Struct OidcProviderService 

pub struct OidcProviderService<S> { /* private fields */ }

OIDC Provider service — authx as IdP.

Implementations

impl<S> OidcProviderService<S>

where S: OidcClientRepository + AuthorizationCodeRepository + OidcTokenRepository + DeviceCodeRepository + UserRepository + Clone + Send + Sync + 'static,

pub fn new(storage: S, config: OidcProviderConfig) -> Self

pub async fn create_authorization_code( &self, request: CreateAuthorizationCodeRequest<'_>, ) -> Result<(String, String)>

Validate authorize request and create authorization code. Caller must ensure user is authenticated.

pub async fn exchange_code( &self, code: &str, client_id: &str, client_secret: Option<&str>, redirect_uri: &str, code_verifier: Option<&str>, ) -> Result<OidcTokenResponse>

Exchange authorization code for tokens.

pub async fn refresh( &self, refresh_token: &str, client_id: &str, client_secret: Option<&str>, scope: Option<&str>, ) -> Result<OidcTokenResponse>

Exchange refresh token for new tokens.

pub fn validate_access_token(&self, token: &str) -> Result<Uuid>

Validate Bearer access token and return user ID for UserInfo.

pub async fn userinfo(&self, access_token: &str) -> Result<Value>

Validate access token and return UserInfo claims as JSON.

pub async fn revoke_token( &self, token: &str, token_type_hint: Option<&str>, client_id: &str, client_secret: Option<&str>, ) -> Result<()>

Revoke a token (access or refresh). Per RFC 7009, the endpoint always returns success even if the token was already invalid.

pub async fn introspect_token( &self, token: &str, token_type_hint: Option<&str>, client_id: &str, client_secret: Option<&str>, ) -> Result<IntrospectionResponse>

Introspect a token. Returns active=true with claims for valid tokens, or active=false for invalid/expired/revoked tokens.

pub async fn request_device_authorization( &self, client_id: &str, scope: &str, ) -> Result<DeviceAuthorizationResponse>

Step 1: Device requests authorization. Returns device_code, user_code, etc.

pub async fn verify_user_code( &self, user_code: &str, user_id: Uuid, approve: bool, ) -> Result<()>

Step 2: User approves or denies the device code via the verification page.

pub async fn poll_device_code( &self, device_code: &str, client_id: &str, ) -> Result<OidcTokenResponse, DeviceCodeError>

Step 3: Device polls for token. Returns tokens on success or a DeviceCodeError.