Struct OAuthProviderPlugin 

pub struct OAuthProviderPlugin { /* private fields */ }

Implementations

impl OAuthProviderPlugin

pub async fn validate_access_token<S: AuthSchema>( &self, ctx: &AuthContext<S>, token: &str, client_id: Option<&str>, ) -> Result<Value, EndpointError>

Validate access authority and return its RFC 7662 payload. Unknown tokens are errors; recognized but inactive authority returns active: false.

pub async fn require_active_access_token<S: AuthSchema>( &self, ctx: &AuthContext<S>, token: &str, client_id: Option<&str>, ) -> Result<Value, EndpointError>

Require recognized and active authority, preserving the reference Bearer challenge.

impl OAuthProviderPlugin

pub async fn authenticate_client<S: AuthSchema>( &self, ctx: &AuthContext<S>, call: &EndpointCall, grant_type: Option<&str>, options: &OAuthClientAuthenticationOptions, ) -> Result<OAuthAuthenticatedClient, EndpointError>

Authenticate a client against this endpoint, its scopes and an optional bound grant. Equivalent to getOAuthProviderApi(...).authenticateClient; assertion audiences use the logical endpoint path. Public clients require an explicit caller opt-in.

impl OAuthProviderPlugin

pub fn oauth2_authorize_endpoint( query: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Authorize an OAuth request with its genuine physical request attached.

impl OAuthProviderPlugin

pub fn create_oauth_client_endpoint( input: &CreateOAuthClientInput, ) -> AuthResult<ServerEndpoint<Value>>

impl OAuthProviderPlugin

pub fn get_oauth_client_endpoint( client_id: &str, ) -> AuthResult<ServerEndpoint<Value>>

Read an owned client without exposing its stored credential.

impl OAuthProviderPlugin

pub fn get_oauth_client_public_endpoint( client_id: &str, ) -> AuthResult<ServerEndpoint<Value>>

Read public display fields for any authenticated user.

impl OAuthProviderPlugin

pub fn get_oauth_clients_endpoint() -> ServerEndpoint<Value>

List durable clients belonging to the authenticated user.

impl OAuthProviderPlugin

pub fn delete_oauth_client_endpoint( client_id: &str, ) -> AuthResult<ServerEndpoint<()>>

Delete a durable client owned by the authenticated user.

impl OAuthProviderPlugin

pub fn rotate_client_secret_endpoint( client_id: &str, ) -> AuthResult<ServerEndpoint<Value>>

Rotate an owned confidential client secret and reveal its replacement once.

impl OAuthProviderPlugin

pub fn update_oauth_client_endpoint( client_id: &str, update: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Patch metadata of a durable client owned by the authenticated user.

impl OAuthProviderPlugin

pub fn register_oauth_client_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Register a client under the provider’s dynamic-registration policy.

impl OAuthProviderPlugin

pub fn admin_create_oauth_client_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Create a managed client with operator fields through the trusted server API.

impl OAuthProviderPlugin

pub fn admin_update_oauth_client_endpoint( client_id: &str, update: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Patch operator-controlled fields of an owned client through the server-only API.

impl OAuthProviderPlugin

pub fn get_oauth_client_public_prelogin_endpoint( client_id: &str, oauth_query: Option<&str>, ) -> AuthResult<ServerEndpoint<Value>>

Read public client display metadata before login using a provider-issued authorization query.

impl OAuthProviderPlugin

pub async fn register_client_metadata_document<S: AuthSchema>( &self, input: RegisterClientMetadataDocumentInput, ctx: &AuthContext<S>, ) -> Result<OAuthClientRegistrationResult, EndpointError>

Persist a validated document under its discovery owner. This does not fetch or discover it.

impl OAuthProviderPlugin

pub fn oauth2_consent_endpoint( accept: bool, scope: Option<&str>, oauth_query: Option<&str>, ) -> AuthResult<ServerEndpoint<Value>>

Accept or deny a provider-issued authorization request as the current user.

impl OAuthProviderPlugin

pub fn get_oauth_consents_endpoint() -> ServerEndpoint<Value>

List durable OAuth grants belonging to the current authenticated user.

impl OAuthProviderPlugin

pub fn get_oauth_consent_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Return the current user’s durable consent identified by its stored grant ID.

impl OAuthProviderPlugin

pub fn update_oauth_consent_endpoint( id: &str, scopes: &[String], ) -> AuthResult<ServerEndpoint<Value>>

Replace the current user’s granted scopes with a subset allowed by the client.

impl OAuthProviderPlugin

pub fn delete_oauth_consent_endpoint(id: &str) -> AuthResult<ServerEndpoint<()>>

Delete the current user’s stored OAuth grant.

impl OAuthProviderPlugin

pub fn oauth2_continue_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Resume a signed OAuth request after account selection, registration or post-login interaction.

impl OAuthProviderPlugin

pub async fn get_client<S: AuthSchema>( &self, ctx: &AuthContext<S>, client_id: &str, ) -> AuthResult<Option<OAuthClient>>

Resolve the raw client for a trusted server caller, including stored credentials. Equivalent to getOAuthProviderApi(...).getClient; callers authorize access.

impl OAuthProviderPlugin

pub fn get_oauth_provider_api<'a, S: AuthSchema>( &'a self, context: &'a AuthContext<S>, call: &'a EndpointCall, grant_type: Option<&'a str>, ) -> impl OAuthProviderApi + 'a

Obtain live capabilities for an extension or a trusted companion endpoint. Issuance without a bound grant is rejected by the shared issuance owner.

impl OAuthProviderPlugin

pub async fn issue_tokens<S: AuthSchema>( &self, ctx: &AuthContext<S>, call: &EndpointCall, grant_type: Option<&str>, params: &OAuthTokenIssueParams, ) -> Result<Value, EndpointError>

Mint authority for an already authorized caller. The grant is required, but need not be registered: admission is the trusted caller’s responsibility.

impl OAuthProviderPlugin

pub fn oauth2_introspect_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Inspect an access or refresh token using the introspecting client’s credentials.

impl OAuthProviderPlugin

pub fn oauth2_end_session_confirmation_endpoint() -> AuthResult<ServerEndpoint<Value>>

pub fn oauth2_end_session_endpoint( input: &Value, ) -> AuthResult<ServerEndpoint<Value>>

impl OAuthProviderPlugin

pub fn admin_create_oauth_resource_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Create durable provider resource policy through the server-only administration API.

impl OAuthProviderPlugin

pub fn admin_list_oauth_resources_endpoint() -> ServerEndpoint<Value>

List the provider’s complete resource catalog through its server-only API.

impl OAuthProviderPlugin

pub fn admin_get_oauth_resource_endpoint( identifier: &str, ) -> AuthResult<ServerEndpoint<Value>>

Read durable resource policy by a raw or URI-encoded identifier through the server-only API.

impl OAuthProviderPlugin

pub fn admin_update_oauth_resource_endpoint( identifier: &str, patch: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Patch the provider’s durable resource policy without changing its identifier.

impl OAuthProviderPlugin

pub fn admin_delete_oauth_resource_endpoint( identifier: &str, ) -> AuthResult<ServerEndpoint<Value>>

Remove durable provider resource policy through the server-only administration API.

impl OAuthProviderPlugin

pub fn admin_link_client_resource_endpoint( identifier: &str, client_id: &str, ) -> AuthResult<ServerEndpoint<Value>>

Grant a client durable membership in a provider resource through the server-only API.

impl OAuthProviderPlugin

pub fn admin_unlink_client_resource_endpoint( identifier: &str, client_id: &str, ) -> AuthResult<ServerEndpoint<Value>>

Remove a client’s durable resource membership, including an already absent pair.

impl OAuthProviderPlugin

pub fn oauth2_revoke_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Revoke an issued token using its client’s registered authentication method.

impl OAuthProviderPlugin

pub fn oauth2_token_endpoint( input: &impl Serialize, ) -> AuthResult<ServerEndpoint<Value>>

Exchange an OAuth grant through the provider’s public server operation.

impl OAuthProviderPlugin

pub async fn hash_token(&self, token: &str, kind: &str) -> AuthResult<String>

Hash a token using this provider’s storage policy (getOAuthProviderApi().hashToken).

impl OAuthProviderPlugin

pub fn oauth2_user_info_endpoint() -> ServerEndpoint<Value>

Read the current user claims authorized by an OAuth access token.

impl OAuthProviderPlugin

pub fn new() -> Self

pub fn with_config(config: OAuthProviderConfig) -> Self

pub fn get_oauth_server_config_endpoint() -> ServerEndpoint<Value>

Return the issuer’s authorization-server configuration for trusted server callers.

pub fn get_open_id_config_endpoint() -> ServerEndpoint<Value>

Return OpenID configuration when the provider supports the openid scope.

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for OAuthProviderPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn rate_limits(&self) -> Vec<PluginRateLimit>

Ordered rate-limit policies supplied by this installed plugin.

fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>>

Installed logical-call hooks, in this plugin’s registration order.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called after route matching and before endpoint dispatch.

fn after_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = AuthResult<AuthResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Transform a completed response, including redirects and rejections.

fn allowed_media_types(&self, route: &AuthRoute) -> Vec<&'static str>

Media types accepted before request hooks and endpoint dispatch. An empty list disables the media restriction for an application-owned endpoint.

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn server_endpoints(&self) -> Vec<EndpointDefinition>

Trusted operations available through host dispatch, independently of HTTP visibility.

fn validate_endpoint( &self, call: &EndpointCall, _ctx: &AuthContext<S>, ) -> AuthResult<EndpointInput>

Validate actual input after all before-hook patches have been applied.

fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Execute a registered operation with validated handler-phase context.

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn origin_check_skip_paths(&self) -> Vec<&'static str>

Protocol callback prefixes whose verified state replaces browser origin admission.

fn session_fields(&self) -> IndexMap<String, FieldConfig>

Session field policies contributed by this registered plugin.

fn user_fields(&self) -> IndexMap<String, FieldConfig>

fn account_fields(&self) -> IndexMap<String, FieldConfig>

fn openapi_metadata(&self, _ctx: &AuthInitContext<S>) -> PluginOpenApiMetadata

Documentation annotations collected after all plugins initialize. Override this hook for custom endpoints and model field policies.

fn static_openapi_metadata(&self) -> PluginOpenApiMetadata

Base declarations for documentation without an initialized auth instance.

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect the original physical HTTP request before routing, body parsing, origin validation and endpoint hooks. Disabled paths and transport/rate limiting middleware run first. Returning a response stops dispatch and later plugin hooks. Server-only endpoint calls do not invoke this hook.

fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect or replace the physical request. The default preserves existing on_http_request implementations. Request-local configuration has already been resolved from the incoming request, matching the Source HTTP handler.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, _response: &'life3 AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Observe the routed HTTP response before transport middleware (including CORS). Hooks run in registration order; the first replacement stops this chain. Early HTTP request-hook responses skip this stage. Errors escape dispatch; they cannot reverse writes already committed by an endpoint.

fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpEndpointResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Dispatch the resolved HTTP endpoint. Existing plugins return logical values through on_request; plugins returning a native raw response can override this method to bypass the endpoint after-hook pipeline.

fn on_user_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user: &'life1 <S as AuthSchema>::User, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a user is created

fn on_session_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session: &'life1 <S as AuthSchema>::Session, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a session is created

fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user_id: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a user is deleted

fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session_token: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a session is deleted

impl Clone for OAuthProviderPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthProviderPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OAuthProviderPlugin

fn default() -> Self

Returns the “default value” for a type.

impl<S: AuthSchema> EndpointHook<S> for OAuthProviderPlugin

fn matches_before( &self, call: &EndpointCall, _: &AuthContext<S>, ) -> AuthResult<bool>

Matchers observe raw logical context, before middleware normalization.

fn before<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeEndpointAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Errors

fn after<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, response: EndpointResponse, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Errors

fn matches_after( &self, _call: &EndpointCall, _ctx: &AuthContext<S>, _response: &EndpointResponse, ) -> Result<bool, AuthError>

Errors