Struct BackendOidcModeRuntime 

pub struct BackendOidcModeRuntime<MS>
where
    MS: PendingAuthStateMetadataRedemptionStore,
{ /* private fields */ }

Unified backend-oidc runtime.

Parameterized by a metadata-redemption store (which may be a no-op for the pure preset). Provides the single implementation of authorize, callback, refresh, and metadata redemption.

Implementations

impl<MS> BackendOidcModeRuntime<MS>

where MS: PendingAuthStateMetadataRedemptionStore,

pub fn from_config( config: BackendOidcModeRuntimeConfig<MS::Config>, ) -> BackendOidcModeRuntimeResult<Self>

Build the unified runtime from its config.

pub async fn from_resolved_config<PS>( resolved: Option<&ResolvedBackendOidcModeConfig<PS::Config, MS::Config>>, ) -> BackendOidcModeRuntimeResult<(Self, Option<Arc<OidcClient<PS>>>)>

where PS: PendingOauthStore, PS::Config: Clone, MS::Config: Clone,

Recommended entry point. Build both the runtime and the optional OIDC client from a resolved backend-oidc config.

Mirrors [AccessTokenSubstrateRuntime::from_resolved_config]:

BackendOidcModeRuntime::from_resolved_config(resolved_oidc.as_ref()).await?
  ──▸ (BackendOidcModeRuntime<MS>, Option<Arc<OidcClient<PS>>>)

AccessTokenSubstrateRuntime::from_resolved_config(&resolved_substrate).await?
  ──▸ (AccessTokenSubstrateRuntime, Option<Arc<OAuthResourceServerVerifier>>)

Pass None when OIDC is disabled — the runtime is built from a default config and oidc_client will be None.

Type parameters

• PS — pending OAuth store (Store type, e.g. MokaPendingOauthStore)
• MS — pending auth-state metadata redemption store (inferred from Self)

pub fn seal_refresh_token( &self, refresh_token: &str, ) -> BackendOidcModeRuntimeResult<SealedRefreshMaterial>

pub fn unseal_refresh_token( &self, material: &SealedRefreshMaterial, ) -> BackendOidcModeRuntimeResult<String>

pub fn auth_state_snapshot_from_code_callback( &self, result: &OidcCodeCallbackResult, options: &BackendOidcModeAuthStateOptions, ) -> BackendOidcModeRuntimeResult<AuthStateSnapshot>

pub fn auth_state_metadata_delta_from_refresh_result( current_metadata: Option<&CurrentAuthStateMetadataSnapshotPartial>, result: &OidcRefreshTokenResult, ) -> AuthStateMetadataDelta

pub async fn authorize_code_flow<PS>( &self, oidc_client: &OidcClient<PS>, external_base_url: &Url, requested_post_auth_redirect_uri: Option<&str>, redirect_url_override: Option<&str>, ) -> BackendOidcModeRuntimeResult<OidcCodeFlowAuthorizationRequest>

where PS: PendingOauthStore,

Build an authorization URL for the OIDC code flow.

When post_auth_redirect_policy = resolved, the post_auth_redirect_uri is resolved against the allowlist and encoded into the OIDC state. When caller_validated, no redirect URI is embedded.

pub async fn handle_code_callback<PS>( &self, oidc_client: &OidcClient<PS>, search_params: OidcCodeCallbackSearchParams, external_base_url: &Url, auth_state_options: &BackendOidcModeAuthStateOptions, redirect_url_override: Option<&str>, ) -> BackendOidcModeRuntimeResult<BackendOidcModeCodeCallbackResult>

where PS: PendingOauthStore,

Handle the OIDC code callback.

pub async fn handle_token_refresh<PS>( &self, oidc_client: &OidcClient<PS>, payload: &BackendOidcModeRefreshPayload, external_base_url: &Url, ) -> BackendOidcModeRuntimeResult<BackendOidcModeTokenRefreshResult>

where PS: PendingOauthStore,

Handle a token refresh.

pub async fn handle_code_callback_inline<PS>( &self, oidc_client: &OidcClient<PS>, search_params: OidcCodeCallbackSearchParams, external_base_url: &Url, auth_state_options: &BackendOidcModeAuthStateOptions, redirect_url_override: Option<&str>, ) -> BackendOidcModeRuntimeResult<BackendOidcModeCodeCallbackResult>

where PS: PendingOauthStore,

Handle the OIDC code callback for a JSON body response, embedding metadata inline.

Compared to handle_code_callback this method:

• Skips post_auth_redirect_uri resolution (irrelevant for body flows)
• Skips issue_metadata_snapshot and the associated store write
• Embeds AuthStateMetadataSnapshot directly in the response body

This removes one store write and one client redemption round-trip, making it the preferred implementation for callback_body_return.

pub async fn handle_token_refresh_inline<PS>( &self, oidc_client: &OidcClient<PS>, payload: &BackendOidcModeRefreshPayload, ) -> BackendOidcModeRuntimeResult<BackendOidcModeTokenRefreshResult>

where PS: PendingOauthStore,

Handle a token refresh for a JSON body response, embedding metadata inline.

Compared to handle_token_refresh this method:

• Skips post_auth_redirect_uri resolution (irrelevant for body flows)
• Skips issue_metadata_delta and the associated store write
• Embeds AuthStateMetadataDelta directly in the response body

This removes one store write and one client redemption round-trip, making it the preferred implementation for refresh_body_return.

pub async fn redeem_metadata( &self, payload: &BackendOidcModeMetadataRedemptionRequest, ) -> BackendOidcModeRuntimeResult<Option<BackendOidcModeMetadataRedemptionResponse>>

Redeem metadata by one-time redemption id.

Trait Implementations

impl<MS> Clone for BackendOidcModeRuntime<MS>

where MS: PendingAuthStateMetadataRedemptionStore + Clone,

fn clone(&self) -> BackendOidcModeRuntime<MS>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<MS> Debug for BackendOidcModeRuntime<MS>

where MS: PendingAuthStateMetadataRedemptionStore,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.