Enum TokenRequest 

pub enum TokenRequest {
    AuthorizationCode {
        client_id: ClientId,
        client_secret: Option<String>,
        code: String,
        redirect_uri: Option<String>,
        code_verifier: Option<String>,
    },
    ClientCredentials {
        client_id: ClientId,
        client_secret: Option<String>,
        scope: Option<ScopeSet>,
    },
    DeviceCode {
        client_id: ClientId,
        client_secret: Option<String>,
        device_code: String,
    },
    RefreshToken {
        client_id: ClientId,
        client_secret: Option<String>,
        refresh_token: String,
        scope: Option<ScopeSet>,
    },
}

A parsed token-endpoint request (RFC 6749 section 3.2). The host parses the form body and the Authorization header into this; client_secret is None for public clients.

Debug is hand-written (see below) rather than derived. Every variant of this type is built directly out of an inbound request and every variant carries at least one credential: RFC 6749 section 2.3.1 makes client_secret a password, and section 4.1.2, section 6 and RFC 8628 section 3.4 each make the grant artifact (code, refresh_token, device_code) a bearer credential in its own right. This is the type a host is most likely to debug-print, since it is the request it just parsed, so a derived Debug here would be the single easiest way to end up with plaintext credentials in a host’s logs.

Variants

AuthorizationCode

RFC 6749 section 4.1.3: grant_type=authorization_code, with the RFC 7636 code_verifier that OAuth 2.1 makes mandatory.

Fields

client_id: ClientId

The redeeming client.

client_secret: Option<String>

The client secret, when the client is confidential.

code: String

The code from the authorization response (single use).

redirect_uri: Option<String>

The redirect URI the authorization request used; must match exactly.

code_verifier: Option<String>

The PKCE verifier for the challenge recorded against the code.

ClientCredentials

RFC 6749 section 4.4: grant_type=client_credentials. Confidential clients only, and no refresh token is issued (section 4.4.3: the client can simply request another token).

Fields

client_id: ClientId

The client acting on its own behalf.

client_secret: Option<String>

The client secret. A public client has none, and cannot use this grant.

scope: Option<ScopeSet>

Optional narrowing scope.

DeviceCode

RFC 8628 section 3.4: grant_type=urn:ietf:params:oauth:grant-type:device_code.

Fields

client_id: ClientId

The polling client.

client_secret: Option<String>

The client secret, when the client is confidential.

device_code: String

The device_code from the device authorization response.

RefreshToken

RFC 6749 section 6: grant_type=refresh_token, with OAuth 2.1 rotation.

Fields

client_id: ClientId

The refreshing client.

client_secret: Option<String>

The client secret, when the client is confidential.

refresh_token: String

The refresh token being redeemed (single use).

scope: Option<ScopeSet>

Optional narrowing scope; widening is invalid_scope.

Trait Implementations

impl Clone for TokenRequest

fn clone(&self) -> TokenRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenRequest

Hand-written so no credential reaches a debug format, while everything that identifies WHICH request this is stays visible: the variant name (so the grant type is readable), client_id (RFC 6749 section 2.2 makes it explicitly not a secret), redirect_uri and scope.

client_secret and code_verifier are Options, and the Some/None distinction is kept: it is not a credential, it is the difference between “a secret was presented” and “none was”, which is exactly what someone debugging an invalid_client (RFC 6749 section 5.2) or a missing-PKCE rejection needs, and it can be read off the request’s shape without the value.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for TokenRequest

impl PartialEq for TokenRequest

fn eq(&self, other: &TokenRequest) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TokenRequest