Struct OidcServerClient 

pub struct OidcServerClient { /* private fields */ }

Minimal OIDC client for server-side PKCE code exchange.

Constructed once at server startup from the compiled schema. The client secret is read from the environment at that time and held in memory — it is never written to disk or emitted in logs.

Implementations

impl OidcServerClient

pub fn new( client_id: impl Into<String>, client_secret: impl Into<String>, server_redirect_uri: impl Into<String>, authorization_endpoint: impl Into<String>, token_endpoint: impl Into<String>, ) -> Self

Construct a client directly from resolved credentials and endpoints.

Prefer Self::from_compiled_schema in production code. This constructor exists for testing and direct wiring.

pub fn from_compiled_schema(schema_json: &Value) -> Option<Arc<Self>>

Build an OidcServerClient from the compiled schema JSON.

Returns None if:

• schema_json["auth"] is absent, or
• the env var named by client_secret_env is not set, or
• the OIDC endpoint cache (schema_json["auth_endpoints"]) is absent.

In all failure cases an explanatory tracing::error! is emitted so operators can diagnose startup issues without reading source code.

pub fn authorization_url( &self, state: &str, code_challenge: &str, code_challenge_method: &str, ) -> String

Build the OIDC /authorize redirect URL with all required PKCE params.

The state, code_challenge, and redirect_uri values are percent-encoded so that base64-url characters (+, /, =) do not break query string parsing on the provider side.

pub async fn exchange_code( &self, code: &str, code_verifier: &str, http: &Client, ) -> Result<OidcTokenResponse, Error>

Exchange an authorization code for tokens.

Sends a POST to the provider’s /token endpoint with the PKCE code_verifier and all required OAuth2 fields.

Errors

Returns an error if the HTTP request fails, the provider returns a non-success status, the response exceeds MAX_OIDC_RESPONSE_BYTES, or the response body cannot be parsed as JSON.

Trait Implementations

impl Debug for OidcServerClient

Custom Debug implementation that redacts the client secret.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.