session

A verified OAuth session: the only shape in which the kernel hands out tokens. A VerifiedSession is produced by flow.callback or tokens.refresh after the token response passed every check: DPoP token type, the atproto scope, a sub equal to the DID the flow started for, and that DID resolving (natively, via its DID document and PDS) to the very authorization server that issued the tokens.

Types

Refresh

Whether the authorization server issued a refresh token. atproto servers normally do; RFC 6749 lets them omit it, and then the session simply cannot be refreshed.

pub type Refresh {
  RefreshToken(token: String)
  NoRefreshToken
}

Constructors

```
RefreshToken(token: String)
```
```
NoRefreshToken
```

TokenError

Why a token request (code exchange or refresh) did not yield a session.

pub type TokenError {
  TokenRequestFailed(error: transport.PostError)
  TokenEndpointRejected(
    status: Int,
    error: option.Option(String),
  )
  TokenResponseInvalid(reason: String)
  WrongTokenType(token_type: String)
  MissingAtprotoScope(scope: String)
  InvalidSubject(error: did.DidError)
  SubjectMismatch(expected: String, actual: String)
  SubjectResolutionFailed(did: String, error: did.DidError)
  SubjectDiscoveryFailed(
    did: String,
    error: metadata.MetadataError,
  )
  SubjectIssuerMismatch(
    did: String,
    expected: String,
    actual: String,
  )
  ServerDiscoveryFailed(error: metadata.MetadataError)
  NotRefreshable
}

Constructors

TokenRequestFailed(error: transport.PostError)

```
TokenEndpointRejected(status: Int, error: option.Option(String))
```
A non-2xx from the token endpoint. error is the OAuth error code (e.g. invalid_grant) when the body carried a well-formed one; the body itself is never kept.
```
TokenResponseInvalid(reason: String)
```
```
WrongTokenType(token_type: String)
```
```
MissingAtprotoScope(scope: String)
```
```
InvalidSubject(error: did.DidError)
```

SubjectMismatch(expected: String, actual: String)

SubjectResolutionFailed(did: String, error: did.DidError)

SubjectDiscoveryFailed(
  did: String,
  error: metadata.MetadataError,
)

```
SubjectIssuerMismatch(
  did: String,
  expected: String,
  actual: String,
)
```
The sub’s own PDS names a different authorization server than the one that issued the tokens.

ServerDiscoveryFailed(error: metadata.MetadataError)

```
NotRefreshable
```

VerifiedSession

opaque

pub opaque type VerifiedSession

Values

access_token

pub fn access_token(session: VerifiedSession) -> String

client_id

pub fn client_id(session: VerifiedSession) -> String

did

pub fn did(session: VerifiedSession) -> did.Did

The account the tokens belong to, as verified against the issuer.

expires_in

pub fn expires_in(session: VerifiedSession) -> Int

Seconds the access token was valid for when issued.

issuer

pub fn issuer(session: VerifiedSession) -> remote.Origin

pds

pub fn pds(session: VerifiedSession) -> remote.Origin

The PDS origin the access token may be sent to.

refresh

pub fn refresh(session: VerifiedSession) -> Refresh

restore

pub fn restore(
  did did: did.Did,
  pds pds: remote.Origin,
  issuer issuer: remote.Origin,
  client_id client_id: String,
  access_token access_token: String,
  scope scope: String,
  expires_in expires_in: Int,
  refresh refresh: Refresh,
) -> VerifiedSession

Rebuild a session you previously persisted from a VerifiedSession’s accessors. The values are trusted as-is: only feed this what verification produced and your own storage kept.

scope

pub fn scope(session: VerifiedSession) -> String

token_error_to_string

pub fn token_error_to_string(error: TokenError) -> String