,
request_client_id: String.t() | nil
}
@enforce_keys [:config, :client, :client_auth_method, :grant_type, :params, :sender_constraint_input]
defstruct [
:config,
:client,
:client_auth_method,
:grant_type,
:params,
:sender_constraint_input,
:client_ip,
:request_client_id
]
end