A standards-driven implementation of the OAuth 2.0 and 2.1 message family. More...
Functions | |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_assertion (const std::string_view issuer, const std::string_view subject, const std::string_view audience, const std::chrono::seconds lifetime, const std::chrono::system_clock::time_point now, const JWKPrivate &key, const JWSAlgorithm algorithm) -> std::optional< std::string > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_client_assertion (const std::string_view client_id, const std::string_view audience, const std::chrono::seconds lifetime, const std::chrono::system_clock::time_point now, const JWKPrivate &key, const JWSAlgorithm algorithm) -> std::optional< std::string > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_client_assertion (const std::string_view assertion, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_jwt_bearer (const std::string_view assertion, const std::string_view scope, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_verify_client_assertion (const std::string_view assertion, const std::span< const std::string_view > expected_audiences, const std::string_view request_client_id, const JWKS &keys, const std::chrono::system_clock::time_point now, const OAuthAssertionVerifyOptions &options) -> std::optional< OAuthAssertionError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_verify_assertion_grant (const std::string_view assertion, const std::string_view expected_issuer, const std::span< const std::string_view > expected_audiences, const JWKS &keys, const std::chrono::system_clock::time_point now, const OAuthAssertionVerifyOptions &options) -> std::optional< OAuthAssertionError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_url (const std::string_view endpoint, const OAuthAuthorizationRequest &request, std::string &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_authorization_request (const std::string_view query, std::string &storage, OAuthAuthorizationRequest &result, const std::function< void(std::string_view, std::string_view)> &on_other) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_redirect_uri_matches (const std::string_view registered, const std::string_view presented, const OAuthProfile profile) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_private_use_scheme (const std::string_view scheme) noexcept -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_authorization_response (const std::string_view query, std::string &storage, OAuthAuthorizationResponse &result) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_redirect (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_error_redirect (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_default_response_mode (const std::string_view response_type) -> std::optional< OAuthResponseMode > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_response_mode_allowed (const std::string_view response_type, const OAuthResponseMode mode) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_redirect (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, const OAuthResponseMode mode, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_error_redirect (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, const OAuthResponseMode mode, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_form_post (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, std::string &sink, const std::string_view title="Submit This Form") -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_authorization_error_form_post (const std::string_view redirect_uri, const OAuthAuthorizationResponse &response, std::string &sink, const std::string_view title="Submit This Form") -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_bearer_header (const std::string_view token, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_challenge_parameter (const std::string_view header, const std::string_view scheme, const std::string_view name) -> std::optional< std::string > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_challenge (const std::string_view scheme, const OAuthChallenge &challenge, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_has_audience (const JSON &claims, const std::string_view audience) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_has_scope (const JSON &claims, const std::string_view value) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_dpop_bound (const JSON &claims) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_client_secret_basic (const std::string_view client_id, const std::string_view client_secret, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_client_secret_post (const std::string_view client_id, const std::string_view client_secret, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_client_id_only (const std::string_view client_id, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_client_authentication (const std::string_view authorization, const std::string_view body, SecureString &storage, OAuthClientCredentials &credentials) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_device_authorization_request (const std::string_view client_id, const std::string_view scope, const std::span< const OAuthParameter > resources, std::string &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_device (const std::string_view device_code, const std::span< const OAuthParameter > resources, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_device_authorization_response (const std::string_view device_code, const std::string_view user_code, const std::string_view verification_uri, const std::string_view verification_uri_complete, const std::chrono::seconds expires_in, const std::chrono::seconds interval) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_device_user_code () -> std::array< char, 8 > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_device_user_code_matches (const std::string_view presented, const std::string_view stored) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_dpop_confirmation (const std::string_view thumbprint) -> JSON |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_dpop_proof_thumbprint (const std::string_view proof) -> std::optional< std::string > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_dpop_verify (const std::string_view proof, const std::string_view method, const std::string_view url, const std::chrono::system_clock::time_point now, const OAuthDPoPVerifyOptions &options) -> std::optional< OAuthDPoPError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_valid_dpop_nonce (const std::string_view value) noexcept -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_error_code (const OAuthAuthorizationError error) noexcept -> std::string_view |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_error_code (const OAuthTokenError error) noexcept -> std::string_view |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_error_code (const OAuthBearerError error) noexcept -> std::string_view |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_error_code (const OAuthRegistrationError error) noexcept -> std::string_view |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::to_oauth_authorization_error (const std::string_view code) noexcept -> std::optional< OAuthAuthorizationError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::to_oauth_token_error (const std::string_view code) noexcept -> std::optional< OAuthTokenError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::to_oauth_bearer_error (const std::string_view code) noexcept -> std::optional< OAuthBearerError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::to_oauth_registration_error (const std::string_view code) noexcept -> std::optional< OAuthRegistrationError > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_token_error_status (const OAuthTokenError error, const bool authenticated_via_header) noexcept -> HTTPStatus |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_bearer_error_status (const OAuthBearerError error) noexcept -> HTTPStatus |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_introspection_request (const std::string_view token, const std::string_view token_type_hint, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_introspection_inactive () -> JSON |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_well_known_url (const std::string_view identifier, const OAuthWellKnownKind kind, std::string &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_endpoint_url (const std::string_view value) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_resource_identifier (const std::string_view value) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_is_issuer_identifier (const std::string_view value) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_server_metadata (const OAuthServerMetadataConfig &config) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_resource_metadata (const OAuthResourceMetadataConfig &config) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_par_request (const OAuthAuthorizationRequest &request, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_par_authorization_url (const std::string_view endpoint, const std::string_view client_id, const std::string_view request_uri, std::string &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_par_request (const std::string_view body, SecureString &storage, OAuthAuthorizationRequest &result, const std::function< void(std::string_view, std::string_view)> &on_other) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_par_request_uri () -> std::string |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_par_response (const std::string_view request_uri, const std::chrono::seconds expires_in) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_par_dpop_binding (const std::string_view dpop_jkt, const std::optional< std::string_view > proof_thumbprint) -> std::optional< std::string_view > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_pkce_method_code (const OAuthPKCEMethod method) noexcept -> std::string_view |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::to_oauth_pkce_method (const std::string_view value) noexcept -> std::optional< OAuthPKCEMethod > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_pkce_verifier () -> std::array< char, 43 > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_pkce_challenge (const std::string_view verifier) -> std::array< char, 43 > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_pkce_verify (const std::string_view verifier, const std::string_view challenge, const OAuthPKCEMethod method, const OAuthProfile profile) -> OAuthPKCEOutcome |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_random_token () -> std::array< char, 43 > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_registration_request (const OAuthClientRegistrationConfig &config) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_registration_error_response (const std::string_view error, const std::string_view error_description) -> JSON |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_registration_grant_response_consistent (const OAuthClientMetadata &metadata) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_apply_software_statement_claims (JSON &metadata, const JSON &claims) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_registration_response (const JSON &metadata, const OAuthClientRegistrationResult &result) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_registration_update_request (const OAuthClientRegistrationConfig &config, const std::string_view client_id, const std::string_view client_secret) -> std::optional< JSON > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_revocation_request (const std::string_view token, const std::string_view token_type_hint, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_revocation_request (const std::string_view body, SecureString &storage, OAuthTokenLookupRequest &result, const std::function< void(std::string_view, std::string_view)> &on_other) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_revocation_outcome (const HTTPStatus status) noexcept -> OAuthRevocationOutcome |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_code (const std::string_view code, const std::string_view redirect_uri, const std::string_view code_verifier, const std::span< const OAuthParameter > resources, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_refresh (const std::string_view refresh_token, const std::string_view scope, const std::span< const OAuthParameter > resources, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_client_credentials (const std::string_view scope, const std::span< const OAuthParameter > resources, SecureString &sink) -> void |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_parse_token_request (const std::string_view body, SecureString &storage, OAuthTokenRequest &result, const std::function< void(std::string_view, std::string_view)> &on_other) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_token_response (const OAuthTokenGrant &grant) -> JSON |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_make_token_error_response (const std::string_view error, const std::string_view error_description, const std::string_view error_uri) -> JSON |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_token_exchange_valid (const OAuthTokenExchangeRequest &request) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_build_token_request_exchange (const OAuthTokenExchangeRequest &request, SecureString &sink) -> bool |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_issued_token_type (const JSON &response) -> std::optional< std::string_view > |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_transaction_mint () -> OAuthTransactionSecrets |
| SOURCEMETA_CORE_OAUTH_EXPORT auto | sourcemeta::core::oauth_transaction_check (const OAuthTransaction &transaction, const OAuthAuthorizationResponse &response, const OAuthIssuerSupport issuer_support, const std::string_view received_uri, std::string_view &code) -> std::optional< OAuthCallbackError > |
Variables | |
| constexpr std::string_view | sourcemeta::core::OAUTH_GRANT_TYPE_JWT_BEARER |
| constexpr std::string_view | sourcemeta::core::OAUTH_CLIENT_ASSERTION_TYPE_JWT_BEARER |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_DPOP {"DPoP"} |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_HINT_ACCESS_TOKEN |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_HINT_REFRESH_TOKEN |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_ACCESS_TOKEN |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_REFRESH_TOKEN |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_ID_TOKEN |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_SAML1 |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_SAML2 |
| constexpr std::string_view | sourcemeta::core::OAUTH_TOKEN_TYPE_JWT |
A standards-driven implementation of the OAuth 2.0 and 2.1 message family.
This functionality is included as follows:
| struct sourcemeta::core::OAuthAssertionVerifyOptions |
The inputs to JWT bearer assertion verification beyond the request. The accepted algorithms are matched exactly, so an empty set accepts none, and a replay store, when set, rejects a reused identifier.
Public Attributes | |
| std::span< const JWSAlgorithm > | allowed_algorithms {} |
| std::chrono::seconds | clock_skew {std::chrono::seconds{0}} |
| The tolerance applied to the expiration, not-before, and issue times. | |
| OAuthDPoPReplayStore * | replay_store {nullptr} |
| std::span<const JWSAlgorithm> sourcemeta::core::OAuthAssertionVerifyOptions::allowed_algorithms {} |
The algorithms accepted per local policy, a non-owning view whose backing storage must outlive the verification (RFC 7523 Section 5).
| OAuthDPoPReplayStore* sourcemeta::core::OAuthAssertionVerifyOptions::replay_store {nullptr} |
The store tracking assertion identifiers to reject a replay, ignored when null or when the assertion carries no identifier (RFC 7523 Section 3 check 7).
| struct sourcemeta::core::OAuthParameter |
A single query or form parameter as a name and value pair. Both members are non-owning views that must outlive any use of this parameter. For example:
Public Attributes | |
| std::string_view | name |
| The parameter name. | |
| std::string_view | value |
| The parameter value, still in its raw unescaped form. | |
| struct sourcemeta::core::OAuthAuthorizationRequest |
A non-owning view of the parameters of an authorization request (RFC 6749 Section 4.1.1). Every field borrows from the caller and must outlive any use of this struct. An empty scalar field is treated as absent and is not emitted, and the spans carry the repeatable and extension parameters. For example:
Public Attributes | |
| std::string_view | client_id |
| The client identifier (RFC 6749 Section 2.2). | |
| std::string_view | redirect_uri |
| std::string_view | scope |
| The space-delimited requested scope (RFC 6749 Section 3.3). | |
| std::string_view | state |
| std::string_view | code_challenge |
| The PKCE code challenge (RFC 7636 Section 4.3). | |
| std::string_view | code_challenge_method |
| std::string_view | request_uri |
| The reference to a pushed authorization request (RFC 9126 Section 4). | |
| std::string_view | dpop_jkt |
| The JWK thumbprint of the DPoP proof public key (RFC 9449 Section 10). | |
| std::string_view | response_type |
| std::span< const OAuthParameter > | resources |
| std::span< const OAuthParameter > | extra |
| std::string_view sourcemeta::core::OAuthAuthorizationRequest::code_challenge_method |
The PKCE code challenge method, emitted only alongside a challenge (RFC 7636 Section 4.3).
| std::span<const OAuthParameter> sourcemeta::core::OAuthAuthorizationRequest::extra |
The extension parameters, such as an OpenID Connect nonce, emitted verbatim after the known parameters.
| std::string_view sourcemeta::core::OAuthAuthorizationRequest::redirect_uri |
The redirection endpoint the response is returned to (RFC 6749 Section 3.1.2).
| std::span<const OAuthParameter> sourcemeta::core::OAuthAuthorizationRequest::resources |
The repeatable resource indicators, each an absolute URI without a fragment (RFC 8707 Section 2).
| std::string_view sourcemeta::core::OAuthAuthorizationRequest::response_type |
The response type, a space-delimited set that defaults to code when unset and is otherwise honored by the authorization URL and pushed request builders alike, surfaced on parse so a server can tell a missing value from one it does not understand (RFC 6749 Section 3.1.1). It is placed after the older members so an existing positional initializer keeps populating them.
| std::string_view sourcemeta::core::OAuthAuthorizationRequest::state |
The opaque cross-site request forgery token echoed back on the response (RFC 6749 Section 10.12).
| struct sourcemeta::core::OAuthAuthorizationResponse |
A non-owning view of an authorization response returned on the redirection endpoint (RFC 6749 Section 4.1.2). Each field borrows from the parsed query or the decode arena, so both must outlive the view, and an absent parameter is an empty view. A present error marks a failure response (RFC 6749 Section 4.1.2.1).
Public Attributes | |
| std::string_view | code |
| The authorization code (RFC 6749 Section 4.1.2). | |
| std::string_view | state |
| The state value echoed from the request (RFC 6749 Section 4.1.2). | |
| std::string_view | iss |
| The issuer identifier of the authorization server (RFC 9207 Section 2). | |
| std::string_view | error |
| The error code of a failure response (RFC 6749 Section 4.1.2.1). | |
| std::string_view | error_description |
| std::string_view | error_uri |
| std::string_view sourcemeta::core::OAuthAuthorizationResponse::error_description |
The human-readable error description of a failure response (RFC 6749 Section 4.1.2.1).
| std::string_view sourcemeta::core::OAuthAuthorizationResponse::error_uri |
The URI of a human-readable error page for a failure response (RFC 6749 Section 4.1.2.1).
| struct sourcemeta::core::OAuthChallenge |
The parameters of a WWW-Authenticate challenge a protected resource returns (RFC 6750 Section 3, RFC 9728 Section 5.1, RFC 9449 Section 7.1). Every field is a non-owning view that must outlive any use of this struct, and an empty field is omitted from the challenge.
Public Attributes | |
| std::string_view | realm |
| The protection space the credentials apply to (RFC 6750 Section 3). | |
| std::string_view | scope |
| The space-delimited scope the token must carry (RFC 6750 Section 3). | |
| std::string_view | error |
| The error code (RFC 6750 Section 3.1). | |
| std::string_view | error_description |
| The human-readable error description (RFC 6750 Section 3). | |
| std::string_view | error_uri |
| The URI of a human-readable error page (RFC 6750 Section 3). | |
| std::string_view | resource_metadata |
| std::string_view | algs |
| std::string_view sourcemeta::core::OAuthChallenge::algs |
The space-delimited JWS algorithms the DPoP scheme accepts (RFC 9449 Section 7.1).
| std::string_view sourcemeta::core::OAuthChallenge::resource_metadata |
The URL of the protected resource metadata document (RFC 9728 Section 5.1).
| struct sourcemeta::core::OAuthClientCredentials |
The client credentials a token request presented, each a non-owning view into the request or the decode arena (RFC 6749 Section 2.3). An absent field is an empty view.
Public Attributes | |
| OAuthClientAuthenticationMethod | method |
| The mechanism the request presented. | |
| std::string_view | client_id |
| The client identifier. | |
| std::string_view | client_secret |
| The client secret, present only for Basic and Post. | |
| std::string_view | assertion_type |
| The assertion type, present only for Assertion (RFC 7521 Section 4.2). | |
| std::string_view | assertion |
| The assertion, present only for Assertion (RFC 7521 Section 4.2). | |
| class sourcemeta::core::OAuthDeviceAuthorizationResponse |
A non-owning view over a device authorization response (RFC 8628 Section 3.2) held in a caller-owned JSON value, which must outlive the view. A client keeps displaying the user code even when it uses the complete verification URI (RFC 8628 Section 3.3.1). For example:
Public Member Functions | |
| OAuthDeviceAuthorizationResponse (const JSON &data) | |
| Construct a view over a device authorization response, which is borrowed. | |
| auto | device_code () const -> std::optional< std::string_view > |
| The device verification code (RFC 8628 Section 3.2). | |
| auto | user_code () const -> std::optional< std::string_view > |
| The end-user verification code (RFC 8628 Section 3.2). | |
| auto | verification_uri () const -> std::optional< std::string_view > |
| The end-user verification URI (RFC 8628 Section 3.2). | |
| auto | verification_uri_complete () const -> std::optional< std::string_view > |
| The verification URI with the user code included (RFC 8628 Section 3.2). | |
| auto | expires_in () const -> std::optional< std::chrono::seconds > |
| auto | interval () const -> std::chrono::seconds |
| auto | data () const -> const JSON & |
| The underlying document. | |
|
nodiscard |
The lifetime of the device and user codes, no value when non-positive (RFC 8628 Section 3.2).
|
nodiscard |
The minimum polling interval, defaulting to five seconds when absent (RFC 8628 Section 3.2).
| class sourcemeta::core::OAuthDevicePoller |
A pure state machine driving the device flow polling (RFC 8628 Section 3.5). It tracks the polling interval and the code lifetime, and interprets token endpoint errors, without performing any I/O. For example:
Public Member Functions | |
| OAuthDevicePoller (const std::chrono::seconds interval, const std::chrono::seconds lifetime, const std::chrono::steady_clock::time_point start) noexcept | |
| auto | interval () const noexcept -> std::chrono::seconds |
| The current polling interval, which a slow_down error grows. | |
| auto | expired (const std::chrono::steady_clock::time_point now) const noexcept -> bool |
| Whether the codes have expired locally by the given time. | |
| auto | observe (const OAuthTokenError error) noexcept -> OAuthDevicePollDecision |
|
noexcept |
Construct a poller with the interval and lifetime the device authorization response advertised, from a starting time. A steady clock is used so wall clock adjustments cannot shorten or extend the lifetime. An interval of zero or less defaults to five seconds (RFC 8628 Section 3.5).
|
noexcept |
Interpret a token endpoint error, permanently adding five seconds to the interval on slow_down and continuing, continuing on authorization_pending, retrying with a nonce on a DPoP nonce requirement (RFC 9449 Section 8), and reporting a terminal decision otherwise (RFC 8628 Section 3.5).
| class sourcemeta::core::OAuthDPoPProofer |
A client-side minter of DPoP proof JSON Web Tokens (RFC 9449 Section 4.2) that holds one proof-of-possession key and the most recent nonce each server has issued. Nonces are tracked per server because a nonce is only accepted by the server that issued it (RFC 9449 Section 9), so a caller keys the authorization server by its issuer and each resource server by its origin. For example:
Public Member Functions | |
| OAuthDPoPProofer (JWKPrivate key, const JWSAlgorithm algorithm) | |
| OAuthDPoPProofer (const OAuthDPoPProofer &)=delete | |
| OAuthDPoPProofer (OAuthDPoPProofer &&)=delete | |
| auto | proof (const std::string_view server, const std::string_view method, const std::string_view url, const std::string_view access_token, const std::chrono::system_clock::time_point now, std::string &sink) -> bool |
| auto | observe (const std::string_view server, const std::string_view nonce) -> void |
| auto | thumbprint () const -> std::optional< std::string > |
| sourcemeta::core::OAuthDPoPProofer::OAuthDPoPProofer | ( | JWKPrivate | key, |
| const JWSAlgorithm | algorithm ) |
Construct a proofer bound to a proof-of-possession key and the asymmetric signature algorithm to sign proofs with (RFC 9449 Section 4.2).
|
delete |
A proofer owns a private key and a mutex, so it is neither copied nor moved.
| auto sourcemeta::core::OAuthDPoPProofer::observe | ( | const std::string_view | server, |
| const std::string_view | nonce ) -> void |
Record the most recent nonce a server issued through its response header, to be included in later proofs to that server, ignoring a malformed nonce rather than echoing it (RFC 9449 Section 8).
|
nodiscard |
Append a DPoP proof for a request to the sink, returning whether it could be built and signed. The method and target URI are covered by the proof, the access token binds the proof through its hash when it is presented to a protected resource and is omitted otherwise (RFC 9449 Section 7), and the most recent nonce the server issued is included when one is known. The creation time is taken from the given clock reading (RFC 9449 Section 4.2).
|
nodiscard |
The JSON Web Key thumbprint of the proof-of-possession key (RFC 9449 Section 6.1), the value a client sends to bind an authorization code to the key (RFC 9449 Section 10), or no value when the public part cannot be recovered.
| struct sourcemeta::core::OAuthDPoPVerifyOptions |
The inputs to DPoP proof verification a caller supplies beyond the request (RFC 9449 Section 4.3). Every field has a safe default, so a token endpoint verifying a proof with no bound token leaves the token and thumbprint unset, and a protected resource sets both.
Public Attributes | |
| std::size_t | proof_count {1} |
| std::span< const JWSAlgorithm > | allowed_algorithms {} |
| std::chrono::seconds | past_window {std::chrono::seconds{300}} |
| How far in the past a creation time may be (RFC 9449 Section 11.1). | |
| std::chrono::seconds | future_window {std::chrono::seconds{5}} |
| std::optional< std::string_view > | expected_nonce {std::nullopt} |
| std::optional< std::string_view > | access_token {std::nullopt} |
| std::optional< std::string_view > | bound_thumbprint {std::nullopt} |
| std::optional<std::string_view> sourcemeta::core::OAuthDPoPVerifyOptions::access_token {std::nullopt} |
The access token presented alongside the proof, requiring a matching hash claim when set, and requiring the bound thumbprint to also be set so the key binding is confirmed rather than skipped (RFC 9449 Section 7).
| std::span<const JWSAlgorithm> sourcemeta::core::OAuthDPoPVerifyOptions::allowed_algorithms {} |
The asymmetric algorithms accepted per local policy, every asymmetric algorithm when empty (RFC 9449 Section 4.3 check 5).
| std::optional<std::string_view> sourcemeta::core::OAuthDPoPVerifyOptions::bound_thumbprint {std::nullopt} |
The thumbprint the access token is bound to, requiring a matching proof key when set (RFC 9449 Section 4.3 check 12).
| std::optional<std::string_view> sourcemeta::core::OAuthDPoPVerifyOptions::expected_nonce {std::nullopt} |
The nonce the server issued to the client, requiring a matching nonce claim when set (RFC 9449 Section 9).
| std::chrono::seconds sourcemeta::core::OAuthDPoPVerifyOptions::future_window {std::chrono::seconds{5}} |
How far in the future a creation time may be, to tolerate clock offset (RFC 9449 Section 11.1).
| std::size_t sourcemeta::core::OAuthDPoPVerifyOptions::proof_count {1} |
The number of DPoP header fields the request carried, checked to be exactly one (RFC 9449 Section 4.3 check 1).
| class sourcemeta::core::OAuthDPoPReplayStore |
An in-memory store of the proof identifiers seen within their acceptance window, to reject a replayed DPoP proof at one target (RFC 9449 Section 11.1). A store instance is safe to share across threads, it holds a hash of each identifier rather than the identifier itself, and it is bounded to a fixed capacity so an attacker minting distinct proofs cannot exhaust memory. When full it fails closed, rejecting a new identifier rather than evicting a live entry whose replay guard is still needed, so a flood costs availability rather than replay protection. Give each entry a window that covers the whole acceptance window a proof enjoys, the sum of the past and future tolerances, so an entry never expires while its proof is still accepted. For example:
Public Member Functions | |
| OAuthDPoPReplayStore (const std::size_t capacity=DEFAULT_CAPACITY) noexcept | |
| OAuthDPoPReplayStore (const OAuthDPoPReplayStore &)=delete | |
| A store owns a mutex, so it is neither copied nor moved. | |
| OAuthDPoPReplayStore (OAuthDPoPReplayStore &&)=delete | |
| auto | check_and_insert (const std::string_view identifier, const std::string_view target, const std::chrono::system_clock::time_point now, const std::chrono::seconds window, const bool normalize_target=true) -> bool |
| auto | size (const std::chrono::system_clock::time_point now) const -> std::size_t |
Static Public Attributes | |
| static constexpr std::size_t | DEFAULT_CAPACITY {131072} |
| The default maximum number of live entries a store retains. | |
|
inlineexplicitnoexcept |
Construct an empty store with the given maximum number of live entries, beyond which a new identifier is rejected until a slot frees on expiry.
|
nodiscard |
Record a proof identifier at a target and report whether it is new, returning false for one already seen within its window, which is a replay (RFC 9449 Section 11.1). Entries whose window has elapsed by the given time are pruned, and a new identifier is refused once the store is full of live entries, so the return also stands for a store that cannot admit it. The target is canonicalized as an HTTP target URI when normalize_target is set, so an equivalent but differently spelled DPoP target still collides (RFC 9449 Section 4.3 check 9), and keyed verbatim otherwise, for a target compared without normalization such as an assertion audience.
|
nodiscard |
The number of entries whose window has not elapsed by the given time, counted without modifying the store, since expired entries are pruned when the next one is recorded.
| class sourcemeta::core::OAuthMetadataParseError |
An error that occurs when parsing an invalid authorization server or protected resource metadata document.
| class sourcemeta::core::OAuthRegistrationParseError |
An error that occurs when parsing an invalid dynamic client registration request or response.
| class sourcemeta::core::OAuthIntrospectionResponse |
A non-owning view over a token introspection response (RFC 7662 Section 2.2) held in a caller-owned JSON value, which must outlive the view. The active state is computed once at construction, since it is the one per-request hot accessor. A response must not be cached past its exp (RFC 7662 Section 4). For example:
Public Member Functions | |
| OAuthIntrospectionResponse (const JSON &data) | |
| auto | active () const noexcept -> bool |
| auto | scope () const -> std::optional< std::string_view > |
| The space-delimited scope (RFC 7662 Section 2.2), or no value when absent. | |
| auto | client_id () const -> std::optional< std::string_view > |
| The client identifier the token was issued to (RFC 7662 Section 2.2). | |
| auto | username () const -> std::optional< std::string_view > |
| The resource owner username (RFC 7662 Section 2.2). | |
| auto | token_type () const -> std::optional< std::string_view > |
| auto | subject () const -> std::optional< std::string_view > |
| The subject of the token (RFC 7662 Section 2.2). | |
| auto | issuer () const -> std::optional< std::string_view > |
| The issuer of the token (RFC 7662 Section 2.2). | |
| auto | jti () const -> std::optional< std::string_view > |
| The identifier of the token (RFC 7662 Section 2.2). | |
| auto | expiration () const -> std::optional< std::chrono::seconds > |
| The expiration time (RFC 7662 Section 2.2), or no value when absent. | |
| auto | issued_at () const -> std::optional< std::chrono::seconds > |
| The issuance time (RFC 7662 Section 2.2). | |
| auto | not_before () const -> std::optional< std::chrono::seconds > |
| The not-before time (RFC 7662 Section 2.2). | |
| auto | data () const -> const JSON & |
|
explicit |
Construct a view over an introspection response document, which is borrowed.
|
nodiscardnoexcept |
Whether the token is active (RFC 7662 Section 2.2), computed at construction. A missing or non-boolean active is treated as inactive.
|
nodiscard |
The underlying document, for reaching members without a typed accessor such as aud, may_act, or cnf.
|
nodiscard |
The token type, which is DPoP for a DPoP-bound token (RFC 7662 Section 2.2, RFC 9449 Section 6.2).
| class sourcemeta::core::OAuthServerMetadata |
An authorization server metadata document (RFC 8414), owning its JSON. The document is validated on construction against the issuer it was retrieved for: the issuer must match by exact code points and be a valid issuer identifier, response_types_supported must be present and non-empty, and an authentication method that needs a signing algorithm list must carry a non-empty one without none. Accessors apply the specification defaults, and any member without a typed accessor is reachable through the underlying document. A string accessor returns a view into the owned document, valid for the lifetime of this object, so a view taken before the object is moved from must not be used afterward. For example:
Public Member Functions | |
| OAuthServerMetadata (JSON &&data, const std::string_view issuer) | |
| auto | issuer () const -> std::string_view |
| The issuer identifier (RFC 8414 Section 2). | |
| auto | authorization_endpoint () const -> std::optional< std::string_view > |
| The authorization endpoint (RFC 8414 Section 2). | |
| auto | token_endpoint () const -> std::optional< std::string_view > |
| The token endpoint (RFC 8414 Section 2). | |
| auto | registration_endpoint () const -> std::optional< std::string_view > |
| The dynamic client registration endpoint (RFC 8414 Section 2). | |
| auto | device_authorization_endpoint () const -> std::optional< std::string_view > |
| The device authorization endpoint (RFC 8628 Section 4). | |
| auto | revocation_endpoint () const -> std::optional< std::string_view > |
| The token revocation endpoint (RFC 8414 Section 2). | |
| auto | introspection_endpoint () const -> std::optional< std::string_view > |
| The token introspection endpoint (RFC 8414 Section 2). | |
| auto | jwks_uri () const -> std::optional< std::string_view > |
| The JWK Set document location (RFC 8414 Section 2). | |
| auto | pushed_authorization_request_endpoint () const -> std::optional< std::string_view > |
| The pushed authorization request endpoint (RFC 9126 Section 5). | |
| auto | require_pushed_authorization_requests () const -> bool |
| auto | authorization_response_iss_parameter_supported () const -> bool |
| auto | supports_response_type (const std::string_view value) const -> bool |
| Whether a response type is supported (RFC 8414 Section 2). | |
| auto | supports_grant_type (const std::string_view value) const -> bool |
| auto | supports_code_challenge_method (const std::string_view value) const -> bool |
| auto | supports_token_endpoint_auth_method (const std::string_view value) const -> bool |
| auto | supports_protected_resource (const std::string_view value) const -> bool |
| auto | data () const -> const JSON & |
| The underlying document, for reaching members without a typed accessor. | |
Static Public Member Functions | |
| static auto | from (JSON &&data, const std::string_view issuer) -> std::optional< OAuthServerMetadata > |
| sourcemeta::core::OAuthServerMetadata::OAuthServerMetadata | ( | JSON && | data, |
| const std::string_view | issuer ) |
Construct and validate a metadata document for an expected issuer, throwing when it is invalid. The document is moved in.
|
nodiscard |
Whether the server signs authorization responses with an iss parameter, defaulting to false when absent (RFC 9207 Section 3).
|
staticnodiscard |
Construct and validate a metadata document for an expected issuer, returning no value when it is invalid. The document is moved in.
|
nodiscard |
Whether the server accepts authorization request data only through the pushed authorization request endpoint, defaulting to false when absent (RFC 9126 Section 5).
|
nodiscard |
Whether a PKCE code challenge method is supported, defaulting to none when absent since an omitted list means PKCE is unsupported (RFC 8414 Section 2).
|
nodiscard |
Whether a grant type is supported, defaulting to the authorization code and implicit grants when absent (RFC 8414 Section 2).
|
nodiscard |
Whether a protected resource is listed as usable with this authorization server (RFC 9728 Section 4).
|
nodiscard |
Whether a token endpoint authentication method is supported, defaulting to client_secret_basic when absent (RFC 8414 Section 2).
| class sourcemeta::core::OAuthResourceMetadata |
A protected resource metadata document (RFC 9728), owning its JSON. The document is validated on construction against the resource it was retrieved for: resource must be present, a valid resource identifier (an https URL with no fragment, a query tolerated), and identical by code points to the expected resource (RFC 9728 Section 3.3). Pass the resource identifier the well-known URL was derived from, or, for the WWW-Authenticate resource_metadata flow, the URL the request was made to (the Section 3.3 second check). Only the plain JSON members are read, so a signed_metadata statement is not processed, which RFC 9728 Section 2.2 permits by making its precedence conditional on a consumer that "supports signed metadata". A string accessor returns a view into the owned document, valid for the lifetime of this object. For example:
Public Member Functions | |
| OAuthResourceMetadata (JSON &&data, const std::string_view resource) | |
| auto | resource () const -> std::string_view |
| The resource identifier (RFC 9728 Section 2). | |
| auto | first_authorization_server () const -> std::optional< std::string_view > |
| auto | supports_authorization_server (const std::string_view value) const -> bool |
| Whether an authorization server issuer is listed (RFC 9728 Section 2). | |
| auto | jwks_uri () const -> std::optional< std::string_view > |
| auto | supports_bearer_method (const std::string_view value) const -> bool |
| auto | supports_scope (const std::string_view value) const -> bool |
| Whether a scope is listed for the resource (RFC 9728 Section 2). | |
| auto | dpop_bound_access_tokens_required () const -> bool |
| auto | resource_name () const -> std::optional< std::string_view > |
| auto | resource_documentation () const -> std::optional< std::string_view > |
| The developer documentation page location (RFC 9728 Section 2). | |
| auto | resource_policy_uri () const -> std::optional< std::string_view > |
| The data usage policy page location (RFC 9728 Section 2). | |
| auto | resource_tos_uri () const -> std::optional< std::string_view > |
| The terms of service page location (RFC 9728 Section 2). | |
| auto | tls_client_certificate_bound_access_tokens () const -> bool |
| auto | supports_resource_signing_alg (const std::string_view value) const -> bool |
| auto | supports_dpop_signing_alg (const std::string_view value) const -> bool |
| auto | supports_authorization_details_type (const std::string_view value) const -> bool |
| auto | data () const -> const JSON & |
Static Public Member Functions | |
| static auto | from (JSON &&data, const std::string_view resource) -> std::optional< OAuthResourceMetadata > |
| sourcemeta::core::OAuthResourceMetadata::OAuthResourceMetadata | ( | JSON && | data, |
| const std::string_view | resource ) |
Construct and validate a metadata document for an expected resource, throwing when it is invalid. The document is moved in.
|
nodiscard |
The underlying document, for reaching members without a typed accessor such as the internationalized names.
|
nodiscard |
Whether the resource requires DPoP-bound access tokens, defaulting to false when absent (RFC 9728 Section 2).
|
nodiscard |
The first authorization server that can issue tokens for the resource, which a client resolves to its metadata (RFC 9728 Section 5), or no value when none is listed.
|
staticnodiscard |
Construct and validate a metadata document for an expected resource, returning no value when it is invalid. The document is moved in.
|
nodiscard |
The JWK Set document location for the resource's own keys (RFC 9728 Section 2).
|
nodiscard |
The human-readable name of the resource without a language tag (RFC 9728 Section 2), reaching a language-tagged variant through the underlying document.
|
nodiscard |
Whether an authorization details type is listed for the resource (RFC 9728 Section 2).
|
nodiscard |
Whether a bearer token presentation method is listed (RFC 9728 Section 2), where an explicit empty list means none is supported. Absence is unspecified rather than unsupported, so this returns false then.
|
nodiscard |
Whether a JWS algorithm is listed for validating DPoP proofs (RFC 9728 Section 2).
|
nodiscard |
Whether a JWS algorithm is listed for signing resource responses (RFC 9728 Section 2).
|
nodiscard |
Whether the resource supports mutual-TLS certificate-bound access tokens, defaulting to false when absent (RFC 9728 Section 2).
| struct sourcemeta::core::OAuthServerMetadataConfig |
The configuration an authorization server publishes as its metadata (RFC 8414 Section 2), each field a non-owning view. An empty scalar and a zero-element array are omitted, since RFC 8414 Section 3.2 forbids a zero-element array in the response.
Public Attributes | |
| std::string_view | issuer |
| The issuer identifier (RFC 8414 Section 2), REQUIRED. | |
| std::string_view | authorization_endpoint |
| The authorization endpoint (RFC 8414 Section 2). | |
| std::string_view | token_endpoint |
| The token endpoint (RFC 8414 Section 2). | |
| std::string_view | registration_endpoint |
| The dynamic client registration endpoint (RFC 8414 Section 2). | |
| std::string_view | jwks_uri |
| The JWK Set document location (RFC 8414 Section 2). | |
| std::span< const std::string_view > | response_types_supported |
| The supported response types (RFC 8414 Section 2), REQUIRED and non-empty. | |
| std::span< const std::string_view > | grant_types_supported |
| The supported grant types (RFC 8414 Section 2). | |
| std::span< const std::string_view > | code_challenge_methods_supported |
| The supported PKCE code challenge methods (RFC 8414 Section 2, RFC 7636). | |
| std::span< const std::string_view > | token_endpoint_auth_methods_supported |
| The supported token endpoint authentication methods (RFC 8414 Section 2). | |
| std::span< const std::string_view > | token_endpoint_auth_signing_alg_values_supported |
| std::span< const std::string_view > | scopes_supported |
| The supported scopes (RFC 8414 Section 2). | |
| std::string_view | pushed_authorization_request_endpoint |
| bool | require_pushed_authorization_requests {false} |
| std::span< const std::string_view > | protected_resources |
| std::span<const std::string_view> sourcemeta::core::OAuthServerMetadataConfig::protected_resources |
The protected resources usable with this authorization server, each a valid resource identifier (RFC 9728 Section 4).
| std::string_view sourcemeta::core::OAuthServerMetadataConfig::pushed_authorization_request_endpoint |
The pushed authorization request endpoint (RFC 9126 Section 5). New members are kept at the end so an existing positional initializer keeps mapping to the older fields.
| bool sourcemeta::core::OAuthServerMetadataConfig::require_pushed_authorization_requests {false} |
Whether authorization request data is accepted only through the pushed authorization request endpoint, emitted only when true (RFC 9126 Section 5).
| std::span<const std::string_view> sourcemeta::core::OAuthServerMetadataConfig::token_endpoint_auth_signing_alg_values_supported |
The supported JWS algorithms for the private_key_jwt and client_secret_jwt token endpoint authentication methods (RFC 8414 Section 2). REQUIRED and must exclude none when either of those methods is advertised.
| struct sourcemeta::core::OAuthResourceMetadataConfig |
The configuration a protected resource publishes as its metadata (RFC 9728 Section 2), each field a non-owning view. An empty scalar and a zero-element array are omitted, since RFC 9728 Section 3.2 forbids a zero-element array in the response. The one exception is the bearer method list, whose engaged empty state is emitted as an empty array, the form RFC 9728 Section 2 gives for a resource that supports no bearer method, distinct from the unspecified absent state.
Public Attributes | |
| std::string_view | resource |
| The resource identifier (RFC 9728 Section 2), REQUIRED. | |
| std::span< const std::string_view > | authorization_servers |
| std::string_view | jwks_uri |
| std::span< const std::string_view > | scopes_supported |
| std::optional< std::span< const std::string_view > > | bearer_methods_supported |
| std::span< const std::string_view > | resource_signing_alg_values_supported |
| std::string_view | resource_name |
| std::string_view | resource_documentation |
| The developer documentation page location (RFC 9728 Section 2). | |
| std::string_view | resource_policy_uri |
| The data usage policy page location (RFC 9728 Section 2). | |
| std::string_view | resource_tos_uri |
| The terms of service page location (RFC 9728 Section 2). | |
| bool | tls_client_certificate_bound_access_tokens {false} |
| std::span< const std::string_view > | authorization_details_types_supported |
| The supported authorization details types (RFC 9728 Section 2). | |
| std::span< const std::string_view > | dpop_signing_alg_values_supported |
| bool | dpop_bound_access_tokens_required {false} |
| std::span<const std::string_view> sourcemeta::core::OAuthResourceMetadataConfig::authorization_servers |
The authorization server issuer identifiers that can issue tokens for the resource (RFC 9728 Section 2).
| std::optional<std::span<const std::string_view> > sourcemeta::core::OAuthResourceMetadataConfig::bearer_methods_supported |
The supported bearer token presentation methods (RFC 9728 Section 2), where no value omits the member and an engaged empty list advertises that no bearer method is supported.
| bool sourcemeta::core::OAuthResourceMetadataConfig::dpop_bound_access_tokens_required {false} |
Whether the resource requires DPoP-bound access tokens, emitted only when true since the default when absent is false (RFC 9728 Section 2).
| std::span<const std::string_view> sourcemeta::core::OAuthResourceMetadataConfig::dpop_signing_alg_values_supported |
The supported JWS algorithms for validating DPoP proofs (RFC 9728 Section 2), which must exclude none and the MAC algorithms a proof may never use (RFC 9449 Section 4.2).
| std::string_view sourcemeta::core::OAuthResourceMetadataConfig::jwks_uri |
The JWK Set document location for the resource's own keys (RFC 9728 Section 2).
| std::string_view sourcemeta::core::OAuthResourceMetadataConfig::resource_name |
The human-readable name of the resource without a language tag (RFC 9728 Sections 2 and 2.1), a language-tagged variant assigned by the caller on the returned document.
| std::span<const std::string_view> sourcemeta::core::OAuthResourceMetadataConfig::resource_signing_alg_values_supported |
The supported JWS algorithms for signing resource responses (RFC 9728 Section 2), which must exclude none.
| std::span<const std::string_view> sourcemeta::core::OAuthResourceMetadataConfig::scopes_supported |
The scopes used in authorization requests for the resource (RFC 9728 Section 2).
| bool sourcemeta::core::OAuthResourceMetadataConfig::tls_client_certificate_bound_access_tokens {false} |
Whether the resource supports mutual-TLS certificate-bound access tokens, emitted only when true since the default when absent is false (RFC 9728 Section 2).
| class sourcemeta::core::OAuthMetadataProvider |
A long-lived, cached resolver of authorization server metadata (RFC 8414). It derives the well-known URL from an issuer, retrieves and validates the document through an injected transport, and caches it with a freshness-aware refresh. It is meant to be constructed once per issuer at startup, since a per-request instance defeats the caching. Reads take a snapshot, so a returned document is immune to a concurrent refresh. The kind must be an authorization server kind, either AuthorizationServer or an OpenID Connect configuration form, since a protected resource document is not an authorization server metadata document and would never validate. For example:
Public Types | |
| using | Fetcher |
| using | Clock = std::function<std::chrono::system_clock::time_point()> |
Public Member Functions | |
| OAuthMetadataProvider (std::string issuer, const OAuthWellKnownKind kind, Fetcher fetcher) | |
| OAuthMetadataProvider (std::string issuer, const OAuthWellKnownKind kind, Fetcher fetcher, Options options) | |
| Construct a provider overriding the caching policy. | |
| OAuthMetadataProvider (std::string issuer, const OAuthWellKnownKind kind, Fetcher fetcher, Options options, Clock clock) | |
| Construct a provider overriding the policy and the clock. | |
| OAuthMetadataProvider (const OAuthMetadataProvider &)=delete | |
| OAuthMetadataProvider (OAuthMetadataProvider &&)=delete | |
| auto | metadata () -> std::shared_ptr< const OAuthServerMetadata > |
| auto | refresh () -> std::shared_ptr< const OAuthServerMetadata > |
| using sourcemeta::core::OAuthMetadataProvider::Clock = std::function<std::chrono::system_clock::time_point()> |
A source of the current time, defaulting to the system clock and existing as an injection point so the refresh can be driven deterministically under test.
A pluggable transport that turns a URL into raw metadata bytes plus an optional freshness hint. Returns no value on a failed retrieval, such as a transport error, an unsuccessful response, or an oversized body. Injecting the transport keeps this module free of any networking dependency and makes the provider substitutable for testing. A refresh runs the transport while holding the cache lock, which serializes concurrent refreshes and blocks other readers for its duration, though a forced refresh still retrieves once per call, so the transport must bound its own wait with a timeout.
| sourcemeta::core::OAuthMetadataProvider::OAuthMetadataProvider | ( | std::string | issuer, |
| const OAuthWellKnownKind | kind, | ||
| Fetcher | fetcher ) |
Construct a provider for an issuer with an injected transport, using the default policy and the system clock.
|
delete |
The provider owns a lock guarding its cache, so it is neither copyable nor movable. Store it behind a pointer or construct it in place.
|
nodiscard |
The cached metadata, retrieving it on the first call and refreshing it once its freshness lifetime has elapsed. A failed refresh keeps serving the last good document, and no value is returned only when the document has never been retrieved successfully. The result is a snapshot immune to a concurrent refresh.
|
nodiscard |
Force an immediate retrieval regardless of freshness, serving the RFC 9728 Section 5.2 recommendation to re-retrieve on a challenge. A failed retrieval keeps the last good document.
| class sourcemeta::core::OAuthResourceMetadataProvider |
A long-lived, cached resolver of protected resource metadata (RFC 9728), the resource-side counterpart of the authorization server provider. It derives the well-known URL from a resource identifier, retrieves and validates the document through an injected transport, and caches it with a freshness-aware refresh. It is meant to be constructed once per resource at startup, since a per-request instance defeats the caching. Reads take a snapshot, so a returned document is immune to a concurrent refresh. For example:
Public Types | |
| using | FetchResult = OAuthMetadataProvider::FetchResult |
| using | Fetcher = OAuthMetadataProvider::Fetcher |
| using | Clock = OAuthMetadataProvider::Clock |
| using | Options = OAuthMetadataProvider::Options |
Public Member Functions | |
| OAuthResourceMetadataProvider (std::string resource, Fetcher fetcher) | |
| OAuthResourceMetadataProvider (std::string resource, Fetcher fetcher, Options options) | |
| Construct a provider overriding the caching policy. | |
| OAuthResourceMetadataProvider (std::string resource, Fetcher fetcher, Options options, Clock clock) | |
| Construct a provider overriding the policy and the clock. | |
| OAuthResourceMetadataProvider (const OAuthResourceMetadataProvider &)=delete | |
| OAuthResourceMetadataProvider (OAuthResourceMetadataProvider &&)=delete | |
| auto | metadata () -> std::shared_ptr< const OAuthResourceMetadata > |
| auto | refresh () -> std::shared_ptr< const OAuthResourceMetadata > |
A source of the current time, shared with the authorization server provider.
A pluggable transport that turns a URL into raw metadata bytes plus an optional freshness hint, shared with the authorization server provider.
| using sourcemeta::core::OAuthResourceMetadataProvider::FetchResult = OAuthMetadataProvider::FetchResult |
The outcome of one metadata retrieval, shared with the authorization server provider.
Tunables for the caching policy, shared with the authorization server provider.
| sourcemeta::core::OAuthResourceMetadataProvider::OAuthResourceMetadataProvider | ( | std::string | resource, |
| Fetcher | fetcher ) |
Construct a provider for a resource with an injected transport, using the default policy and the system clock.
|
delete |
The provider owns a lock guarding its cache, so it is neither copyable nor movable. Store it behind a pointer or construct it in place.
|
nodiscard |
The cached metadata, retrieving it on the first call and refreshing it once its freshness lifetime has elapsed. A failed refresh keeps serving the last good document, and no value is returned only when the document has never been retrieved successfully. The result is a snapshot immune to a concurrent refresh.
|
nodiscard |
Force an immediate retrieval regardless of freshness, serving the RFC 9728 Section 5.2 recommendation to re-retrieve on a challenge. A failed retrieval keeps the last good document.
| class sourcemeta::core::OAuthPARResponse |
A non-owning view over a pushed authorization request response (RFC 9126 Section 2.2) held in a caller-owned JSON value, which must outlive the view. For example:
Public Member Functions | |
| OAuthPARResponse (const JSON &data) | |
| auto | request_uri () const -> std::optional< std::string_view > |
| auto | expires_in () const -> std::optional< std::chrono::seconds > |
| auto | data () const -> const JSON & |
| The underlying document. | |
|
explicit |
Construct a view over a pushed authorization request response, which is borrowed.
|
nodiscard |
The lifetime of the request URI, no value when non-positive (RFC 9126 Section 2.2).
|
nodiscard |
The request URI to use at the authorization endpoint (RFC 9126 Section 2.2).
| class sourcemeta::core::OAuthClientMetadata |
A dynamic client registration metadata document (RFC 7591 Section 2), owning its JSON. The same document is exchanged in both roles: a client's registration request (RFC 7591 Section 3.1) and the server's registration response (RFC 7591 Section 3.2.1), so the response-only members carry a value only when read over a response. The document is validated on construction to reject a jwks and jwks_uri present together, and a grant_types, response_types, or token_endpoint_auth_method present with the wrong type, since each of those carries a default an accessor would otherwise substitute (RFC 7591 Section 2). Accessors apply the specification defaults, and any member without a typed accessor, such as an internationalized name (RFC 7591 Section 2.2), is reachable through the underlying document. A string accessor returns a view into the owned document, valid for the lifetime of this object, so a view taken before the object is moved from must not be used afterward. For example:
Public Member Functions | |
| OAuthClientMetadata (JSON &&data) | |
| auto | has_redirect_uri (const std::string_view value) const -> bool |
| Whether a redirection URI is registered (RFC 7591 Section 2). | |
| auto | token_endpoint_auth_method () const -> std::string_view |
| auto | supports_grant_type (const std::string_view value) const -> bool |
| auto | supports_response_type (const std::string_view value) const -> bool |
| auto | client_name () const -> std::optional< std::string_view > |
| The human-readable client name (RFC 7591 Section 2). | |
| auto | client_uri () const -> std::optional< std::string_view > |
| The client information page (RFC 7591 Section 2). | |
| auto | logo_uri () const -> std::optional< std::string_view > |
| The client logo location (RFC 7591 Section 2). | |
| auto | scope () const -> std::optional< std::string_view > |
| The space-separated scopes the client may request (RFC 7591 Section 2). | |
| auto | has_contact (const std::string_view value) const -> bool |
| Whether a contact is listed (RFC 7591 Section 2). | |
| auto | tos_uri () const -> std::optional< std::string_view > |
| The terms of service page (RFC 7591 Section 2). | |
| auto | policy_uri () const -> std::optional< std::string_view > |
| The privacy policy page (RFC 7591 Section 2). | |
| auto | jwks_uri () const -> std::optional< std::string_view > |
| The JWK Set document location for the client's keys (RFC 7591 Section 2). | |
| auto | software_id () const -> std::optional< std::string_view > |
| auto | software_version () const -> std::optional< std::string_view > |
| The client software version (RFC 7591 Section 2). | |
| auto | software_statement () const -> std::optional< std::string_view > |
| auto | client_id () const -> std::optional< std::string_view > |
| auto | client_secret () const -> std::optional< std::string_view > |
| auto | client_id_issued_at () const -> std::optional< std::chrono::seconds > |
| auto | client_secret_expires_at () const -> std::optional< std::chrono::seconds > |
| auto | registration_access_token () const -> std::optional< std::string_view > |
| auto | registration_client_uri () const -> std::optional< std::string_view > |
| auto | data () const -> const JSON & |
| The underlying document, for reaching members without a typed accessor. | |
Static Public Member Functions | |
| static auto | from (JSON &&data) -> std::optional< OAuthClientMetadata > |
|
explicit |
Construct and validate a client registration document, throwing when it is invalid. The document is moved in.
|
nodiscard |
The issued client identifier, present only in a registration response (RFC 7591 Section 3.2.1).
|
nodiscard |
The time the client identifier was issued, present only in a response (RFC 7591 Section 3.2.1).
|
nodiscard |
The issued client secret, present only in a response to a confidential client (RFC 7591 Section 3.2.1).
|
nodiscard |
The time the client secret expires, zero meaning it never expires, present only in a response that issued a secret (RFC 7591 Section 3.2.1).
|
staticnodiscard |
Construct and validate a client registration document, returning no value when it is invalid. The document is moved in.
|
nodiscard |
The registration access token for managing the registration, present only in a response when management is offered (RFC 7592 Section 3).
|
nodiscard |
The registration management location, present only in a response when management is offered (RFC 7592 Section 3).
|
nodiscard |
The client software identifier, stable across instances (RFC 7591 Section 2).
|
nodiscard |
The software statement asserting the metadata, echoed unmodified in a response (RFC 7591 Section 2.3).
|
nodiscard |
Whether a grant type is registered, defaulting to the authorization code grant when absent (RFC 7591 Section 2).
|
nodiscard |
Whether a response type is registered, defaulting to the code response type when absent (RFC 7591 Section 2).
|
nodiscard |
The requested token endpoint authentication method, defaulting to client_secret_basic when absent (RFC 7591 Section 2).
| struct sourcemeta::core::OAuthClientRegistrationConfig |
The client metadata a registration request carries (RFC 7591 Section 2), each field a non-owning view. An empty scalar and a zero-element array are omitted.
Public Attributes | |
| std::span< const std::string_view > | redirect_uris |
| std::string_view | token_endpoint_auth_method |
| std::span< const std::string_view > | grant_types |
| The grant types the client will use (RFC 7591 Section 2). | |
| std::span< const std::string_view > | response_types |
| The response types the client will use (RFC 7591 Section 2). | |
| std::string_view | client_name |
| The human-readable client name (RFC 7591 Section 2). | |
| std::string_view | client_uri |
| The client information page (RFC 7591 Section 2). | |
| std::string_view | logo_uri |
| The client logo location (RFC 7591 Section 2). | |
| std::string_view | scope |
| The space-separated scopes the client may request (RFC 7591 Section 2). | |
| std::span< const std::string_view > | contacts |
| The ways to contact those responsible for the client (RFC 7591 Section 2). | |
| std::string_view | tos_uri |
| The terms of service page (RFC 7591 Section 2). | |
| std::string_view | policy_uri |
| The privacy policy page (RFC 7591 Section 2). | |
| std::string_view | jwks_uri |
| const JSON * | jwks {nullptr} |
| std::string_view | software_id |
| The client software identifier (RFC 7591 Section 2). | |
| std::string_view | software_version |
| The client software version (RFC 7591 Section 2). | |
| std::string_view | software_statement |
| The software statement asserting the metadata (RFC 7591 Section 2.3). | |
| const JSON* sourcemeta::core::OAuthClientRegistrationConfig::jwks {nullptr} |
The client's JWK Set carried inline for a client that cannot host one, mutually exclusive with its location, a non-owning pointer left null when absent (RFC 7591 Section 2).
| std::string_view sourcemeta::core::OAuthClientRegistrationConfig::jwks_uri |
The JWK Set document location for the client's keys, mutually exclusive with an inline key set (RFC 7591 Section 2).
| std::span<const std::string_view> sourcemeta::core::OAuthClientRegistrationConfig::redirect_uris |
The redirection URIs the client registers for redirect-based flows (RFC 7591 Section 2).
| std::string_view sourcemeta::core::OAuthClientRegistrationConfig::token_endpoint_auth_method |
The requested token endpoint authentication method, omitted to take the client_secret_basic default (RFC 7591 Section 2).
| struct sourcemeta::core::OAuthClientRegistrationResult |
The values an authorization server assigns to a client at registration (RFC 7591 Section 3.2.1) and for its management (RFC 7592 Section 3), each a non-owning view. The client identifier is REQUIRED, a secret and its expiry are emitted together, and the management pair is emitted when registration management is offered.
Public Attributes | |
| std::string_view | client_id |
| The issued client identifier (RFC 7591 Section 3.2.1), REQUIRED. | |
| std::string_view | client_secret |
| std::optional< std::chrono::seconds > | client_id_issued_at {} |
| The time the client identifier was issued (RFC 7591 Section 3.2.1). | |
| std::optional< std::chrono::seconds > | client_secret_expires_at {} |
| std::string_view | registration_access_token |
| std::string_view | registration_client_uri |
| std::string_view sourcemeta::core::OAuthClientRegistrationResult::client_secret |
The issued client secret, present for a confidential client (RFC 7591 Section 3.2.1).
| std::optional<std::chrono::seconds> sourcemeta::core::OAuthClientRegistrationResult::client_secret_expires_at {} |
The time the client secret expires, zero meaning it never expires, REQUIRED alongside a secret (RFC 7591 Section 3.2.1).
| std::string_view sourcemeta::core::OAuthClientRegistrationResult::registration_access_token |
The registration access token for managing the registration, REQUIRED together with the management location when management is offered (RFC 7592 Section 3).
| std::string_view sourcemeta::core::OAuthClientRegistrationResult::registration_client_uri |
The registration management location, REQUIRED together with the access token when management is offered (RFC 7592 Section 3).
| struct sourcemeta::core::OAuthTokenLookupRequest |
A non-owning view of a token revocation or introspection request (RFC 7009 Section 2.1, RFC 7662 Section 2.1). The token borrows from the input or the decode arena, and an absent hint is an empty view.
Public Attributes | |
| std::string_view | token |
| The token to act on (RFC 7009 Section 2.1). | |
| std::string_view | token_type_hint |
| std::string_view sourcemeta::core::OAuthTokenLookupRequest::token_type_hint |
The hint about the token type, one of the hint vocabulary values, empty when absent (RFC 7009 Section 2.1).
| struct sourcemeta::core::OAuthTokenRequest |
A non-owning view of a token request at the authorization server (RFC 6749 Section 4.1.3, Section 4.4.2, Section 6). Every field borrows from the input or the decode arena, and an absent parameter is an empty view. The grant type is surfaced as its raw value so a server can tell a missing grant from an unsupported one.
Public Attributes | |
| std::string_view | grant_type |
| The grant type (RFC 6749 Section 4.1.3). | |
| std::string_view | code |
| std::string_view | redirect_uri |
| std::string_view | code_verifier |
| The PKCE code verifier (RFC 7636 Section 4.5). | |
| std::string_view | refresh_token |
| The refresh token, for the refresh grant (RFC 6749 Section 6). | |
| std::string_view | scope |
| The space-delimited requested scope (RFC 6749 Section 3.3). | |
| std::string_view sourcemeta::core::OAuthTokenRequest::code |
The authorization code, for the authorization code grant (RFC 6749 Section 4.1.3).
| std::string_view sourcemeta::core::OAuthTokenRequest::redirect_uri |
The redirection endpoint echoed for the authorization code grant (RFC 6749 Section 4.1.3), surfaced unconditionally.
| class sourcemeta::core::OAuthTokenResponse |
A non-owning view over a token endpoint success response (RFC 6749 Section 5.1) held in a caller-owned JSON value. The value must outlive the view, and the token accessors return views into it, which are secret and must not be logged. Extension members such as an OpenID Connect id_token are reached through the underlying document. For example:
Public Member Functions | |
| OAuthTokenResponse (const JSON &data) | |
| Construct a view over a token response document, which is borrowed. | |
| auto | access_token () const -> std::optional< std::string_view > |
| The issued access token (RFC 6749 Section 5.1), or no value when absent. | |
| auto | token_type () const -> std::optional< std::string_view > |
| The access token type (RFC 6749 Section 5.1), or no value when absent. | |
| auto | is_bearer_token_type () const -> bool |
| auto | expires_in () const -> std::optional< std::chrono::seconds > |
| auto | refresh_token () const -> std::optional< std::string_view > |
| The issued refresh token (RFC 6749 Section 5.1), or no value when absent. | |
| auto | scope () const -> std::optional< std::string_view > |
| The granted scope (RFC 6749 Section 5.1), or no value when absent. | |
| auto | has_scope (const std::string_view value) const -> bool |
| auto | data () const -> const JSON & |
|
nodiscard |
The underlying document, for reaching extension members such as an OpenID Connect id_token.
|
nodiscard |
The access token lifetime in seconds (RFC 6749 Section 5.1), or no value when absent or not a non-negative integer.
|
nodiscard |
Whether the granted scope contains a value, comparing the space-delimited unordered set (RFC 6749 Section 3.3).
|
nodiscard |
Whether the token type is Bearer, matched case insensitively (RFC 6749 Section 5.1).
| struct sourcemeta::core::OAuthTokenGrant |
The token a server grants, for building a token endpoint success response (RFC 6749 Section 5.1). Every field borrows from the caller, an empty scalar is omitted, and the two scope fields decide whether a scope is emitted.
Public Attributes | |
| std::string_view | access_token |
| The issued access token (RFC 6749 Section 5.1). | |
| std::string_view | token_type |
| The token type, such as Bearer (RFC 6749 Section 7.1). | |
| std::optional< std::chrono::seconds > | expires_in |
| std::string_view | refresh_token |
| The issued refresh token, omitted when absent (RFC 6749 Section 5.1). | |
| std::string_view | scope |
| std::string_view | requested_scope |
| std::optional<std::chrono::seconds> sourcemeta::core::OAuthTokenGrant::expires_in |
The lifetime of the access token, omitted when absent (RFC 6749 Section 5.1).
| std::string_view sourcemeta::core::OAuthTokenGrant::requested_scope |
The scope the client requested, used to decide whether the granted scope must be emitted (RFC 6749 Section 5.1).
| std::string_view sourcemeta::core::OAuthTokenGrant::scope |
The granted scope (RFC 6749 Section 3.3). A scope has at least one token, so an empty granted scope is not representable and is not emitted. A server that would grant no scopes denies the request instead of issuing a token with an empty scope.
| struct sourcemeta::core::OAuthTokenExchangeRequest |
The parameters of a token exchange request (RFC 8693 Section 2.1). Every field is a non-owning view, an empty scalar is omitted, and the spans carry the repeatable audience and resource indicator values, each emitted under its fixed parameter name.
Public Attributes | |
| std::string_view | subject_token |
| std::string_view | subject_token_type |
| The type of the subject token, REQUIRED (RFC 8693 Section 2.1). | |
| std::string_view | actor_token |
| std::string_view | actor_token_type |
| The type of the actor token, emitted only together with the actor token. | |
| std::string_view | requested_token_type |
| The requested type for the issued token (RFC 8693 Section 2.1). | |
| std::string_view | scope |
| The space-delimited requested scope (RFC 6749 Section 3.3). | |
| std::span< const std::string_view > | audiences |
| std::span< const std::string_view > | resources |
| std::string_view sourcemeta::core::OAuthTokenExchangeRequest::actor_token |
The security token that represents the acting party, emitted only together with its type (RFC 8693 Section 2.1).
| std::span<const std::string_view> sourcemeta::core::OAuthTokenExchangeRequest::audiences |
The repeatable logical audience names of the target service, each emitted as an audience parameter (RFC 8693 Section 2.1).
| std::span<const std::string_view> sourcemeta::core::OAuthTokenExchangeRequest::resources |
The repeatable resource indicators, each an absolute URI without a fragment emitted as a resource parameter (RFC 8707 Section 2).
| std::string_view sourcemeta::core::OAuthTokenExchangeRequest::subject_token |
The security token that represents the subject, REQUIRED (RFC 8693 Section 2.1).
| struct sourcemeta::core::OAuthTransactionSecrets |
The secrets minted for one authorization code flow, each the base64url encoding of 32 random octets. Both are secret and are serialized by the caller, such as into a sealed cookie, and wiped once the flow completes. The 43 bytes of each are not null terminated.
Public Attributes | |
| std::array< char, 43 > | state |
| The cross-site request forgery token (RFC 6749 Section 10.12). | |
| std::array< char, 43 > | code_verifier |
| The PKCE code verifier (RFC 7636 Section 4.1). | |
| struct sourcemeta::core::OAuthTransaction |
A non-owning view of the state a client retains between an authorization request and its callback. Every field borrows from the caller and must outlive any use of this struct.
Public Attributes | |
| std::string_view | state |
| The state sent with the request, compared against the callback. | |
| std::string_view | code_verifier |
| The PKCE code verifier, carried through to the token request. | |
| std::string_view | issuer |
| The issuer identifier the request was sent to (RFC 9207 Section 2). | |
| std::string_view | redirect_uri |
| The redirection URI the request was sent with (RFC 8252 Section 8.10). | |
|
strong |
The reason a JWT bearer assertion failed verification (RFC 7523 Section 3).
| Enumerator | |
|---|---|
| Malformed | The assertion was not a well-formed JSON Web Token. |
| UnsupportedAlgorithm | The algorithm was absent or outside the accepted set (RFC 7523 Section 5). |
| UnknownKey | No key verified the signature. |
| Signature | The signature did not verify. |
| Issuer | The issuer claim was absent or did not match (RFC 7523 Section 3 check 1). |
| Subject | The subject claim was absent or did not match (RFC 7523 Section 3 check 2, RFC 7521 Section 4.2). |
| Audience | The audience claim did not identify this server (RFC 7523 Section 3 check 3). |
| Expired | The assertion has expired (RFC 7523 Section 3 check 4). |
| NotYetValid | The assertion is not yet valid (RFC 7523 Section 3 check 5). |
| IssuedInFuture | The issue time lies in the future (RFC 7523 Section 3 check 6). |
| Replay | The identifier was already seen within its window, a replay (RFC 7523 Section 3 check 7). |
|
strong |
The error codes an authorization endpoint returns in its redirect (RFC 6749 Section 4.1.2.1).
|
strong |
The error codes a protected resource returns in its WWW-Authenticate challenge (RFC 6750 Section 3.1), shared by the Bearer and DPoP schemes.
|
strong |
The reason a callback was rejected, in the order the checks run. The first failing check decides the outcome (RFC 9700 Section 4).
| Enumerator | |
|---|---|
| State | The state is missing or does not match, a possible cross-site request forgery (RFC 6749 Section 10.12). |
| ReceivedURI | The callback arrived on a URI other than the one the request was sent with (RFC 8252 Section 8.10). |
| Issuer | The iss is missing when required or does not match the expected issuer, a possible mix-up attack (RFC 9207 Section 2.4). |
| Declined | The authorization server returned an error rather than a code (RFC 6749 Section 4.1.2.1). |
| MissingCode | The response carries neither an error nor a code. |
|
strong |
The client authentication mechanism a token request presented (RFC 6749 Section 2.3). Public is a bare client identifier with no secret, which is identification rather than an authentication mechanism (RFC 6749 Section 3.2.1).
|
strong |
What a device flow client does after a token endpoint error (RFC 8628 Section 3.5).
|
strong |
The reason a DPoP proof failed verification (RFC 9449 Section 4.3), one per check performed, with a missing nonce kept distinct from a mismatched one because a server resupplies a nonce for the former (RFC 9449 Section 9).
| Enumerator | |
|---|---|
| ProofCount | More or fewer than one DPoP header field was present (check 1). |
| Malformed | The header value was not a single well-formed JSON Web Token (check 2). |
| MissingClaim | A required header parameter or claim was absent (check 3). |
| UnexpectedType | The token type header parameter was not dpop+jwt (check 4). |
| UnsupportedAlgorithm | The algorithm was absent, symmetric, or outside the accepted set (check 5). |
| PrivateKey | The embedded key carried private material (check 7). |
| Signature | The signature did not verify with the embedded key (check 6). |
| MethodMismatch | The method claim did not match the request method (check 8). |
| TargetMismatch | The target claim did not match the request target (check 9). |
| MissingNonce | A nonce was required but absent, the downgrade the server must reject (check 10, RFC 9449 Section 11.3). |
| NonceMismatch | The nonce claim did not match the nonce the server issued (check 10). |
| Expired | The creation time was outside the acceptable window (check 11). |
| AccessTokenMismatch | The access token hash was absent or did not match the presented token (check 12). |
| KeyMismatch | The proof key did not match the key the access token is bound to, or a token was presented with no binding to confirm it against (check 12). |
|
strong |
Whether the authorization server is known to support the iss response parameter (RFC 9207 Section 2.4). This governs how a callback missing iss is treated.
|
strong |
|
strong |
The result of verifying a PKCE code verifier against a stored code challenge. Only Match and NotUsed let the exchange proceed. The remaining outcomes each name a distinct pairing failure the token endpoint rejects (RFC 7636 Section 4.6, RFC 9700 Section 2.1.1, OAuth 2.1 Section 4.1.3).
|
strong |
The behavioural profile a parser or validator runs under. Strict applies the OAuth 2.1 and RFC 9700 hardening, and Compatible relaxes it for RFC 6749 interoperability where a specification still permits the older behaviour. For example:
|
strong |
The error codes a dynamic client registration endpoint returns (RFC 7591 Section 3.2.2).
| Enumerator | |
|---|---|
| InvalidRedirectURI | A redirect URI in the request is invalid. |
| InvalidClientMetadata | A field in the client metadata is invalid. |
| InvalidSoftwareStatement | The software statement is invalid. |
| UnapprovedSoftwareStatement | The software statement is not approved by the authorization server. |
|
strong |
The mechanism used for returning authorization response parameters from the authorization endpoint (OAuth 2.0 Multiple Response Types Section 2.1, OAuth 2.0 Form Post Response Mode Section 2).
|
strong |
The outcome a client draws from a token revocation response (RFC 7009 Section 2.2).
|
strong |
The error codes a token endpoint returns (RFC 6749 Section 5.2), extended with the codes the device grant, resource indicators, token exchange, DPoP, and token revocation add to the same endpoint family.
|
strong |
The kind of metadata document a well-known URL points at, which selects the suffix and whether it is inserted before the path or appended after it.
|
nodiscard |
Flatten the claims of a trusted software statement onto a registration record (RFC 7591 Section 3.1.1), returning false when the record or the claims are not a JSON object. A statement claim takes precedence over a directly supplied value of the same name, so it overwrites it, while the JSON Web Token structural claims (RFC 7519 Section 4.1) and the statement member itself are left out since they describe the statement rather than the client. Pass the claims a trusted statement was verified to carry. For example:
|
noexcept |
The HTTP status a protected resource returns for a bearer error, as the SHOULD-level recommendation of RFC 6750 Section 3.1: 400 for a malformed request, 401 for an invalid token, and 403 for insufficient scope. The DPoP resource codes accompany a 401 (RFC 9449 Section 7). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_bearer_header | ( | const std::string_view | token, |
| std::string & | sink ) -> bool |
Append a Bearer credential (RFC 6750 Section 2.1) for an access token to the sink, returning whether the token is a well-formed b64token. Nothing is appended when it is not. The sink then holds the access token, which is secret, so a caller that keeps it should use wiping storage. For example:
|
nodiscard |
Build a JWT bearer assertion (RFC 7523 Section 3) signed with the given key and algorithm, carrying the issuer, subject, and a single audience, an expiration a lifetime past the given time, an issue time, and a random identifier, or no value when the key cannot sign. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_error_form_post | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| std::string & | sink, | ||
| const std::string_view | title = "Submit This Form" ) -> bool |
Build the auto-submitting HTML page of a failed authorization response in the form post response mode (OAuth 2.0 Form Post Response Mode Section 2, RFC 6749 Section 4.1.2.1), returning whether it was produced, with the same validation as the error redirect builder and the page carrying the given title. The redirect URI, the response fields, and the title must not alias the sink. When serving the page, the authorization server "MUST instruct the User Agent (and any intermediaries) not to store or reuse the content of the response". For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_error_redirect | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| const OAuthResponseMode | mode, | ||
| std::string & | sink ) -> bool |
Build a failed authorization redirect at the authorization server in the given response mode (RFC 6749 Section 4.1.2.1, OAuth 2.0 Multiple Response Types Section 2.1), returning whether it was produced. The form post mode produces no value, as it emits an HTML page rather than a redirect. Every other behavior matches the query-only builder. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_error_redirect | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| std::string & | sink ) -> bool |
Build a failed authorization redirect at the authorization server (RFC 6749 Section 4.1.2.1), returning whether it was produced. The Error is required, error_description, error_uri, and state are emitted when present, and an iss is emitted when present and must be a valid issuer identifier (RFC 9207 Section 2). This must not be called when the redirect URI or client identifier failed validation, since the error is then shown to the resource owner rather than redirected. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_form_post | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| std::string & | sink, | ||
| const std::string_view | title = "Submit This Form" ) -> bool |
Build the auto-submitting HTML page of a successful authorization response in the form post response mode (OAuth 2.0 Form Post Response Mode Section 2), returning whether it was produced. The action of the form is the client's redirection endpoint, the response parameters are the hidden form values, and the page carries the given title, with the same validation as the redirect builder. The redirect URI, the response fields, and the title must not alias the sink. When serving the page, the authorization server "MUST instruct the User Agent (and any intermediaries) not to store or reuse the content of the response". For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_redirect | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| const OAuthResponseMode | mode, | ||
| std::string & | sink ) -> bool |
Build a successful authorization redirect at the authorization server in the given response mode, encoding the parameters in the query (RFC 6749 Section 4.1.2) or in the fragment (OAuth 2.0 Multiple Response Types Section 2.1) of the client's redirection endpoint, returning whether it was produced. The form post mode produces no value, as it emits an HTML page rather than a redirect. Every other behavior matches the query-only builder. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_redirect | ( | const std::string_view | redirect_uri, |
| const OAuthAuthorizationResponse & | response, | ||
| std::string & | sink ) -> bool |
Build a successful authorization redirect at the authorization server by appending the query to the client's redirection endpoint (RFC 6749 Section 4.1.2), returning whether it was produced. The code is required, state is echoed when present, and an iss is emitted when present and must be a valid issuer identifier (RFC 9207 Section 2). No value is produced when the redirect URI contains a fragment, which a redirection endpoint must not (RFC 6749 Section 3.1.2). Every value is percent-escaped, an existing query on the endpoint is honored, and the sink is appended to and never cleared. The redirect URI and the response fields must not alias the sink. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_authorization_url | ( | const std::string_view | endpoint, |
| const OAuthAuthorizationRequest & | request, | ||
| std::string & | sink ) -> void |
Build an authorization request URL by appending the query to the endpoint (RFC 6749 Section 4.1.1). The response_type defaults to code and is honored when set, every value is percent-escaped, an existing query on the endpoint is honored, and the code challenge method is emitted only when a challenge is present. The sink is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_challenge | ( | const std::string_view | scheme, |
| const OAuthChallenge & | challenge, | ||
| std::string & | sink ) -> bool |
Build a WWW-Authenticate challenge for a scheme and append it to the sink, returning whether a challenge was produced (RFC 7235 Section 4.1). Each present parameter is emitted as a quoted-string with the double quote and backslash escaped (RFC 9110 Section 5.6.4). A challenge with no parameter yields a bare scheme, which RFC 7235 Section 2.1 permits and a DPoP challenge may use (RFC 9449 Section 7.1), so the Bearer scheme's own rule that it carry at least one parameter (RFC 6750 Section 3) is the caller's responsibility. Nothing is appended and false is returned only when the scheme is not a token or a value carries a control character that would allow header injection. Only header safety is enforced, so keeping each value within the tighter character set its own attribute defines (RFC 6750 Section 3) is likewise the caller's responsibility. It is a pure function, so a resource server builds its fixed challenge once and caches it. For example:
|
nodiscard |
Build a JWT bearer client authentication assertion (RFC 7523 Section 3), a self-issued assertion whose issuer and subject are both the client identifier (RFC 7521 Section 5.2), or no value when the key cannot sign. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_device_authorization_request | ( | const std::string_view | client_id, |
| const std::string_view | scope, | ||
| const std::span< const OAuthParameter > | resources, | ||
| std::string & | sink ) -> void |
Append a device authorization request body (RFC 8628 Section 3.1) to the sink. The client_id is required for a public client, the scope is emitted when present, and the repeatable resources follow. This request has no secret, so the sink is an ordinary string, appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_introspection_request | ( | const std::string_view | token, |
| const std::string_view | token_type_hint, | ||
| SecureString & | sink ) -> void |
Append a token introspection request body (RFC 7662 Section 2.1) to the sink. The token is required, and the token_type_hint is emitted only when present. The authorization the endpoint requires is supplied separately, since RFC 7662 Section 2.1 mandates it but does not fix the method. The token is secret, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_par_authorization_url | ( | const std::string_view | endpoint, |
| const std::string_view | client_id, | ||
| const std::string_view | request_uri, | ||
| std::string & | sink ) -> void |
Append the front-channel authorization request URL (RFC 9126 Section 4) to the sink, the reference form carrying only the client_id and the request_uri obtained from the pushed authorization request endpoint. Unlike a full authorization request it emits no response_type, since the pushed request holds it. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_par_request | ( | const OAuthAuthorizationRequest & | request, |
| SecureString & | sink ) -> void |
Append a pushed authorization request body (RFC 9126 Section 2.1) to the sink. Every authorization request parameter is emitted except the request_uri, which a pushed request MUST NOT carry, and the client_id, which client authentication supplies, in the body for a public client or the client_secret_post method and in the Authorization header for the client_secret_basic method. The response_type defaults to the authorization code flow. The body may carry a client secret, so the sink is a wiping string, appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_revocation_request | ( | const std::string_view | token, |
| const std::string_view | token_type_hint, | ||
| SecureString & | sink ) -> void |
Append a token revocation request body (RFC 7009 Section 2.1) to the sink. The token is required, and the token_type_hint is emitted only when present. No client_id is emitted, so the caller composes a client authentication builder into the same sink. The token is secret, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_client_credentials | ( | const std::string_view | scope, |
| const std::span< const OAuthParameter > | resources, | ||
| SecureString & | sink ) -> void |
Append a client credentials grant token request body (RFC 6749 Section 4.4.2) to the sink. The requested scope is emitted only when present. No client_id is emitted, so the caller composes a client authentication builder into the same sink. The sink is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_code | ( | const std::string_view | code, |
| const std::string_view | redirect_uri, | ||
| const std::string_view | code_verifier, | ||
| const std::span< const OAuthParameter > | resources, | ||
| SecureString & | sink ) -> void |
Append an authorization code grant token request body (RFC 6749 Section 4.1.3) to the sink. The code is required, the redirect_uri is emitted only when the authorization request carried one, and the code_verifier is emitted only when PKCE is in use (RFC 7636 Section 4.5). No client_id is emitted, so the caller composes a client authentication builder into the same sink. The body carries secrets, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_device | ( | const std::string_view | device_code, |
| const std::span< const OAuthParameter > | resources, | ||
| SecureString & | sink ) -> void |
Append a device grant token request body (RFC 8628 Section 3.4) to the sink. The device_code is required, and the repeatable resources follow. No client_id is emitted, so the caller composes a client authentication builder into the same sink. The device code is a credential, so the sink is a wiping string, appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_exchange | ( | const OAuthTokenExchangeRequest & | request, |
| SecureString & | sink ) -> bool |
Append a token exchange request body (RFC 8693 Section 2.1) to the sink, returning whether it is well formed. The grant_type is the token exchange URN, the subject token and its type are required, the actor token and its type are emitted only together, and the repeatable audiences and resources follow. No client_id is emitted, so the caller composes a client authentication builder into the same sink. The body carries a secret token, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_jwt_bearer | ( | const std::string_view | assertion, |
| const std::string_view | scope, | ||
| SecureString & | sink ) -> void |
Append a JWT bearer authorization grant token request body (RFC 7523 Section 2.1) to the sink, the grant type, the assertion, and the scope when present. No client_id is emitted, so the caller composes a client authentication builder into the same sink when the client authenticates. The assertion is a credential, so the sink is a wiping string, appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_build_token_request_refresh | ( | const std::string_view | refresh_token, |
| const std::string_view | scope, | ||
| const std::span< const OAuthParameter > | resources, | ||
| SecureString & | sink ) -> void |
Append a refresh token grant token request body (RFC 6749 Section 6) to the sink. The refresh_token is required, and the requested scope is emitted only when present and must not exceed the original grant. No client_id is emitted, so the caller composes a client authentication builder into the same sink. The body carries secrets, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_challenge_parameter | ( | const std::string_view | header, |
| const std::string_view | scheme, | ||
| const std::string_view | name ) -> std::optional< std::string > |
Find the value of one authentication parameter within the challenge for a scheme in a WWW-Authenticate header value (RFC 7235 Section 4.1), returning no value when the scheme or parameter is absent, or the header is malformed before the parameter is reached. The scheme and parameter name are matched case insensitively, and a quoted-string value is unescaped (RFC 9110 Section 5.6.4). The full grammar is parsed so that adjacent challenges and parameters are told apart correctly. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_client_assertion | ( | const std::string_view | assertion, |
| SecureString & | sink ) -> void |
Append the client authentication assertion parameters (RFC 7521 Section 4.2) to the sink, the assertion and its JWT bearer type. No client_id is emitted, since the client is identified by the assertion subject. The assertion is a credential, so the sink is a wiping string, appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_client_id_only | ( | const std::string_view | client_id, |
| SecureString & | sink ) -> void |
Append a public client identification parameter (RFC 6749 Section 3.2.1) to a token request body, emitting the identifier alone with no secret. This composes into the same sink as a grant builder. The sink is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_client_secret_basic | ( | const std::string_view | client_id, |
| const std::string_view | client_secret, | ||
| SecureString & | sink ) -> void |
Append an HTTP Basic authentication credential (RFC 6749 Section 2.3.1) to the sink, for use as an Authorization header value. The client identifier and secret are each percent-encoded, joined with a colon, and Base64 encoded. The credential is secret, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_client_secret_post | ( | const std::string_view | client_id, |
| const std::string_view | client_secret, | ||
| SecureString & | sink ) -> void |
Append the client_secret_post client authentication parameters (RFC 6749 Section 2.3.1) to a token request body. Both the identifier and the secret are emitted, so this composes into the same sink as a grant builder. The body carries a secret, so the sink is a wiping string, and it is appended to and never cleared. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_default_response_mode | ( | const std::string_view | response_type | ) | -> std::optional< OAuthResponseMode > |
Look up the default response mode of a response type (OAuth 2.0 Multiple Response Types Sections 2.1, 3, 4, and 5), returning no value unless the response type is registered. The response type "is compared as a space-delimited list of values in which the order of values does not matter" (Section 1.2). The lookup covers every registered response type, including token-bearing ones whose successful response this module does not encode, since requests are still built and response modes still negotiated for them. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_device_user_code | ( | ) | -> std::array< char, 8 > |
Mint a device flow user code, eight characters from the RFC 8628 Section 6.1 recommended twenty-character alphabet, drawn with rejection sampling for a uniform distribution. The code is shown to the end user, not kept secret. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_device_user_code_matches | ( | const std::string_view | presented, |
| const std::string_view | stored ) -> bool |
Whether a user code the end user typed matches a stored one, comparing after discarding every non-alphanumeric character and folding to uppercase, so the separators and case a user adds do not matter (RFC 8628 Section 6.1). The final comparison is constant time. For example:
|
nodiscard |
Build the confirmation value that binds an access token to a DPoP key (RFC 9449 Section 6.1), for a server to assign under the cnf claim of a JSON Web Token access token or a top-level cnf of a token introspection response (RFC 9449 Section 6.2). For example:
|
nodiscard |
The JSON Web Key thumbprint of the key a DPoP proof is signed with (RFC 9449 Section 6.1), the value a server matches against an authorization code binding (RFC 9449 Section 10) or binds an issued token to, or no value when the proof or its embedded key cannot be read. For example:
|
nodiscard |
Verify a DPoP proof against the request it accompanies (RFC 9449 Section 4.3), returning the first failing check or no value when every check passes. The checks are run in a fixed order though the specification permits any order, and replay is a separate concern the caller enforces after this passes. For example:
|
noexcept |
The wire code for an authorization endpoint error (RFC 6749 Section 4.1.2.1). For example:
|
noexcept |
The wire code for a protected resource challenge error (RFC 6750 Section 3.1). For example:
|
noexcept |
The wire code for a dynamic client registration error (RFC 7591 Section 3.2.2). For example:
|
noexcept |
The wire code for a token endpoint error (RFC 6749 Section 5.2 and its extensions). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_has_audience | ( | const JSON & | claims, |
| const std::string_view | audience ) -> bool |
Whether a set of access token claims names an audience, so that a resource server accepts only a token minted for it (RFC 9068 Section 4, RFC 7662 Section 2.2). The claims are the payload of a JWT access token or an introspection response, and the aud claim is honored whether it is a single string or an array of strings. Each value is treated as an opaque case-sensitive string (RFC 7519 Section 4.1.3) and compared by code points (RFC 3986 Section 6.2.1), with no normalization. An empty audience never matches. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_has_scope | ( | const JSON & | claims, |
| const std::string_view | value ) -> bool |
Whether a set of access token claims grants a scope, so that a resource server admits only a caller whose token carries it (RFC 6749 Section 3.3, RFC 9068 Section 2.2.3, RFC 7662 Section 2.2). The claims are the payload of a JWT access token or an introspection response, and the scope claim is a single string of space-delimited case-sensitive tokens compared whole and by code points, with no normalization. An empty scope never matches. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_is_dpop_bound | ( | const JSON & | claims | ) | -> bool |
Whether a set of access token claims carries the DPoP confirmation that binds the token to a proof-of-possession key, namely a jkt JWK thumbprint (RFC 9449 Section 6.1). A resource server that receives such a token under the Bearer scheme must reject it, since a key-bound token stripped of its proof is being replayed (RFC 9449 Section 7.2). Only the DPoP confirmation is detected, not other sender-constraining methods such as mutual-TLS. The claims are the payload of a JWT access token or an introspection response. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_is_endpoint_url | ( | const std::string_view | value | ) | -> bool |
Whether a URL is usable as an endpoint a client sends requests to: the https scheme, compared case-insensitively per RFC 3986 Section 3.1, a non-empty host, and no fragment, which RFC 6749 Section 3.1 forbids on an endpoint. A query is permitted. This is the rule the metadata parsers apply, named for the endpoint case rather than as a general https test, since the fragment prohibition comes from the endpoint specifications and does not hold of https URLs at large. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_is_issuer_identifier | ( | const std::string_view | value | ) | -> bool |
Whether a value is a valid authorization server issuer identifier: the https scheme by exact code points, a non-empty host, and no query or fragment (RFC 8414 Section 2). This is the rule the metadata builders apply to issuer and to authorization_servers entries, so a caller assembling a document can pre-filter with it. For example:
|
noexcept |
Whether a URI scheme is a private-use scheme suitable for a native app redirect, a reverse-domain name that must contain at least one period (RFC 8252 Section 7.1 and Section 8.4). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_is_resource_identifier | ( | const std::string_view | value | ) | -> bool |
Whether a value is a valid protected resource identifier: the https scheme by exact code points, a non-empty host, and no fragment, a query tolerated (RFC 9728 Section 1.2, RFC 8707 Section 2). This is the rule the resource metadata builder and parser apply, so a caller assembling a document can pre-filter with it. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_is_response_mode_allowed | ( | const std::string_view | response_type, |
| const OAuthResponseMode | mode ) -> bool |
Check whether a response mode may encode the response of a response type, as "in no case should a set of Authorization Response parameters whose default Response Mode is the fragment encoding be encoded using the query encoding" (OAuth 2.0 Multiple Response Types Section 7). An unknown response type allows no mode. For example:
|
nodiscardnoexcept |
Whether a value is a well-formed DPoP nonce, a non-empty string of the nonce character set (RFC 9449 Section 8.1, RFC 6749 Appendix A), so a client validates a received nonce before echoing it. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_issued_token_type | ( | const JSON & | response | ) | -> std::optional< std::string_view > |
The type of the token a token exchange response issued (RFC 8693 Section 2.2.1), or no value when absent. The result borrows from the response, which must outlive it. It is REQUIRED on a successful response, so its absence marks a malformed one. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_device_authorization_response | ( | const std::string_view | device_code, |
| const std::string_view | user_code, | ||
| const std::string_view | verification_uri, | ||
| const std::string_view | verification_uri_complete, | ||
| const std::chrono::seconds | expires_in, | ||
| const std::chrono::seconds | interval ) -> std::optional< JSON > |
Build a device authorization response document (RFC 8628 Section 3.2), returning no value when a required part is missing: an empty device code, user code, or verification URI, or a non-positive expires_in, which is a REQUIRED positive lifetime. The verification URI complete is emitted when present, and the interval only when it is positive and differs from the default, so a client never sees a zero or negative polling delay. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_introspection_inactive | ( | ) | -> JSON |
Build the minimal inactive introspection response { "active": false } (RFC 7662 Section 2.2). The minimality is a recommendation, while the field value is the requirement, so a caller may add members. For example:
|
nodiscard |
Build a pushed authorization request response document (RFC 9126 Section 2.2), returning no value when the request URI is empty or the lifetime is non-positive, which is a REQUIRED positive value. For example:
|
nodiscard |
Build a dynamic client registration error response body (RFC 7591 Section 3.2.2). The error is the wire error code, and the description is emitted only when present. The caller serializes the object as the application/json response body. For example:
|
nodiscard |
Build a dynamic client registration request body (RFC 7591 Section 3.1), returning no value when a present client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, or redirection URI is not a valid URI, or an inline key set is not a JSON object or is given together with its location. Each present scalar and each non-empty array is emitted. The caller serializes the object as the application/json request body. For example:
|
nodiscard |
Build a dynamic client registration response body (RFC 7591 Section 3.2.1 and RFC 7592 Section 3) by returning the registered metadata with the server-assigned values overlaid, or no value when the client identifier is empty, only one of the secret and its expiry is given, a time is negative, only one of the management access token and location is given, or the management location is not a valid URI. The server-assigned members come only from the assigned values, never from the accepted record. The caller serializes the object as the application/json response body. For example:
|
nodiscard |
Build a dynamic client registration update request body (RFC 7592 Section 2.2), a full replacement of the client's metadata that MUST carry the current client identifier and MAY carry the current secret to match against, returning no value when the client identifier is empty or a URL field is not a valid URI. Every metadata field is emitted as in a registration request, and the four server-assigned members are excluded since the request MUST NOT carry them. An omitted field is a request to delete it, since the update replaces rather than augments. The caller serializes the object as the application/json request body. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_resource_metadata | ( | const OAuthResourceMetadataConfig & | config | ) | -> std::optional< JSON > |
Build a protected resource metadata document for the well-known endpoint (RFC 9728 Section 2), returning no value when the document would be unusable: the resource is not a valid resource identifier, an authorization server entry is not a valid issuer identifier, the JWK Set location is not a valid https URL, a human-readable page location is not a URL, the resource signing algorithm list contains none, or the DPoP algorithm list contains none or a MAC algorithm. Every produced document parses back through its own consumer for the same resource. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_server_metadata | ( | const OAuthServerMetadataConfig & | config | ) | -> std::optional< JSON > |
Build an authorization server metadata document for the well-known endpoint (RFC 8414 Section 2), returning no value when the document would be unusable: the issuer is not a valid issuer identifier, the required response types are empty, the required authorization endpoint or (unless only the implicit grant is offered) token endpoint is missing, any advertised endpoint or JWK Set location is not a valid https URL, the signing algorithm list contains none, or a JWT token endpoint authentication method is advertised without a non-empty signing algorithm list. Each present scalar and each non-empty array is emitted, and a zero-element array is omitted (RFC 8414 Section 3.2). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_token_error_response | ( | const std::string_view | error, |
| const std::string_view | error_description, | ||
| const std::string_view | error_uri ) -> JSON |
Build a token endpoint error response document (RFC 6749 Section 5.2). The error code is always emitted, and the description and URI when present. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_make_token_response | ( | const OAuthTokenGrant & | grant | ) | -> JSON |
Build a token endpoint success response document (RFC 6749 Section 5.1). The access token and token type are always emitted, the lifetime and refresh token when present, and the scope only when it differs from the requested scope, which is when it is REQUIRED (RFC 6749 Section 5.1). For example:
|
nodiscard |
Reconcile the two ways a DPoP key is communicated at the pushed authorization request endpoint (RFC 9449 Section 10.1): the dpop_jkt parameter and the thumbprint of a verified DPoP header proof. Returns the effective thumbprint to bind the authorization code to, an empty view when neither is present, or no value when both are present and disagree, which the server MUST reject. The returned view borrows from the arguments. For example:
|
nodiscard |
Mint a request URI reference for a pushed authorization request response (RFC 9126 Section 2.2), the urn:ietf:params:oauth:request_uri form with a cryptographically strong random reference so a value cannot be guessed (RFC 9126 Section 7.1). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_parse_authorization_request | ( | const std::string_view | query, |
| std::string & | storage, | ||
| OAuthAuthorizationRequest & | result, | ||
| const std::function< void(std::string_view, std::string_view)> & | on_other ) -> bool |
Parse the query of an authorization request at the authorization server (RFC 6749 Section 4.1.1) into the result, returning whether it is well formed. Each recognized value is form-decoded, borrowing from the input when it carries no escape and otherwise from the storage arena, which the caller owns and reuses across parses. A duplicated parameter is a failure (RFC 6749 Section 3.1), and code_challenge_method defaults to plain when a challenge is present without one (RFC 7636 Section 4.3). Every repeatable resource and every unrecognized parameter is passed to the callback with its decoded value rather than stored on the result, so the caller collects them. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_parse_authorization_response | ( | const std::string_view | query, |
| std::string & | storage, | ||
| OAuthAuthorizationResponse & | result ) -> bool |
Parse the query of an authorization response (RFC 6749 Section 4.1.2) into the result, returning whether the query is well formed. Each recognized value is form-decoded (RFC 6749 Appendix B), borrowing from the input when it carries no escape and otherwise from the storage arena, which the caller owns and which is reused across parses. A duplicated recognized parameter is a failure, and an unrecognized parameter is ignored. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_parse_client_authentication | ( | const std::string_view | authorization, |
| const std::string_view | body, | ||
| SecureString & | storage, | ||
| OAuthClientCredentials & | credentials ) -> bool |
Parse the client authentication a token request presented, from the Authorization header value and the request body, into the credentials (RFC 6749 Section 2.3). Returns whether the presentation is well formed. It is malformed when more than one mechanism is presented (RFC 6749 Section 2.3, RFC 7521 Section 4.2.1), when a Basic username conflicts with a body client_id (RFC 6749 Section 5.2), when the Basic credential is not a canonical Base64 of a colon-separated pair, or when only one of the assertion parameters is present. The caller chooses the error code for a rejection, which is invalid_client when a collision involves the assertion mechanism (RFC 7521 Section 4.2.1) and invalid_request otherwise (RFC 6749 Section 5.2). The decoded Basic credential is secret, so the arena is a wiping string, which the caller owns, should clear between independent parses, and must not alias the header or body inputs. This detects the mechanism and extracts the credentials, but does not verify the secret, which the caller does against its stored value in constant time, nor that an Assertion client_id identifies the same client as the assertion (RFC 7521 Section 4.2), which the caller checks when it verifies the assertion. For example:
|
nodiscard |
Parse a pushed authorization request body (RFC 9126 Section 2.1) into the result, returning whether it is well formed. The parse follows the authorization request rules, and additionally rejects a request_uri parameter, which a pushed request MUST NOT provide, and every other parameter, such as the client authentication ones, is passed to the callback. The body may carry a client secret, so it is decoded into a wiping arena the caller owns and reuses. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_parse_revocation_request | ( | const std::string_view | body, |
| SecureString & | storage, | ||
| OAuthTokenLookupRequest & | result, | ||
| const std::function< void(std::string_view, std::string_view)> & | on_other ) -> bool |
Parse a token revocation request body (RFC 7009 Section 2.1) into the result, returning whether it is well formed. The token is required, a duplicated parameter fails (RFC 6749 Section 3.2), and every other parameter, such as the client authentication ones, is passed to the callback. The token is secret, so it is decoded into a wiping arena the caller owns and reuses, and which must not alias the body. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_parse_token_request | ( | const std::string_view | body, |
| SecureString & | storage, | ||
| OAuthTokenRequest & | result, | ||
| const std::function< void(std::string_view, std::string_view)> & | on_other ) -> bool |
Parse the body of a token request at the authorization server (RFC 6749 Section 4.1.3) into the result, returning whether it is well formed. Each recognized value is form-decoded into the storage arena and viewed there. The body carries the request's secrets, the authorization code, the code verifier, the refresh token, and the client authentication parameters, so the arena is a wiping string, which the caller owns, should clear between independent parses, and must outlive the result. A duplicated recognized parameter is a failure (RFC 6749 Section 3.2). Every repeatable resource and audience and every unrecognized parameter, including the client authentication parameters, is passed to the callback with its decoded value rather than stored on the result. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_pkce_challenge | ( | const std::string_view | verifier | ) | -> std::array< char, 43 > |
Derive the S256 code challenge for a code verifier, the base64url encoding of its SHA-256 digest (RFC 7636 Section 4.2). For example:
|
noexcept |
The wire value for a PKCE challenge method (RFC 7636 Section 4.3). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_pkce_verifier | ( | ) | -> std::array< char, 43 > |
Mint a new PKCE code verifier, the base64url encoding of 32 cryptographically random octets (RFC 7636 Section 4.1). The 43 bytes are not null terminated, so pass them onward as a view of data() and size() rather than as a C string. The result is secret material, so wipe it once the exchange completes. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_pkce_verify | ( | const std::string_view | verifier, |
| const std::string_view | challenge, | ||
| const OAuthPKCEMethod | method, | ||
| const OAuthProfile | profile ) -> OAuthPKCEOutcome |
Verify a presented code verifier against a stored code challenge and its method, under the given profile, returning the pairing outcome. An empty verifier or challenge means the value is absent. The final verifier against challenge comparison is constant time over their bytes once their lengths match. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_random_token | ( | ) | -> std::array< char, 43 > |
Mint a random token, the base64url encoding of 32 cryptographically random octets, for an unguessable but non-confidential value such as a state or nonce (RFC 6749 Section 10.10). The 43 bytes are not null terminated, so pass them onward as a view of data() and size() rather than as a C string. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_redirect_uri_matches | ( | const std::string_view | registered, |
| const std::string_view | presented, | ||
| const OAuthProfile | profile ) -> bool |
Whether a redirection URI a client presents matches one it registered (RFC 6749 Section 3.1.2.3), by an exact byte comparison with one exception. When the registered URI is a loopback redirect, an HTTP URI whose host is literally 127.0.0.1 or [::1], only the port may differ (RFC 8252 Section 7.3). The strict profile keeps the OAuth 2.1 rule that localhost is not a loopback host (RFC 8252 Section 8.3). No URI is constructed, so the inputs are compared as given. For example:
|
nodiscard |
Whether the registered grant types and response types are mutually consistent (RFC 7591 Section 2.1): the authorization_code grant pairs with the code response type and the implicit grant with the token response type. Only the explicitly registered lists are compared, so a document that omits either list registers no value that could contradict the other, and the server surfaces an inconsistency as invalid_client_metadata (RFC 7591 Section 3.2.2). For example:
|
noexcept |
Map a revocation response status code to its outcome: a 200 is a success, including for an unknown token (RFC 7009 Section 2.2), a 503 is retryable (RFC 7009 Section 2.2.1), and any other status is an error. For example:
|
noexcept |
The HTTP status for a token endpoint error response. It is 400 Bad Request in general, but 401 Unauthorized for a client authentication failure when the client authenticated through the Authorization header, since that response must then carry a WWW-Authenticate challenge (RFC 6749 Section 5.2). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_token_exchange_valid | ( | const OAuthTokenExchangeRequest & | request | ) | -> bool |
Whether a token exchange request is well formed (RFC 8693 Section 2.1): the subject token and its type are present, and the actor token and its type are either both present or both absent. A malformed request is rejected as invalid_request (RFC 8693 Section 2.2.2), so a server applies this after collecting the parameters. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_transaction_check | ( | const OAuthTransaction & | transaction, |
| const OAuthAuthorizationResponse & | response, | ||
| const OAuthIssuerSupport | issuer_support, | ||
| const std::string_view | received_uri, | ||
| std::string_view & | code ) -> std::optional< OAuthCallbackError > |
Validate an authorization response against the retained transaction, returning the authorization code through code on success or the first failing check otherwise (RFC 9700 Section 4). The checks run in order: the state in constant time, the received URI when one is supplied, the issuer, whether the server declined, and finally the presence of a code. Pass an empty received_uri to skip that check. The state check always defends against cross-site request forgery. Guaranteed mix-up defense needs a non-empty received_uri (RFC 8252 Section 8.10) or an issuer_support of Supported, which makes a missing iss fatal (RFC 9207 Section 2.4). With Unknown the iss is validated only when present, so a server that omits it is not caught, and with NotSupported it is ignored entirely. A caller talking to more than one authorization server must therefore supply one of those two. For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_transaction_mint | ( | ) | -> OAuthTransactionSecrets |
Mint the secrets for a new authorization code flow, a random state and a PKCE code verifier (RFC 7636 Section 4.1, RFC 6749 Section 10.12). For example:
|
nodiscard |
Verify a JWT bearer authorization grant assertion (RFC 7523 Section 3), returning the first failing check or no value when it verifies. The issuer must match the expected one, the subject identifies the accessor and is only required to be present, and the audience must match one of the accepted values by Simple String Comparison without normalization (RFC 3986 Section 6.2.1). A failure is reported to the client as invalid_grant (RFC 6749 Section 5.2). For example:
|
nodiscard |
Verify a JWT bearer client authentication assertion (RFC 7523 Section 3, RFC 7521 Section 5.2), returning the first failing check or no value when it verifies. The issuer and subject must both be the client identifier, the subject must match a presented client_id when one is given (RFC 7521 Section 4.2), and the audience must match one of the accepted values by Simple String Comparison without normalization (RFC 3986 Section 6.2.1). A failure is reported to the client as invalid_client (RFC 7521 Section 4.2.1). For example:
| SOURCEMETA_CORE_OAUTH_EXPORT auto sourcemeta::core::oauth_well_known_url | ( | const std::string_view | identifier, |
| const OAuthWellKnownKind | kind, | ||
| std::string & | sink ) -> bool |
Derive a metadata well-known URL from an identifier and append it to the sink, returning whether the identifier is well formed (RFC 8414 Section 3, RFC 9728 Section 3). The identifier must use the https scheme and carry no fragment, and no query unless it is a protected resource. A terminating slash on the path is removed, and for the inserted kinds the well-known string is placed between the host and the path, preserving a protected resource query after it. The sink is appended to and never cleared. For example:
|
noexcept |
Map an authorization endpoint error code to its value, returning no value for an unrecognized code (RFC 6749 Section 4.1.2.1). For example:
|
noexcept |
Map a protected resource challenge error code to its value, returning no value for an unrecognized code (RFC 6750 Section 3.1). For example:
|
noexcept |
Map a PKCE challenge method wire value to its type, returning no value for an unrecognized method (RFC 7636 Section 4.3). For example:
|
noexcept |
Map a dynamic client registration error code to its value, returning no value for an unrecognized code (RFC 7591 Section 3.2.2). For example:
|
noexcept |
Map a token endpoint error code to its value, returning no value for an unrecognized code (RFC 6749 Section 5.2 and its extensions). For example:
|
inlineconstexpr |
The client assertion type identifier of a JWT bearer client authentication assertion (RFC 7523 Section 2.2).
|
inlineconstexpr |
The grant type identifier of a JWT bearer authorization grant (RFC 7523 Section 2.1).
|
inlineconstexpr |
The access_token token type identifier (RFC 8693 Section 3).
|
inlineconstexpr |
The token type of a DPoP-bound access token (RFC 9449 Section 5), the value a bound token response carries and a client confirms before use.
|
inlineconstexpr |
The access_token token type hint (RFC 7009 Section 2.1), reused by token introspection (RFC 7662 Section 2.1).
|
inlineconstexpr |
The refresh_token token type hint (RFC 7009 Section 2.1), reused by token introspection (RFC 7662 Section 2.1).
|
inlineconstexpr |
The id_token token type identifier (RFC 8693 Section 3).
|
inlineconstexpr |
The JWT token type identifier (RFC 8693 Section 3).
|
inlineconstexpr |
The refresh_token token type identifier (RFC 8693 Section 3).
|
inlineconstexpr |
The SAML 1.1 token type identifier (RFC 8693 Section 3).
|
inlineconstexpr |
The SAML 2.0 token type identifier (RFC 8693 Section 3).
1.16.1 