WardrikOAuth.Provider (wardrik_oauth v0.1.0-rc.1)

Copy Markdown

An OAuth app with a service. It has the same name as the credential it grants.

github: [
  issuer: "https://github.com/login/oauth",
  client_id: System.fetch_env!("GITHUB_CLIENT_ID"),
  client_secret: {:secret, "GITHUB_CLIENT_SECRET"},
  scopes: ~w(repo),
  flow: :device
]

Options

  • :issuer - the authorization server, whose metadata names its endpoints.
  • :resource - the API or MCP server the token is for. Used to discover the issuer if none is given.
  • :authorization_endpoint, :token_endpoint - the endpoints, for a service without metadata.
  • :client_id - your OAuth app's client ID. Without it, Wardrik becomes the client where the service allows. See WardrikOAuth.add_provider/3.
  • :client_secret - the client secret, or {:secret, name} to read it from the vault.
  • :client_auth - :post to send the secret in the form, or :basic for HTTP Basic. :post unless set.
  • :scopes - scopes to ask for. [] unless set.
  • :flow - :browser or :device. :browser unless set.
  • :authorization_params - extra parameters for a browser sign-in, as %{access_type: "offline"}. Can't set the parameters Wardrik sends itself.

A provider needs an :issuer, a :resource, or both endpoints.

Summary

Types

t()

An OAuth app a principal can grant access to.

Functions

endpoints?(provider)

Returns whether the provider names both endpoints, so none need discovering.

new(name, opts)

Builds a provider from its name and options. Raises ArgumentError on invalid options.

Types

t()

@type t() :: %WardrikOAuth.Provider{
  authorization_endpoint: String.t() | nil,
  authorization_params: %{optional(String.t()) => String.t()},
  client_auth: :post | :basic,
  client_id: String.t() | nil,
  client_secret: WardrikVault.value(),
  flow: :browser | :device,
  issuer: String.t() | nil,
  name: String.t(),
  resource: String.t() | nil,
  scopes: [String.t()],
  token_endpoint: String.t() | nil
}

An OAuth app a principal can grant access to.

Functions

endpoints?(provider)

@spec endpoints?(t()) :: boolean()

Returns whether the provider names both endpoints, so none need discovering.

new(name, opts)

@spec new(atom() | String.t(), keyword()) :: t()

Builds a provider from its name and options. Raises ArgumentError on invalid options.