Struct OAuthAuthorizationPolicy 

pub struct OAuthAuthorizationPolicy {

    pub account_key: Option<OAuthAccountKey>,
    pub callback_path: Option<String>,
    pub disable_sign_up_option: Option<bool>,
    pub issuer: Option<String>,
    pub end_session: Option<OAuthEndSessionConfig>,
    pub verify_grant_id_token: bool,
    pub id_token_nonce_binding: bool,
    pub discovery_openid_scope: bool,
    pub authorization_code: Option<OAuthAuthorizationCodeCallback>,
    pub authorization_code_pkce: Option<bool>,
    pub client_id_parameter: String,
    pub literal_client_id: Option<String>,
    pub token_expiry_always: bool,
    pub token_response_omits_id_token: bool,
    pub scope_separator: String,
    pub emit_empty_scope: bool,
    pub authorization_fragment: Option<String>,
    pub supports_refresh: bool,
    pub supports_profile_mapper: bool,
    pub allow_missing_access_token: bool,
    pub default_access_token_expires_in: Option<f64>,
    pub configured_scopes: Vec<String>,
    pub omit_scopes: bool,
    pub scope_encoding: OAuthScopeEncoding,
    pub deduplicate_scopes: bool,
    pub require_client_id: bool,
    pub token_endpoint_auth: Option<OAuthTokenEndpointAuth>,
    pub refresh_token_endpoint_auth: Option<OAuthTokenEndpointAuth>,
    pub fixed_authorization_params: Vec<(String, String)>,
    pub authorization_code_client_key: Option<String>,
    pub authorization_code_headers: Vec<(String, String)>,
    pub authorization_code_params: BTreeMap<String, String>,
    pub refresh_token_params: BTreeMap<String, String>,
    pub refresh_token_params_resolver: Option<OAuthRefreshTokenParams>,
    pub client_assertion: Option<OAuthClientAssertion>,
    pub refresh_scope: Option<String>,
    pub response_type: String,
    pub redirect_uri: Option<String>,
    pub response_mode: Option<String>,
    pub require_client_secret: bool,
    pub login_hint: bool,
    pub disable_default_scopes: bool,
    pub scope_order: OAuthScopeOrder,
    pub pkce: bool,
    pub prompt: Option<String>,
    pub default_prompt: Option<String>,
    pub discord_permissions: Option<f64>,
    pub propagate_grant_profile_errors: bool,
    pub preserve_raw_email_errors: bool,
    pub preserve_raw_profile_scalars: bool,
    pub honor_factory_options: bool,
    pub source_profile_exceptions: bool,
}

Immutable authorization configuration used by the built-in social providers. Scope entries retain their original order and whitespace; providers may opt into removing exact duplicates.

Fields

account_key: Option<OAuthAccountKey>

Optional application subject resolver; precedes the profile-only factory subject.

callback_path: Option<String>

Application callback path, normalized relative to the authentication base.

disable_sign_up_option: Option<bool>

Preserve explicit false separately from absent provider signup configuration.

issuer: Option<String>

Trusted discovery issuer for authorization-response mixup protection.

end_session: Option<OAuthEndSessionConfig>

RP-initiated logout from trusted generic-provider configuration.

verify_grant_id_token: bool

Verify code-grant ID tokens against trusted discovery metadata before profile admission.

id_token_nonce_binding: bool

Bind discovered ID tokens to a nonce in authenticated OAuth state.

discovery_openid_scope: bool

Discovery advertised OIDC signing algorithms; prepend openid if absent.

authorization_code: Option<OAuthAuthorizationCodeCallback>

Application-owned or provider-specific code grant implementation.

authorization_code_pkce: Option<bool>

A code grant can retain PKCE even when authorization disables it (Zoom).

client_id_parameter: String

Name of the client identifier in custom authorization URLs.

literal_client_id: Option<String>

Custom URL factories may interpolate the entire client array.

token_expiry_always: bool

WeChat’s custom factory constructs an expiry even for zero/null seconds.

token_response_omits_id_token: bool

Custom factory token objects can omit returned grant ID tokens.

scope_separator: String

emit_empty_scope: bool

authorization_fragment: Option<String>

supports_refresh: bool

Dedicated factories may lack a built-in refresh implementation (Vercel).

supports_profile_mapper: bool

TikTok’s published factory ignores mapProfileToUser.

allow_missing_access_token: bool

Published social factories pass through omitted access tokens to userinfo.

default_access_token_expires_in: Option<f64>

Generic-provider fallback, applied only when a grant omits actual expiry.

configured_scopes: Vec<String>

omit_scopes: bool

Providers such as PayPal deliberately omit even configured/requested scopes.

scope_encoding: OAuthScopeEncoding

deduplicate_scopes: bool

Retain the first occurrence of each scope, as Cloudflare requires.

require_client_id: bool

token_endpoint_auth: Option<OAuthTokenEndpointAuth>

None preserves the existing generic provider credential transport.

refresh_token_endpoint_auth: Option<OAuthTokenEndpointAuth>

Grant-specific authentication when refresh differs from code exchange.

fixed_authorization_params: Vec<(String, String)>

Provider parameters applied after caller additions.

authorization_code_client_key: Option<String>

Optional application client key sent in authorization-code forms only.

authorization_code_headers: Vec<(String, String)>

Trusted provider headers applied to authorization-code grants only.

authorization_code_params: BTreeMap<String, String>

Trusted additional code-grant form fields (tokenUrlParams). Fields already supplied by the grant, including PKCE, are preserved. Token authentication is applied afterwards and retains credential authority.

refresh_token_params: BTreeMap<String, String>

Trusted static refresh form fields (refreshTokenParams). Ordinary fields replace defaults; grant type and refresh token cannot be replaced. Validate tenant, scope, and audience entitlements before configuring them.

refresh_token_params_resolver: Option<OAuthRefreshTokenParams>

When configured, replaces the static map at each default refresh grant. Ok(None) supplies no additions; errors abort before transport/writes. Custom refresh handlers take precedence and bypass this resolver.

client_assertion: Option<OAuthClientAssertion>

Required by private_key_jwt; invoked afresh for each real token grant.

refresh_scope: Option<String>

Exact configured refresh scope, including an explicitly empty value.

response_type: String

redirect_uri: Option<String>

Application callback URI overrides the generated provider callback.

response_mode: Option<String>

require_client_secret: bool

login_hint: bool

disable_default_scopes: bool

scope_order: OAuthScopeOrder

pkce: bool

prompt: Option<String>

default_prompt: Option<String>

Used when prompt is absent or empty; Discord defaults to none.

discord_permissions: Option<f64>

Discord emits this JS number only when the effective scopes contain bot.

propagate_grant_profile_errors: bool

Preserve thrown decoded grant-profile failures instead of redirecting. Missing/falsy ID tokens still follow the absent-profile redirect.

preserve_raw_email_errors: bool

Preserve effective raw email type errors at their callback stage. Typed native profile fields remain unchanged.

preserve_raw_profile_scalars: bool

Retain the published adapter scalar rather than discarding it in bool projection.

honor_factory_options: bool

Some published factories omit their returned options object entirely.

source_profile_exceptions: bool

Preserve uncaught published profile/application callback exceptions.

Trait Implementations

impl Clone for OAuthAuthorizationPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthAuthorizationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OAuthAuthorizationPolicy

fn default() -> Self

Returns the “default value” for a type.