Struct OidcClient 

pub struct OidcClient<PS>
where
    PS: PendingOauthStore,
{ /* private fields */ }

Wraps the OIDC discovered client for login/callback flows.

The redirect URI is resolved dynamically per-request so that external_base_url = "auto" can produce the correct absolute callback URL based on the incoming request headers.

Implementations

impl<PS> OidcClient<PS>

where PS: PendingOauthStore,

pub async fn from_config( config: OidcClientConfig<PS::Config>, ) -> OidcResult<Self>

pub async fn from_provider( provider: Arc<OAuthProviderRuntime>, config: OidcClientConfig<PS::Config>, ) -> OidcResult<Self>

pub fn provider(&self) -> &Arc<OAuthProviderRuntime>

pub async fn handle_code_authorize( &self, external_base_url: &Url, ) -> OidcResult<OidcCodeFlowAuthorizationRequest>

pub async fn handle_code_authorize_with_redirect_override( &self, external_base_url: &Url, redirect_url_override: Option<&str>, ) -> OidcResult<OidcCodeFlowAuthorizationRequest>

pub async fn handle_code_authorize_with_redirect_override_and_extra_data( &self, external_base_url: &Url, redirect_url_override: Option<&str>, extra_data: Option<Value>, ) -> OidcResult<OidcCodeFlowAuthorizationRequest>

pub async fn handle_device_authorize( &self, ) -> OidcResult<OidcDeviceAuthorizationResult>

pub async fn handle_device_token_poll( &self, device_authorization: &OidcDeviceAuthorizationResult, current_interval: Option<Duration>, ) -> OidcResult<OidcDeviceTokenPollResult>

pub async fn handle_device_token_poll_until_complete( &self, device_authorization: &OidcDeviceAuthorizationResult, timeout: Option<Duration>, ) -> OidcResult<OidcDeviceTokenResult>

pub async fn handle_code_callback( &self, search_params: OidcCodeCallbackSearchParams, external_base_url: &Url, ) -> OidcResult<OidcCodeCallbackResult>

pub async fn handle_code_callback_with_redirect_override( &self, search_params: OidcCodeCallbackSearchParams, external_base_url: &Url, redirect_url_override: Option<&str>, ) -> OidcResult<OidcCodeCallbackResult>

pub async fn handle_code_callback_with_redirect_override_diagnosed( &self, search_params: OidcCodeCallbackSearchParams, external_base_url: &Url, redirect_url_override: Option<&str>, ) -> DiagnosedResult<OidcCodeCallbackResult, OidcError>

pub async fn handle_token_refresh( &self, refresh_token: String, id_token: Option<String>, ) -> OidcResult<OidcRefreshTokenResult>

pub async fn handle_token_refresh_diagnosed( &self, refresh_token: String, id_token: Option<String>, ) -> DiagnosedResult<OidcRefreshTokenResult, OidcError>

pub async fn handle_token_revoke( &self, token: OidcRevocableToken, ) -> OidcResult<()>

pub async fn handle_user_info_exchange( &self, id_token_raw: &str, access_token: &str, ) -> OidcResult<UserInfoExchangeResult>

Shared user_info exchange helper for backend modes.

Given a raw id_token string and a bearer access_token, this method:

1. Decodes and verifies the ID token (nonce validation is skipped, since this is a server-side post-flow call, not an in-flight callback).
2. Optionally calls the provider’s userinfo endpoint (if available).
3. Runs check_claims to produce a ClaimsCheckResult.

Backend OIDC presets (pure, mediated, etc.) should call this helper rather than reimplementing the user-info protocol stack.

pub fn authorize_url( &self, external_base_url: &Url, ) -> OidcResult<OidcCodeFlowAuthorizationRequest>

pub fn authorize_url_with_redirect_override( &self, external_base_url: &Url, redirect_url_override: Option<&str>, ) -> OidcResult<OidcCodeFlowAuthorizationRequest>

pub async fn exchange_code( &self, external_base_url: &Url, code: &str, nonce: &Nonce, pkce_verifier_secret: Option<&str>, ) -> OidcResult<OidcCodeExchangeResult>

pub async fn exchange_code_with_redirect_override( &self, external_base_url: &Url, code: &str, nonce: &Nonce, pkce_verifier_secret: Option<&str>, redirect_url_override: Option<&str>, ) -> OidcResult<OidcCodeExchangeResult>