Module authorize 

GET /oauth/authorize, the authorization response, and the ceiling.

Nothing is decided here. This module reads a pushed authorization request and the decision crate::oauth::par already minted for it. A policy edited between the push and this call does not reach back into that record — it applies to the next push, which is plan/app-allowlist.md’s “de-admission is a rule change, not session invalidation”.

The page waits for the account

A browser that loads the page before the account has answered gets a page that reloads itself every RELOAD_INTERVAL. Once the account approves a sign-in whose code a browser carries (browser_carries), the page hands the code to a browser signed in as the account (crate::oauth::browser), on a top-level navigation, once. Any other browser keeps getting the page until the request expires. A decline, a verdict that grants nothing, or an expiry sends the browser back to the client with access_denied. See answer for what each load gets.

A browser signed in as the account can also confirm a sign-in the account’s remembered approval covers, without asking the account (confirms_unasked). The route approves it as bot.did.approveAuthorization would before answer reads the record.

The ceiling is not policy

ScopePolicy is the one narrowing mechanism left beside the tree, and calling it a policy overstates it. It is the deployment’s statement of the most any agent here may ever hold, applied by intersection with what the client asked for. It is applied at PAR alongside the tree’s denials, and again at every token issue and every write. It cannot grant: ConfiguredCeiling::new keeps only the atoms GrantAnyScope’s compiled-in ceiling already admits, so the widest a configured ceiling can be is the compiled-in one and every step from there subtracts. It is also blunt — one statement for every agent and every client, because it is keyed on neither.

Retiring it in favour of a rule in the tree has a precondition: didbot_policy::Subject::Grant carries a client_id and the requested scopes, and no account. A per-account ceiling is not expressible as a policy until it does. See plan/scope-policy.md.

Structs

AuthorizePending

A decision, as the page shows it.

ConfiguredCeiling

The ceiling an operator wrote down, applied to every agent and every client alike.

Denial

A sign-in that ended without a code, and the pushed request whose redirect says so.

DroppedAtoms

What ConfiguredCeiling::new did not keep, and why — for the startup line that reports it, since the two reasons ask different things of an operator.

GrantAnyScope

The compiled-in ceiling, and the widest one this binary has: every implementation of ScopePolicy is a subset of it.

Loader

The browser loading the page, as far as the page’s answer turns on it.

Enums

AuthorizeAnswer

What one load of GET /oauth/authorize gets.

AuthorizeError

Why authorize answered with an error rather than the page or a redirect.

ResponseMode

Where an authorization response carries its parameters.

Constants

DECLINED 🔒

The error_description for a request the account declined.

EVERY_SCOPE 🔒

What GrantAnyScope admits.

EXPIRED 🔒

The error_description for a request that expired before its code reached the client.

REFUSED 🔒

The error_description for a request whose verdict grants nothing.

RELOAD_INTERVAL

How often the page reloads itself while the account has not answered.

Traits

ScopePolicy

The ceiling. PAR applies it to write the verdict an agent reads, and POST /oauth/token and every write apply it again to the login’s whole request (crate::oauth::token::in_force). An approval covers that request, so what a login may do moves with the ceiling.

Functions

answer

Answers one load of the page for request_uri, by loader, at now.

authorization_response

The client’s redirect, carrying an authorization response: result (a code, or an error), then state if the client sent one, then iss, in the query or the fragment as mode says.

browser_carries

Whether a browser carries a sign-in’s code to its client: every redirect but a loopback one taking its code in the query.

confirms_unasked

Whether this load confirms the sign-in without asking the account, on the approval it remembered. See plan/remembered-consent.md.