Packages

attesto_phoenix

2.2.0
2.3.0 2.2.0 2.1.0 2.0.2 2.0.1 2.0.0 1.4.0 1.3.0 1.2.0 1.1.0 1.0.0 0.20.0 0.19.1 0.19.0 0.18.0 0.17.0 0.16.0 0.15.0 0.14.2 0.14.1 0.14.0 0.13.5 0.13.4 0.13.3 0.13.2 0.13.1 0.13.0 0.12.0 0.11.0 0.10.0 0.9.5 0.9.4 0.9.3 0.9.2 0.9.1 0.9.0 0.8.0 0.7.7 0.7.6 0.7.5 0.7.4 0.7.3 0.7.2 0.7.1 0.7.0 0.6.23 0.6.22 0.6.21 0.6.20 0.6.19 0.6.18 0.6.17 0.6.16 0.6.15 0.6.14 0.6.13 0.6.12 0.6.11 0.6.10 0.6.9 0.6.8 0.6.7 0.6.6 0.6.5 0.6.4 0.6.3 0.6.2 0.6.1 0.6.0

Phoenix/Ecto OAuth 2.0 / OIDC authorization server layer over attesto: authorization, token, PAR, revocation, discovery, JWKS, UserInfo, protected-resource plugs, and Ecto-backed token stores.

HexDocs

Current section

Files

Jump to
Readme
69 Versions
7 Dependencies
Dependants
Files
Activity
attesto_phoenix lib attesto_phoenix plug require_scopes.ex
Raw

lib/attesto_phoenix/plug/require_scopes.ex 

defmodule AttestoPhoenix.Plug.RequireScopes do

  @moduledoc """

  Phoenix alias for `Attesto.Plug.RequireScopes`.



  Scope authorization is protocol logic, so the implementation remains in the

  core `attesto` package and uses `Attesto.Scope` grant-form algebra. This

  module exists to give Phoenix routers a stable `AttestoPhoenix.Plug.*` surface

  alongside `AttestoPhoenix.Plug.Authenticate`.



  ## RFC 9728 `resource_metadata` on the 403



  Unlike `AttestoPhoenix.Plug.Authenticate` (which sources the

  `resource_metadata` pointer from `AttestoPhoenix.Config`), this plug is a thin,

  config-independent protocol alias so it stays usable in a resource-server-only

  deployment with no host config. Its `insufficient_scope` (403) challenge

  therefore omits the pointer unless one is passed explicitly:



      plug AttestoPhoenix.Plug.RequireScopes,

        scopes: ["read:reports"],

        resource_metadata: "https://api.example/.well-known/oauth-protected-resource"



  This is intentional, not a discovery gap: a 403 is only reached *after* the

  request authenticated, so the client already received the pointer on the

  initial unauthenticated 401 from `Authenticate`, and RFC 9728 §5.1 makes the

  `resource_metadata` auth-param OPTIONAL on a challenge.

  """



  @behaviour Plug



  alias Attesto.Plug.RequireScopes, as: CoreRequireScopes



  @impl Plug

  def init(scope) when is_binary(scope), do: CoreRequireScopes.init([scope])

  def init(opts), do: CoreRequireScopes.init(opts)



  @impl Plug

  def call(conn, opts), do: CoreRequireScopes.call(conn, opts)

end