metadata

atproto OAuth discovery as Effects, two hops of well-known metadata: PDS /.well-known/oauth-protected-resource -> authorization_servers[0] issuer /.well-known/oauth-authorization-server -> endpoints

Both documents are parsed into types that only exist once their checks pass: the protected resource must name the PDS it was fetched from (RFC 9728), the authorization server’s issuer must equal the issuer it was fetched for (RFC 8414 section 3.3), every endpoint is a parsed remote.Url, and the server must advertise the capabilities the atproto OAuth profile requires (RFC 9207 iss, mandatory PAR, ES256 DPoP, client metadata documents, the atproto scope).

Types

AuthorizationServer

opaque

An authorization server whose metadata passed issuer, endpoint, and capability checks. Obtainable only through fetch_authorization_server or discover.

pub opaque type AuthorizationServer

Capability

A capability the atproto OAuth profile requires of an authorization server.

pub type Capability {
  AuthorizationResponseIss
  RequiredPushedAuthorizationRequests
  DpopEs256
  ClientIdMetadataDocument
  AtprotoScope
}

Constructors

```
AuthorizationResponseIss
```
```
RequiredPushedAuthorizationRequests
```
```
DpopEs256
```
```
ClientIdMetadataDocument
```
```
AtprotoScope
```

MetadataError

pub type MetadataError {
  ResourceFetchFailed(error: effect.FetchError)
  ResourceMismatch(requested: String, claimed: String)
  NoAuthorizationServer(resource: String)
  InvalidAuthorizationServer(error: remote.UrlError)
  ServerFetchFailed(error: effect.FetchError)
  IssuerMismatch(requested: String, claimed: String)
  InvalidEndpoint(field: String, error: remote.UrlError)
  MissingCapability(issuer: String, capability: Capability)
}

Constructors

ResourceFetchFailed(error: effect.FetchError)

ResourceMismatch(requested: String, claimed: String)

```
NoAuthorizationServer(resource: String)
```

InvalidAuthorizationServer(error: remote.UrlError)

ServerFetchFailed(error: effect.FetchError)

IssuerMismatch(requested: String, claimed: String)

InvalidEndpoint(field: String, error: remote.UrlError)

MissingCapability(issuer: String, capability: Capability)

ProtectedResource

opaque

A PDS’s protected-resource metadata, checked against the PDS origin.

pub opaque type ProtectedResource

Values

authorization_endpoint

pub fn authorization_endpoint(
  server: AuthorizationServer,
) -> remote.Url

authorization_server

pub fn authorization_server(
  metadata: ProtectedResource,
) -> remote.Origin

capability_to_string

pub fn capability_to_string(capability: Capability) -> String

discover

pub fn discover(
  pds: remote.Origin,
) -> effect.Effect(Result(AuthorizationServer, MetadataError))

Resolve a PDS to its verified authorization server in one call.

fetch_authorization_server

pub fn fetch_authorization_server(
  issuer: remote.Origin,
) -> effect.Effect(Result(AuthorizationServer, MetadataError))

Fetch issuer’s authorization-server metadata and verify it. The metadata issuer must be exactly remote.origin_to_string(issuer).

fetch_protected_resource

pub fn fetch_protected_resource(
  pds: remote.Origin,
) -> effect.Effect(Result(ProtectedResource, MetadataError))

Fetch pds’s protected-resource metadata and require its resource to be that same origin.

issuer

pub fn issuer(server: AuthorizationServer) -> remote.Origin

metadata_error_to_string

pub fn metadata_error_to_string(error: MetadataError) -> String

pushed_authorization_request_endpoint

pub fn pushed_authorization_request_endpoint(
  server: AuthorizationServer,
) -> remote.Url

resource

pub fn resource(metadata: ProtectedResource) -> remote.Origin

revocation_endpoint

pub fn revocation_endpoint(
  server: AuthorizationServer,
) -> option.Option(remote.Url)

token_endpoint

pub fn token_endpoint(server: AuthorizationServer) -> remote.Url