entropy-auth 2026.7.31

Authentication and authorization for Entropy Softworks server and API projects
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

//! OAuth 2.0 Authorization Code flow with PKCE support.
//!
//! This module builds authorization URLs, token exchange requests, and
//! parses token responses. It does NOT make HTTP requests — the caller
//! provides the HTTP transport.
//!
//! # Design
//!
//! The implementation follows RFC 6749 (OAuth 2.0 Authorization Framework)
//! and RFC 7636 (PKCE) with the following security decisions:
//!
//! * **PKCE is always S256** — the `plain` method is insecure and rejected.
//! * **Client secrets** are stored in [`Zeroizing`] wrappers and never
//!   appear in query parameters (they go in the POST body only).
//! * **State parameter** uses constant-time comparison to prevent timing
//!   side-channel attacks on CSRF tokens.
//! * **No HTTP transport** — this module only builds requests and parses
//!   responses, leaving transport to the caller. This avoids coupling to
//!   any particular HTTP library.
//!
//! # Modules
//!
//! * [`OAuthConfig`] — OAuth provider configuration with builder pattern.
//! * [`PkceChallenge`] — PKCE code verifier and challenge (RFC 7636).
//! * [`OAuthState`] — CSRF state parameter generation and verification.
//! * [`AuthorizationRequest`] — Authorization URL construction.
//! * [`TokenExchangeRequest`] — Token exchange request building (POST body).
//! * [`TokenResponse`] — Token response parsing from JSON.
//! * [`RefreshRequest`] — Refresh token request building.
//!
//! [`Zeroizing`]: crate::crypto::zeroize::Zeroizing

mod authorization;
mod config;
mod device;
mod pkce;
mod refresh;
pub mod server;
mod state;
mod token_request;
mod token_response;

pub use self::authorization::AuthorizationRequest;
pub use self::config::{OAuthConfig, OAuthConfigBuilder, OAuthConfigError};
pub use self::device::{
    DEFAULT_POLL_INTERVAL_SECS, DeviceAccessTokenRequest, DeviceAuthorizationRequest,
    DeviceAuthorizationResponse, DeviceFlowError, DeviceTokenOutcome, SLOW_DOWN_INCREMENT_SECS,
};
pub use self::pkce::PkceChallenge;
pub use self::refresh::RefreshRequest;
pub use self::state::OAuthState;
pub use self::token_request::TokenExchangeRequest;
pub use self::token_response::{TokenResponse, TokenResponseError};