1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
//! OAuth 2.1 authorization, as MCP's revisions specify it.
//!
//! Which revision requires what is [`authorization_model`](crate::domain::authorization_model)
//! in `domain/`. This module holds the decisions that follow from it, and they
//! are split by who makes them: [`token`] is the pure logic this crate owns and
//! can be tested without a socket, while the crypto and HTTP that turn a
//! presented string into claims live in adapters.
//!
//! No scope vocabulary is defined here. The vendored spec names no scope
//! strings, so any table would be this crate inventing one and presenting it as
//! policy — see [`token::ScopePolicy`].
// `client`, `callback` and `redeem` read `domain::oauth`, which is gated on the
// same feature, so they carry the gate too. `token` does not and stays ungated:
// it is pure claim logic with no dependency on a SHA-256 implementation or a
// base64url codec.
pub use ;