Module oauth 

OAuth 2.0 for atproto (plan/oauth.md).

Built in slices; see each submodule’s own doc for what it covers and what it deliberately does not. dpop is the RFC 9449 verifier side, and scope is didbot-scope, the granular atproto scope grammar as a typed value with containment and intersection — the substrate a ceiling is expressed over, shared with every other program that computes one.

The authorization server itself — pushed authorization requests, authorize, token, refresh rotation, client metadata — is sibling work landing in sibling files under this module. Each of those endpoints holds a dpop::DpopVerifier and calls dpop::DpopVerifier::verify once per request.

Re-exports

pub use didbot_scope as scope;

Modules

authorize

GET /oauth/authorize, the authorization response, and the ceiling.

browser

Browser sessions: an account signs its own browser in, so the authorize page can hand a code only to a browser signed in as the account a sign-in names. See plan/browser-binding.md.

client_auth

Confidential clients: private_key_jwt client authentication.

client_metadata

Fetching, validating, and caching OAuth client metadata documents.

consent

The consent seam.

decision

Decision records: what a pushed authorization request becomes, and what an agent answers.

discovery

Authorization server metadata: GET /.well-known/oauth-authorization-server. Protected-resource metadata: GET /.well-known/oauth-protected-resource.

dpop

DPoP proof verification (RFC 9449), the verifier side.

dpop_seam

The narrow interface every caller needs from DPoP verification (RFC 9449).

error

The error shape OAuth’s own endpoints use.

par

Pushed authorization requests (RFC 9126), and where a sign-in is decided.

permission_set

What an include: scope grants: the permission set it names, resolved from the set’s lexicon authority and cached.

token

POST /oauth/token: authorization code exchange and refresh rotation.

Structs

OAuthState

Every collaborator the OAuth authorization server routes need, bundled so crate::routes::AuthState carries one field instead of a dozen.

Constants

DPOP_NONCE_TTL 🔒

How long a DPoP nonce is handed out before a fresh one replaces it.

DPOP_SKEW 🔒

How far a DPoP proof’s iat may sit from this server’s own clock, either direction — and, per dpop::DpopVerifier::new’s own doc, also how long a jti is retained in the replay cache, since the two are the same number for the reason named there. Matches token::ACCESS_TTL: a proof need only stay fresh for about as long as the token it mints or presents is good for.

Functions

client_metadata_http_client

The client OAuthState::default fetches client metadata documents with.