oauth_toolkit/lib.rs
1#![forbid(unsafe_code)]
2#![deny(missing_docs)]
3
4//! Turnkey OAuth2/OIDC primitives for Rust.
5//!
6//! Two capabilities lead the crate:
7//!
8//! - **RFC 8252 desktop loopback flow** ([`loopback`]) — binds an ephemeral
9//! `127.0.0.1` port, builds the authorization URL with PKCE (S256) and a
10//! single-use `state`, captures exactly one redirect, then shuts down.
11//! The [`oauth2`](https://crates.io/crates/oauth2) crate ships protocol
12//! primitives but no turnkey loopback listener; this is one call:
13//! [`loopback::LoopbackFlow::start`] → open URL →
14//! [`loopback::LoopbackFlow::wait_for_code`].
15//! - **Mail-provider presets** ([`providers`]) — Gmail, Outlook, Yahoo,
16//! AOL, and Fastmail endpoints plus the IMAP/SMTP XOAUTH2 scope sets for
17//! desktop mail clients.
18//!
19//! Around those: PKCE generation *and* server-side verification
20//! ([`pkce`]), token exchange/refresh ([`token`]), OIDC discovery and
21//! JWKS-backed validation ([`oidc`], [`oidc_validator`]), social login
22//! (GitHub/Google, [`social`]), CSRF state ([`csrf`]), scope handling
23//! ([`scope`]), and HMAC/opaque-token crypto ([`crypto`]).
24//!
25//! Scope note: [`oauth2`](https://crates.io/crates/oauth2) covers the full
26//! grant surface (client credentials, device code, extensions) and
27//! [`openidconnect`](https://crates.io/crates/openidconnect) validates ID
28//! tokens more deeply (nonce, `at_hash`, ES256, per-`kid` keys) — this
29//! crate trades that breadth for turnkey flows.
30
31pub mod crypto;
32pub mod csrf;
33pub mod jwt;
34pub mod loopback;
35pub mod oidc;
36pub mod oidc_validator;
37pub mod pkce;
38pub mod providers;
39pub mod redirect;
40pub mod scope;
41pub mod social;
42pub mod token;