Module device_code 

Device-code flow against login.microsoftonline.com/<tenant>/oauth2/v2.0/.

Polling state machine handles all the cases the spec calls out:

• 200 OK → success
• 400 authorization_pending → keep polling at the same interval
• 400 slow_down → bump interval by +5s
• 400 bad_verification_code → keep polling (transient)
• 400 authorization_declined / expired_token / access_denied → terminal failure
• any other 4xx/5xx → terminal failure with structured error (body never leaked)

Polling budget tracks scheduled sleep time only; real wall clock can exceed expires_in if requests are slow. The server’s expired_token response is the authoritative cap.

Structs

DeviceCodeResponse

IdClaims

Identity claims we extract from the id_token (oid, tid, preferred_username, name).

OAuth2Error

Structured OAuth2 error response from the token endpoint.

TokenResponse

Functions

decode_id_token

Decode the middle segment of a JWT (no signature verification — we trust the channel the token came over, like every other MSAL-style client).

default_scope

Build the full scope string we request in v0.1.

poll_for_token

redact_token_fields

Strip token-shaped substrings from any string destined for an error message.

refresh

request_device_code