provider data flow

OpenID Connect login application

Project overview

This view opens the provider folder one level deeper. Each arrow shows the called operation and the data it returns to its caller. Calls inside a file stay in that file’s sequence view.

authorization request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["common"]
    n2["authorization"]
    n3["credentials"]
    n4["views"]
    n0 -->|"2 HTTP routes → Html response"| n2
    n2 -->|"securityHeaders / settings + 1 more → Headers / Settings"| n1
    n2 -->|"verifyCredentials(username, password) → bool"| n3
    n2 -->|"ProviderFailure(message) / ProviderLogin(requestId, csrf, …) → Html"| n4
    n4 -->|"Page(title, children) → Html"| n1

discovery request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["common"]
    n2["discovery"]
    n0 -->|"2 HTTP routes → Discovery / RsaJwks"| n2
    n2 -->|"SigningKeys.provider / settings → RsaPrivateKey / Settings"| n1

token request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["common"]
    n2["token"]
    n0 -->|"POST /provider/token(http) → Json response"| n2
    n2 -->|"SigningKeys.provider / securityHeaders + 1 more → Headers / RsaPrivateKey + 1 more"| n1

userinfo request flow

100%

Mermaid source

flowchart TD
    n0["HTTP requests"]
    n1["common"]
    n2["userinfo"]
    n0 -->|"GET /provider/userinfo(authorization) → Json response"| n2
    n2 -->|"securityHeaders → Headers"| n1

Package boundaries

authorization package calls

100%

Mermaid source

flowchart LR
    n0["memory"]
    n1["web"]
    n2["crypto"]
    n3["time"]
    n4["authorization"]
    n4 -->|"ExpiringStore.put(key, value, …) / ExpiringStore.take(key, now) → optional AuthorizationRequest"| n0
    n4 -->|"urlEncode(input) → string"| n1
    n4 -->|"Crypto.decodeBase64url(input) / Crypto.equal(left, right) + 1 more → Bytes / bool"| n2
    n4 -->|"Clock.now → int"| n3

credentials package calls

100%

Mermaid source

flowchart LR
    n0["crypto"]
    n1["credentials"]
    n1 -->|"Crypto.decodeBase64url(input) / Crypto.equal(left, right) + 1 more → Bytes / bool"| n0

discovery package calls

100%

Mermaid source

flowchart LR
    n0["crypto"]
    n1["discovery"]
    n1 -->|"Crypto.publicRsa(key) / rsaJwk(publicKey, kid) → RsaJwk / RsaPublicKey"| n0

token package calls

100%

Mermaid source

flowchart LR
    n0["memory"]
    n1["crypto"]
    n2["time"]
    n3["token"]
    n3 -->|"ExpiringStore.put(key, value, …) / ExpiringStore.take(key, now) → optional AuthorizationCode"| n0
    n3 -->|"Crypto.equal(left, right) / Crypto.random(size) + 2 more → Bytes / bool + 1 more"| n1
    n3 -->|"Clock.now → int"| n2

userinfo package calls

100%

Mermaid source

flowchart LR
    n0["memory"]
    n1["time"]
    n2["userinfo"]
    n2 -->|"ExpiringStore.get(key, now) → optional AccessGrant"| n0
    n2 -->|"Clock.now → int"| n1

Follow the data

Each row opens the complete operations and call sites behind one pair of logical units. A grouped arrow records calls between those units; connected arrows need not belong to the same execution path.

From	To	Operations	Read
HTTP requests	authorization	2	Inputs, results and call sites
HTTP requests	discovery	2	Inputs, results and call sites
HTTP requests	token	1	Inputs, results and call sites
HTTP requests	userinfo	1	Inputs, results and call sites
client	contracts	2	Inputs, results and call sites
authorization	common	3	Inputs, results and call sites
authorization	memory	3	Inputs, results and call sites
authorization	web	1	Inputs, results and call sites
authorization	crypto	3	Inputs, results and call sites
authorization	time	1	Inputs, results and call sites
authorization	contracts	3	Inputs, results and call sites
authorization	credentials	1	Inputs, results and call sites
authorization	views	2	Inputs, results and call sites
credentials	crypto	3	Inputs, results and call sites
discovery	common	2	Inputs, results and call sites
discovery	crypto	3	Inputs, results and call sites
token	common	3	Inputs, results and call sites
token	memory	2	Inputs, results and call sites
token	crypto	4	Inputs, results and call sites
token	time	1	Inputs, results and call sites
token	contracts	4	Inputs, results and call sites
userinfo	common	1	Inputs, results and call sites
userinfo	memory	1	Inputs, results and call sites
userinfo	time	1	Inputs, results and call sites
userinfo	contracts	1	Inputs, results and call sites
views	common	1	Inputs, results and call sites

Data crossing these boundaries (52 contracts)

HTTP requests → authorization

2 operations, 2 sites

GET /provider/authorize · HTTP endpoint

Inputs: response_type: string from query, client_id: string from query, redirect_uri: string from query, requestedScope: string from query, state: string from query, nonce: string from query, code_challenge: string from query, code_challenge_method: string from query. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

POST /provider/login · HTTP endpoint

Inputs: form: LoginForm from form, browser: optional string from cookie, origin: optional string from header. Result: HttpResponse<Html>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → discovery

2 operations, 2 sites

GET /provider/.well-known/openid-configuration · HTTP endpoint

No caller-supplied inputs. Result: Discovery.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

GET /provider/jwks · HTTP endpoint

No caller-supplied inputs. Result: RsaJwks.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → token

1 operation, 1 site

POST /provider/token · HTTP endpoint

Inputs: http: HttpRequest from request. Result: HttpResponse<Json>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

HTTP requests → userinfo

1 operation, 1 site

GET /provider/userinfo · HTTP endpoint

Inputs: authorization: optional string from header. Result: HttpResponse<Json>.

Caller or entry	Evidence
HTTP requests	Declaration · Caller explanation

client → contracts

2 operations, 4 sites

IdClaims · value construction

Inputs: iss: string, sub: string, aud: string, exp: int, iat: int, nonce: string, name: string. Result: IdClaims.

Caller or entry	Evidence
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation
test validateIdentity	Call site · Caller explanation

UserInfo · value construction

Inputs: sub: string, name: string. Result: UserInfo.

Caller or entry	Evidence
me	Call site · Caller explanation

authorization → common

3 operations, 12 sites

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation

withCookie

Inputs: headers: Headers, name: string, value: string, path: string, maxAge: int, secure: bool. Result: Headers.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation

authorization → memory

3 operations, 3 sites

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AuthorizationCode, expires: int, now: int. Result: void.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AuthorizationRequest, expires: int, now: int. Result: void.

Caller or entry	Evidence
authorize	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional AuthorizationRequest.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

authorization → web

1 operation, 2 sites

urlEncode

Inputs: input: string. Result: string.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

authorization → crypto

3 operations, 7 sites

Crypto.decodeBase64url · interface dispatch

Inputs: input: string. Result: Bytes.

Caller or entry	Evidence
authorize	Call site · Caller explanation

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

Crypto.random · interface dispatch

Inputs: size: int. Result: Bytes.

Caller or entry	Evidence
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation

authorization → time

1 operation, 3 sites

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
authorize	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

authorization → contracts

3 operations, 7 sites

AuthorizationCode · value construction

Inputs: clientId: string, redirectUri: string, challenge: string, nonce: string, subject: string, name: string, expires: int. Result: AuthorizationCode.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

AuthorizationRequest · value construction

Inputs: clientId: string, redirectUri: string, state: string, nonce: string, challenge: string, browser: string, csrf: string, expires: int. Result: AuthorizationRequest.

Caller or entry	Evidence
authorize	Call site · Caller explanation

LoginError · value construction

No caller-supplied inputs. Result: LoginError.

Caller or entry	Evidence
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation
authorize	Call site · Caller explanation

authorization → credentials

1 operation, 1 site

verifyCredentials

Inputs: username: string, password: string. Result: bool.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation

authorization → views

2 operations, 7 sites

ProviderFailure

Inputs: message: string. Result: Html.

Caller or entry	Evidence
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation
providerLogin	Call site · Caller explanation

ProviderLogin

Inputs: requestId: string, csrf: string, message: string, submit: HttpAction. Result: Html.

Caller or entry	Evidence
authorize	Call site · Caller explanation

credentials → crypto

3 operations, 4 sites

Crypto.decodeBase64url · interface dispatch

Inputs: input: string. Result: Bytes.

Caller or entry	Evidence
verifyCredentials	Call site · Caller explanation

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
verifyCredentials	Call site · Caller explanation
verifyCredentials	Call site · Caller explanation

Crypto.passwordHash · interface dispatch

Inputs: password: Bytes, salt: Bytes, iterations: int. Result: Bytes.

Caller or entry	Evidence
verifyCredentials	Call site · Caller explanation

discovery → common

2 operations, 2 sites

SigningKeys.provider · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
jwks	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
discovery	Call site · Caller explanation

discovery → crypto

3 operations, 3 sites

Crypto.publicRsa · interface dispatch

Inputs: key: RsaPrivateKey. Result: RsaPublicKey.

Caller or entry	Evidence
jwks	Call site · Caller explanation

RsaJwks · value construction

Inputs: keys: List<RsaJwk>. Result: RsaJwks.

Caller or entry	Evidence
jwks	Call site · Caller explanation

rsaJwk

Inputs: publicKey: RsaPublicKey, kid: string. Result: RsaJwk.

Caller or entry	Evidence
jwks	Call site · Caller explanation

token → common

3 operations, 4 sites

SigningKeys.provider · interface dispatch

No caller-supplied inputs. Result: RsaPrivateKey.

Caller or entry	Evidence
token	Call site · Caller explanation

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
_oauthError	Call site · Caller explanation
token	Call site · Caller explanation

settings

No caller-supplied inputs. Result: Settings.

Caller or entry	Evidence
token	Call site · Caller explanation

token → memory

2 operations, 2 sites

ExpiringStore.put · interface dispatch

Inputs: key: string, value: AccessGrant, expires: int, now: int. Result: void.

Caller or entry	Evidence
token	Call site · Caller explanation

ExpiringStore.take · interface dispatch

Inputs: key: string, now: int. Result: optional AuthorizationCode.

Caller or entry	Evidence
token	Call site · Caller explanation

token → crypto

4 operations, 4 sites

Crypto.equal · interface dispatch

Inputs: left: Bytes, right: Bytes. Result: bool.

Caller or entry	Evidence
token	Call site · Caller explanation

Crypto.random · interface dispatch

Inputs: size: int. Result: Bytes.

Caller or entry	Evidence
token	Call site · Caller explanation

Crypto.sha256 · interface dispatch

Inputs: input: Bytes. Result: Bytes.

Caller or entry	Evidence
token	Call site · Caller explanation

signJwt

Inputs: key: RsaPrivateKey, claims: Json, kid: string, tokenType: string. Result: string.

Caller or entry	Evidence
token	Call site · Caller explanation

token → time

1 operation, 1 site

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
token	Call site · Caller explanation

token → contracts

4 operations, 4 sites

AccessGrant · value construction

Inputs: subject: string, name: string, expires: int. Result: AccessGrant.

Caller or entry	Evidence
token	Call site · Caller explanation

IdClaims · value construction

Inputs: iss: string, sub: string, aud: string, exp: int, iat: int, nonce: string, name: string. Result: IdClaims.

Caller or entry	Evidence
token	Call site · Caller explanation

OAuthError · value construction

Inputs: error: string, error_description: string. Result: OAuthError.

Caller or entry	Evidence
_oauthError	Call site · Caller explanation

TokenResponse · value construction

Inputs: token_type: string, access_token: string, id_token: string, expires_in: int, scope: string. Result: TokenResponse.

Caller or entry	Evidence
token	Call site · Caller explanation

userinfo → common

1 operation, 2 sites

securityHeaders

No caller-supplied inputs. Result: Headers.

Caller or entry	Evidence
userinfo	Call site · Caller explanation
userinfo	Call site · Caller explanation

userinfo → memory

1 operation, 1 site

ExpiringStore.get · interface dispatch

Inputs: key: string, now: int. Result: optional AccessGrant.

Caller or entry	Evidence
userinfo	Call site · Caller explanation

userinfo → time

1 operation, 1 site

Clock.now · interface dispatch

No caller-supplied inputs. Result: int.

Caller or entry	Evidence
userinfo	Call site · Caller explanation

userinfo → contracts

1 operation, 1 site

UserInfo · value construction

Inputs: sub: string, name: string. Result: UserInfo.

Caller or entry	Evidence
userinfo	Call site · Caller explanation

views → common

1 operation, 2 sites

Page

Inputs: title: string, children: List<Html>. Result: Html.

Caller or entry	Evidence
ProviderLogin	Call site · Caller explanation
ProviderFailure	Call site · Caller explanation

What this folder exposes

Exports

Export the declaration AuthorizationRequest from contracts.aug. Export the declaration AuthorizationCode from contracts.aug. Export the declaration AccessGrant from contracts.aug. Export the declaration IdClaims from contracts.aug.

Export the declaration TokenResponse from contracts.aug. Export the declaration UserInfo from contracts.aug. Export the declaration Discovery from discovery.aug. Export the declaration discovery from discovery.aug.

Export the declaration jwks from discovery.aug. Export the declaration authorize from authorization.aug. Export the declaration providerLogin from authorization.aug. Export the declaration token from token.aug.

Export the declaration userinfo from userinfo.aug.

Files in this folder

Module	Read
provider/authorization.aug	Flow and sequences · Explanation
provider/contracts.aug	Flow and sequences · Explanation
provider/credentials.aug	Flow and sequences · Explanation
provider/discovery.aug	Flow and sequences · Explanation
provider/export.aug	Flow and sequences · Explanation
provider/token.aug	Flow and sequences · Explanation
provider/userinfo.aug	Flow and sequences · Explanation
provider/views.aug	Flow and sequences · Explanation