An IndieAuth server: the authorization, token, revocation, introspection and userinfo endpoints and the metadata document.
Signing the user in and asking for consent are up to you: the :authorize function of handler gets the checked request, and approve! gives the client its code when the user says yes. Codes and tokens go in stores of yours, or in memory-store, as hashes. In ClojureScript, the handlers answer with promises, and take a body that has been read.
Its internals are in info, authorization, grant and endpoint.
An IndieAuth server: the authorization, token, revocation, introspection and userinfo endpoints and the metadata document. Signing the user in and asking for consent are up to you: the :authorize function of handler gets the checked request, and approve! gives the client its code when the user says yes. Codes and tokens go in stores of yours, or in memory-store, as hashes. In ClojureScript, the handlers answer with promises, and take a body that has been read. Its internals are in info, authorization, grant and endpoint.
(approve! token {:keys [me scopes profile] :as grant} opts)Give the client of the consent token a code for the grant of the
user who said yes, by opts, and give the URL to send the browser back
to, as a map of the :redirect, or of the :error. In ClojureScript, it
gives a promise.
The grant is a map:
The code lasts :code-seconds and works once.
Give the client of the consent `token` a code for the `grant` of the user who said yes, by `opts`, and give the URL to send the browser back to, as a map of the :redirect, or of the :error. In ClojureScript, it gives a promise. The grant is a map: - :me, the profile URL of the signed-in user, who must be the one that consent gave the token to - :scopes, the scopes that the user grants, among those that the client asked for, all of them when nil - :profile, the user's :name, :url, :photo and :email, which the client gets with the profile scope, the email with the email scope too The code lasts :code-seconds and works once.
(authorization-request! fields opts)Check the authorization request of a client with the query fields, a
map by name or pairs of a name and a value, by the opts of handler,
and give the :request, or the :error. In ClojureScript, it gives a
promise.
The request is a map:
An error has the :code of OAuth 2.0 and the :reason, and the :redirect that sends the browser back to the client, when the client is known. Without it, tell the user the reason.
Check the authorization request of a client with the query `fields`, a map by name or pairs of a name and a value, by the `opts` of handler, and give the :request, or the :error. In ClojureScript, it gives a promise. The request is a map: - :client-id, :redirect-uri, :state and :code-challenge - :scopes, a vector of the scopes that the client asks for - :me, the profile URL that the client gave as an unchecked hint - :client, the client information of client-info!, to show the user An error has the :code of OAuth 2.0 and the :reason, and the :redirect that sends the browser back to the client, when the client is known. Without it, tell the user the reason.
(client-info client-id {:keys [headers body] :as response})The client information in the response of a GET of the client
identifier client-id, from a client metadata document in JSON or else
the h-app and the redirect_uri links of an HTML page, as a map:
A document that names another client gives the :client-id alone.
The client information in the `response` of a GET of the client identifier `client-id`, from a client metadata document in JSON or else the h-app and the redirect_uri links of an HTML page, as a map: - :client-id - :client-name, :client-uri and :logo-uri, when it names them - :redirect-uris, the redirect URLs that the client lists A document that names another client gives the :client-id alone.
(client-info! client-id)(client-info! client-id opts)Fetch the client identifier client-id with opts, and give its
client information as client-info does, or the :client-id alone with
the :error when it can't be read. A client identifier on a loopback host
isn't fetched, as section 4.2 says. In ClojureScript, it gives a
promise.
Fetch the client identifier `client-id` with `opts`, and give its client information as client-info does, or the :client-id alone with the :error when it can't be read. A client identifier on a loopback host isn't fetched, as section 4.2 says. In ClojureScript, it gives a promise.
(consent request me opts)The data for the page that asks the user me, who is signed in, to
consent to the authorization request, by opts: the request with the
:me of the user in place of the client's hint, and the :token to post
back with the answer.
Show the :client and the :scopes, and let the user grant fewer. The
token is signed for me alone, so it also guards the page's form
against cross-site requests.
The data for the page that asks the user `me`, who is signed in, to consent to the authorization `request`, by `opts`: the request with the :me of the user in place of the client's hint, and the :token to post back with the answer. Show the :client and the :scopes, and let the user grant fewer. The token is signed for `me` alone, so it also guards the page's form against cross-site requests.
The default of each option of a server that has one, which follows IndieAuth:
The default of each option of a server that has one, which follows IndieAuth: - :scopes-supported, the scopes that the metadata lists. Add those of your resource servers, e.g. create for Micropub. - :code-seconds, :token-seconds and :refresh-seconds, how long a code, an access token and an unused refresh token last. A nil :token-seconds gives tokens that never expire, and a nil :refresh-seconds no refresh tokens. - :request-seconds, how long a user has to sign in and say yes - :legacy-revocation?, true: the token endpoint revokes a token with action=revoke, as earlier versions of IndieAuth had it - :legacy-verification?, false: the token endpoint verifies a token with a GET, as the W3C Note of 2018 had it. It tells anyone who has a token whose it is, so turn it on only for a resource server that needs it. - :client-info?, true: the client identifier is fetched for the client's name, logo and redirect URLs - :client-id-pred and :profile-url-pred, the identifiers that the server takes, indieauth/client-id? and indieauth/profile-url? - :cors?, true: a page in any browser can read the metadata and redeem a code - :send, http/send-public!, which never fetches a client identifier on the server's own network (section 4.2) - :timeout-seconds, :max-page-bytes, :max-json-bytes and :max-form-bytes, the limits of the requests to and from a client - :now-fn, a function that gives the instant now
(denial {:keys [redirect-uri state] :as request} {:keys [issuer] :as opts})The URL that sends the browser back to the client of the authorization
request when the user says no, with the error access_denied, the state
and the :issuer of opts.
The URL that sends the browser back to the client of the authorization `request` when the user says no, with the error access_denied, the state and the :issuer of `opts`.
(handler opts)A Ring handler for the authorization endpoint, by opts.
A GET is a client's authorization request, which authorization-request!
checks. The handler answers a good one with the :authorize of opts, a
function of the Ring request and the checked request, e.g. a sign-in or
consent page. For a bad one, it sends the browser back to the client
with the error, or else answers with the :error-page of opts, a
function of the Ring request and the :error. A POST redeems a code for
the profile URL alone.
The opts are those of default-options, and these:
A Ring handler for the authorization endpoint, by `opts`. A GET is a client's authorization request, which authorization-request! checks. The handler answers a good one with the :authorize of `opts`, a function of the Ring request and the checked request, e.g. a sign-in or consent page. For a bad one, it sends the browser back to the client with the error, or else answers with the :error-page of `opts`, a function of the Ring request and the :error. A POST redeems a code for the profile URL alone. The `opts` are those of default-options, and these: - :issuer, an https URL that is a prefix of the URL of the metadata - :authorization-endpoint and :token-endpoint, and the :revocation-endpoint, :introspection-endpoint and :userinfo-endpoint that you serve - :secret, a text of 32 bytes or more, e.g. a token, that signs the requests and consents - :codes and :tokens, the stores of codes and of tokens, e.g. memory-store - :resource-tokens or :introspect-pred, as introspection-handler has them - :authorize and :error-page, as above
(introspection-handler opts)A Ring handler for the introspection endpoint, by the opts of handler.
A POST asks about the access token of its form, as RFC 7662 has it. A
resource server asks with one of the :resource-tokens of opts as its
bearer token, and you can wrap those with wary-fetch's secret/hide. Or
else the :introspect-pred of opts, a function of the Ring request,
says whether it may ask (section 6.1). Others get 401.
A Ring handler for the introspection endpoint, by the `opts` of handler. A POST asks about the access token of its form, as RFC 7662 has it. A resource server asks with one of the :resource-tokens of `opts` as its bearer token, and you can wrap those with wary-fetch's secret/hide. Or else the :introspect-pred of `opts`, a function of the Ring request, says whether it may ask (section 6.1). Others get 401.
(link-header opts)The value of a Link header that names the server of the opts of
handler, with the links of links, e.g. for the answer to a request for a
profile page.
The value of a Link header that names the server of the `opts` of handler, with the links of links, e.g. for the answer to a request for a profile page.
(links opts)The links that name the server of the opts of handler on a profile
page, as maps of :rel and :href, e.g. for the link elements in its head:
indieauth-metadata, and authorization_endpoint and token_endpoint for
older clients.
The links that name the server of the `opts` of handler on a profile page, as maps of :rel and :href, e.g. for the link elements in its head: indieauth-metadata, and authorization_endpoint and token_endpoint for older clients.
(memory-store)(memory-store a)(memory-store a now-fn)A store in the atom a, or in a new one, which drops each value once
the instant that now-fn gives passes its :expires.
A store is a map of functions, which can give promises in ClojureScript:
The store of codes needs :put! and :take!, and the store of tokens all four. A key is the hash of a code or a token, and a value a map whose :expires, an instant, says when a store can drop it.
A store in the atom `a`, or in a new one, which drops each value once the instant that `now-fn` gives passes its :expires. A store is a map of functions, which can give promises in ClojureScript: - :put!, of a key and a value, which keeps the value - :get, of a key, which gives its value, or nil - :take!, of a key, which gives its value and removes it in one step, so that two calls never both get it - :delete!, of a key, which removes its value The store of codes needs :put! and :take!, and the store of tokens all four. A key is the hash of a code or a token, and a value a map whose :expires, an instant, says when a store can drop it.
(metadata opts)The metadata document of the server of the opts of handler, as a map
of its JSON.
The :metadata-url of opts is the URL where you serve it, the
well-known URL of RFC 8414 by default. The issuer must be a prefix of
it, as section 3.1 says, or it throws. The :service-documentation of
opts, a URL, is listed too when it's given, and so are the endpoints
that opts name.
The metadata document of the server of the `opts` of handler, as a map of its JSON. The :metadata-url of `opts` is the URL where you serve it, the well-known URL of RFC 8414 by default. The issuer must be a prefix of it, as section 3.1 says, or it throws. The :service-documentation of `opts`, a URL, is listed too when it's given, and so are the endpoints that `opts` name.
(metadata-handler opts)A Ring handler that serves the metadata document of the server of the
opts of handler, which a page in any browser can read, by :cors?.
A Ring handler that serves the metadata document of the server of the `opts` of handler, which a page in any browser can read, by :cors?.
The headers of the pages of the authorization endpoint, which no other site can frame (RFC 9700, section 4.16), and which tell no other site their URL. Add them to your sign-in and consent pages too.
The headers of the pages of the authorization endpoint, which no other site can frame (RFC 9700, section 4.16), and which tell no other site their URL. Add them to your sign-in and consent pages too.
(profile {:keys [url body] :as response})The profile information on the HTML page of a user in the response,
from its representative h-card, as a map of the :name, :url, :photo and
:email that it has, or nil. The client gets it with the profile scope,
and the email with the email scope too.
The profile information on the HTML page of a user in the `response`, from its representative h-card, as a map of the :name, :url, :photo and :email that it has, or nil. The client gets it with the profile scope, and the email with the email scope too.
(profile! me)(profile! me opts)Fetch the page of the profile URL me with opts, and give its
profile information as profile does, or nil when it can't be read. In
ClojureScript, it gives a promise.
Fetch the page of the profile URL `me` with `opts`, and give its profile information as profile does, or nil when it can't be read. In ClojureScript, it gives a promise.
(registered? {:keys [client-id redirect-uris] :as info} redirect-uri)Whether the client of the client information info may have its
browser sent to redirect-uri: one on the scheme, host and port of the
client identifier, or one that the client lists, the same text.
Whether the client of the client information `info` may have its browser sent to `redirect-uri`: one on the scheme, host and port of the client identifier, or one that the client lists, the same text.
(request-token request opts)The authorization request as a URL-safe text, signed with the :secret
of opts, to carry it through the pages that sign the user in, e.g. in
a query parameter or a form.
The authorization `request` as a URL-safe text, signed with the :secret of `opts`, to carry it through the pages that sign the user in, e.g. in a query parameter or a form.
(revocation-handler opts)A Ring handler for the revocation endpoint, by the opts of handler.
A POST revokes the token of its form: an access token alone, or a refresh token with its grant, and so with every token of the grant. It answers 200 whether it knew the token or not, as RFC 7009 says, and takes no client authentication, as section 4.1.1 has it.
A Ring handler for the revocation endpoint, by the `opts` of handler. A POST revokes the token of its form: an access token alone, or a refresh token with its grant, and so with every token of the grant. It answers 200 whether it knew the token or not, as RFC 7009 says, and takes no client authentication, as section 4.1.1 has it.
(token-handler opts)A Ring handler for the token endpoint, by the opts of handler.
A POST redeems a code for an access token, or a refresh token for new tokens, and a code without a scope for the :me alone. A refresh token works once, and one used again revokes its grant and all its tokens, as a code used again does. Older clients and resource servers can revoke and verify tokens here too, by the :legacy-revocation? and :legacy-verification? of default-options.
A Ring handler for the token endpoint, by the `opts` of handler. A POST redeems a code for an access token, or a refresh token for new tokens, and a code without a scope for the :me alone. A refresh token works once, and one used again revokes its grant and all its tokens, as a code used again does. Older clients and resource servers can revoke and verify tokens here too, by the :legacy-revocation? and :legacy-verification? of default-options.
(token-request token opts)The authorization request that the token of request-token or consent
carries, if the :secret of opts signed it less than :request-seconds
ago, or nil.
The authorization request that the `token` of request-token or consent carries, if the :secret of `opts` signed it less than :request-seconds ago, or nil.
(userinfo-handler opts)A Ring handler for the userinfo endpoint, by the opts of handler.
A GET or a POST with an access token that has the profile scope gives the JSON of the user's profile information, as the token response had it. A request without a token gets 401, and one whose token doesn't have the scope 403, as section 8.1 has it.
A Ring handler for the userinfo endpoint, by the `opts` of handler. A GET or a POST with an access token that has the profile scope gives the JSON of the user's profile information, as the token response had it. A request without a token gets 401, and one whose token doesn't have the scope 403, as section 8.1 has it.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |