Module oauth 

Rust-native atproto OAuth — the replacement for the Node sidecar.

This module is the live login and repo path when FEATHERREADER_REPO_BACKEND=rust; crate::atproto::SidecarClient is the default and serves it otherwise. Both implementations share an at-rest wire format so the switch is reversible in either direction — see crypto.

Modules

client_auth

How this client authenticates to the authorization server.

crypto

Application-layer at-rest encryption for the OAuth secrets.

discovery

Authorization-server discovery, and the validations that make it safe.

dpop

DPoP (RFC 9449) — proof-of-possession for the per-session key.

fetch

Fetching the JSON documents OAuth discovery depends on.

flow

The login flow’s decisions: PKCE, browser binding, PAR, and the callback.

identity

atproto identity resolution: handle → DID → DID document → PDS.

jwt

ES256 JWS signing — the one signing primitive the OAuth flow needs.

keys

The OAuth confidential-client signing key, and the documents derived from it.

login

The browser-facing halves of the OAuth flow: starting a login and finishing one.

metadata

The OAuth client-identity documents: client-metadata.json and the client_id derived from it.

request

DPoP-authenticated form POSTs, with nonce persistence and a bounded retry.

resolve

Turning what a user typed into a DID, a DID document, and a PDS.

revoke

RFC 7009 token revocation — what “log out” actually means at the PDS.

runtime

The Rust OAuth client’s long-lived state, assembled once at startup.

session

Holding a session valid: refresh-on-read, rotation, and what a failure means.

store

Persistence for in-flight logins, authenticated sessions, and DPoP nonces.

token

Token exchange, refresh, and what a token response has to prove.

xrpc

DPoP-bound com.atproto.repo.* calls against the user’s PDS.