flow

Start an authorization flow as an Effect: resolve the PDS, discover the authorization server, push the request (PAR) with PKCE + DPoP, and return the authorization URL plus the discovered endpoints. The one-shot inputs the platform computes (PKCE challenge, state) come in as parameters; the DPoP key never appears here (PAR’s proof is a DpopProof effect). The per-target wrapper adds the key and its own Flow record.

Types

Authorized

What the kernel resolves before the wrapper folds in its platform key: the authorization redirect URL and the discovered endpoints.

pub type Authorized {
  Authorized(
    redirect_url: String,
    pds: String,
    issuer: String,
    token_endpoint: String,
  )
}

Constructors

Authorized(
  redirect_url: String,
  pds: String,
  issuer: String,
  token_endpoint: String,
)

StartError

pub type StartError {
  ResolveFailed(String)
  DiscoverFailed(String)
  ParFailed(String)
}

Constructors

```
ResolveFailed(String)
```
```
DiscoverFailed(String)
```
```
ParFailed(String)
```

Values

start

pub fn start(
  resolver resolver: String,
  identifier identifier: String,
  client_id client_id: String,
  redirect_uri redirect_uri: String,
  scope scope: String,
  pkce_challenge pkce_challenge: String,
  state state: String,
  extra_form extra_form: List(#(String, String)),
) -> effect.Effect(Result(Authorized, StartError))