cratefield_oauth_client/
lib.rs

1//! OAuth 2.0 for the harness's modules and adapters (issue #531).
2//!
3//! Three-legged OAuth is the same shape everywhere and is still easy to get
4//! wrong in ways that matter: a scope list that is not encoded, a refresh
5//! that loops, a token pasted into a log. This crate speaks the protocol
6//! once, over the [`HttpClient`](cratefield_core::HttpClient) port, so the
7//! code runs unchanged on Workers and native, and the provider is
8//! configuration ([`ProviderConfig`]) rather than a client type per brand.
9//!
10//! Sealing what comes back is a trait, [`TokenSealer`], so moving storage to
11//! the secrets store later is a swap of implementations, not a rewrite of
12//! every module: `fz-module-linkedin` seals today with [`XChaChaSealer`]
13//! (ADR 0102), and the blob format it writes is the one that has to keep
14//! opening.
15//!
16//! **wasm-safe.** No `std::net`, no wall clock, no threads: HTTP goes
17//! through the `HttpClient` port and randomness through `getrandom`, whose
18//! wasm backend the manifest enables on `wasm32`.
19
20#![doc = include_str!("../README.md")]
21#![forbid(unsafe_code)]
22
23mod client;
24mod config;
25pub mod device;
26mod pkce;
27mod refresh;
28mod seal;
29
30pub use client::{OAuthClient, OAuthError, ProviderError, TokenResponse};
31pub use config::{ClientAuth, ProviderConfig, authorize_url};
32pub use pkce::{Pkce, RandomError, random_state};
33pub use refresh::{SendWithRefreshError, send_with_refresh};
34pub use seal::{KEY_LEN, SealContext, SealError, TokenSealer, XChaChaSealer};
cratefield_oauth_client/lib.rs

cratefield_oauth_client/
lib.rs
