Struct ClientMetadataDocument 

pub struct ClientMetadataDocument {
    pub client_id: String,
    pub application_type: ApplicationType,
    pub client_name: Option<String>,
    pub client_uri: Option<String>,
    pub logo_uri: Option<String>,
    pub redirect_uris: Vec<String>,
    pub grant_types: Vec<String>,
    pub response_types: Vec<String>,
    pub authentication: ClientAuthentication,
    pub scope: Option<String>,
    pub dpop_bound_access_tokens: bool,
}

A validated client metadata document.

Reduced to the fields this server’s endpoints and plan/app-allowlist.md need. plan/app-allowlist.md also asks that client_name, client_uri and logo_uri be recorded and never displayed, since showing an untrusted client’s own self-description to anyone is how impersonation works — this server has no human to show them to, so that requirement is met by construction, and they are kept here only for the log line that records them.

Fields

client_id: String

Must equal the URL it was fetched from; checked in validate.

application_type: ApplicationType

What kind of client this is, which decides the redirects it may register. Left out of the content key when it is the default, so a document that says web and one that says nothing hash alike.

client_name: Option<String>

The applicant’s own name for itself. Never displayed; see the module doc.

client_uri: Option<String>

The applicant’s own homepage. Never displayed.

logo_uri: Option<String>

The applicant’s own logo. Never displayed.

redirect_uris: Vec<String>

Where an authorization code may be delivered. Never empty after validation.

grant_types: Vec<String>

OAuth grant types this client uses. Defaults to ["authorization_code"] when absent.

response_types: Vec<String>

OAuth response types this client uses. Defaults to ["code"].

authentication: ClientAuthentication

How this client authenticates at par and token; see crate::oauth::client_auth.

scope: Option<String>

The scope this client declares it may ask for, if it published one.

dpop_bound_access_tokens: bool

Must be true: the atproto OAuth profile requires every access token to be DPoP-bound, and a client that has not opted into that is not one this server’s tokens can be issued to.

Implementations

impl ClientMetadataDocument

pub fn admits_redirect_uri(&self, requested: &str) -> bool

Whether a push may name requested as its redirect.

Exact, except for a loopback redirect (http://127.0.0.1 or http://[::1]), which matches on everything but the port. A native client listens on whatever port it is handed when it starts: RFC 8252 §7.3 says “the authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs”, and the atproto profile says of its loopback clients “Path components must match, but port numbers are not matched.”

Trait Implementations

impl Clone for ClientMetadataDocument

fn clone(&self) -> ClientMetadataDocument

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientMetadataDocument

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ClientMetadataDocument

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ClientMetadataDocument

fn eq(&self, other: &ClientMetadataDocument) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ClientMetadataDocument

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ClientMetadataDocument

impl StructuralPartialEq for ClientMetadataDocument